summary:Reproducible builds developer *kpcyrd* reported that that the <a href="https://archlinux.org/">Arch Linux</a> "minimal container userland" <a href="https://lists.reproducible-builds.org/pipermail/rb-general/2024-March/003301.html">is now 100% reproducible</a>.
summary:<a href="https://delta.chat">Delta Chat</a>, an open source messaging application that can work over email, announced that the Rust-based core library underlying Delta chat application <a href="https://chaos.social/@delta/112047758353026678">is now reproducible</a>.
summary:On the <a href="https://discourse.nixos.org/t/nixos-reproducible-builds-minimal-installation-iso-successfully-independently-rebuilt/34756">NixOS Discourse instance</a>, Arnout Engelen (*raboof*) announced that NixOS have created an independent, bit-for-bit identical rebuilding of the `nixos-minimal` image that is used to install NixOS.
summary:<a href="https://sethmlarson.dev/">Seth Larson</a> published a blog post <a href="https://sethmlarson.dev/security-developer-in-residence-weekly-report-14">investigating the reproducibility of the CPython source tarballs</a>.
summary:The <a href="https://www.yoctoproject.org/">Yocto Project</a> reported that it's core metadata (OpenEmbedded-Core) is now reproducible for all recipes (100% coverage) after issues with newer languages such as Golang were resolved.
summary:Hervé Boutemy <a href="https://lists.reproducible-builds.org/pipermail/rb-general/2022-March/002529.html">posted to our mailing list with an announcement</a> that the Java Reproducible Central has hit the milestone of "500 fully reproduced builds of upstream projects".
blog:"reports/2022-03"
-title:Debian
image:"/images/reports/2022-08/debian.png#right"
image_url:https://debian.org/
summary:In <a href="https://debian.org/">Debian</a>, the `essential` and `required` package sets became 100% reproducible in Debian *bookworm* on the `amd64` and `arm64` architectures.
blog:"reports/2022-08#debian"
-year:2021
success_stories:
-title:Tor browser
image:"/images/logos/tor.png"
image_url:https://www.torproject.org/
summary:The secure/anonymous <a href="https://www.torproject.org/">Tor browser</a> now supports reproducible source releases.
blog:"reports/2021-12"
-year:2016
success_stories:
-title:Coreboot Images
image:images/logos/coreboot.png
image_url:https://www.coreboot.org/
summary:<a href="https://www.phoronix.com/scan.php?page=news_item&px=Coreboot-100-Reproducible-Build">100% Of The 289 Coreboot Images Are Now Built Reproducibly</a> by Phoronix.
blog:"blog/posts/87#media-coverage"
-title:Scala
image:images/reports/2019-04/scala.png#right
image_url:https://www.scala-lang.org/
summary:The first non-trivial library written in the <a href="https://www.scala-lang.org/">Scala</a> programming language on the <a href="https://reproducible-builds.org/docs/jvm/">Java Virtual Machine</a> was released with Arnout Engelen's <a href="https://github.com/raboof/sbt-reproducible-builds">`sbt-reproducible-builds`</a> plugin enabled during the build. This resulted in <a href="https://akka.io/blog/news/2019/04/03/akka-2.5.22-released">Akka 2.5.22</a> becoming reproducible, both for the artifacts built with version <a href="https://arnout.engelen.eu/rb/akka/2.12/2.5.22/">2.12.8</a> and 2.13.0-RC1 of the Scala compiler.
This page lists the products, which are shipping with verifiable reproducible builds in the real world. 100% reproducible projects are considered as success stories.
{% for section in site.data.success_stories %}
<h2>{{ section.year }}</h2>
<divclass="container">
{% for item in section.success_stories %}
<divclass="row mb-4">
<divclass="col-sm d-flex justify-content-end">
<ahref="{{ item.image_url }}">
<imgsrc="{{ item.image | relative_url }}">
</a>
</div>
<divclass="col-sm">
<h3class="mt-0">{{ item.title }}</h3>
{{ item.summary }}
<br>
<ahref="{{ item.blog | relative_url }}">Read more on our blog.</a>
</div>
</div>
{% endfor %}
</div>
{% endfor %}
## F-Droid
All F-Droid apps published with Reproducible Builds.
On the [NixOS Discourse instance](https://discourse.nixos.org/t/nixos-reproducible-builds-minimal-installation-iso-successfully-independently-rebuilt/34756), Arnout Engelen (*raboof*) announced that NixOS have created an independent, bit-for-bit identical rebuilding of the `nixos-minimal` image that is used to install NixOS. [In their post](https://discourse.nixos.org/t/nixos-reproducible-builds-minimal-installation-iso-successfully-independently-rebuilt/34756), Arnout details what exactly can be reproduced, and even includes some of the history of this endeavour:
> You may remember a [2021 announcement](https://discourse.nixos.org/t/nixos-unstable-s-iso-minimal-x86-64-linux-is-100-reproducible/13723) that the minimal ISO was 100% reproducible. While back then we successfully tested that all packages that were needed to build the ISO were individually reproducible, actually rebuilding the ISO still introduced differences. This was due to [some remaining problems](https://github.com/NixOS/nixpkgs/issues/125380) in the hydra cache and the way the ISO was created. By the time we fixed those, regressions had popped up (notably an upstream problem in Python 3.10), and it isn’t until this week that we were back to having everything reproducible and being able to validate the complete chain.
🎉 Congratulations to NixOS team for reaching this important milestone! Discussion about this announcement [can be found underneath the post](https://discourse.nixos.org/t/nixos-reproducible-builds-minimal-installation-iso-successfully-independently-rebuilt/34756#post_2) itself, as well as [on Hacker News](https://news.ycombinator.com/item?id=38057591).
## [CPython source tarballs now reproducible]({{ "reports/2023-10#cpython-source-tarballs-now-reproducible" | relative_url }})
[Seth Larson](https://sethmlarson.dev/) published a blog post [investigating the reproducibility of the CPython source tarballs](https://sethmlarson.dev/security-developer-in-residence-weekly-report-14). Using [*diffoscope*](https://diffoscope.org/), *reprotest* and other tools, Seth documents his work that led to [a pull request to make these files reproducible](https://github.com/python/release-tools/pull/62) which was merged by [Łukasz Langa](https://lukasz.langa.pl/).
### March 2024
## [Arch Linux minimal container userland now 100% reproducible]({{ "reports/2024-03#arch-linux-minimal-container-userland-now-100-reproducible" | relative_url }})
In remarkable news, Reproducible builds developer *kpcyrd* reported that that the [Arch Linux](https://archlinux.org/) "minimal container userland" [is now 100% reproducible](https://lists.reproducible-builds.org/pipermail/rb-general/2024-March/003301.html) after work by developers *dvzv* and *Foxboron* on the one remaining package. This represents a "real world", widely-used Linux distribution being reproducible.
Their post, which *kpcyrd* suffixed with the question "now what?", continues on to outline some potential next steps, including validating whether the container image itself could be reproduced bit-for-bit. The post, which was itself a followup for an [Arch Linux update earlier in the month](https://lists.reproducible-builds.org/pipermail/rb-general/2024-March/003291.html), generated a [significant number of replies](https://lists.reproducible-builds.org/pipermail/rb-general/2024-March/thread.html#3301).
### Delta chat clients now reproducible({{ "reports/2024-03#delta-chat-clients-now-reproducible" | relative_url }})
[Delta Chat](https://delta.chat), an open source messaging application that can work over email, announced this month that the Rust-based core library underlying Delta chat application [is now reproducible](https://chaos.social/@delta/112047758353026678).
## 2022
### The Yocto Project's core metadata (OpenEmbedded-Core) is now reproducible for all recipes (100% coverage)
The [Yocto Project](https://www.yoctoproject.org/) is pleased to report that it's core metadata (OpenEmbedded-Core) is now reproducible for all recipes (100% coverage) after issues with newer languages such as Golang were resolved. This was announced in their recent [Year in Review](https://www.yoctoproject.org/2021-a-year-in-review/) publication. It is of particular interest for security updates so that systems can have specific components updated but reducing the risk of other unintended changes and making the sections of the system changing very clear for audit.
The project is now also making heavy use of "equivalence" of build output to determine whether further items in builds need to be rebuilt or whether cached previously built items can be used. As mentioned in the article above, there are now public servers sharing this equivalence information. Reproducibility is key in making this possible and effective to reduce build times/costs/resource usage.
# Collection
"products", which are shipping with verifyable reproducible builds in the real world,
like **tails** and what else? ;)
**yocto base image**, I believe. docker.debian.net images maybe.
Some **BSD, NixOS, Guix, F-Droid** parts too, probably.
In a way I'd only want 100% reproducible projects here,
but then I'd also think something like
*"yocto base images are reproducible, whether your yocto image is reproducible depends.."*
is a success story.
"**Debian Live-CD images** distributed from ftp.d.o are reproducible and this is
systematically being verified" is also a success story,
while Debian packages can maybe be reproduced if one manages to recreate the
build environment OTOH is IMO not yet a success story worth mentioning here.
### collect success stories:
we put them in our monthly blog but we don't have a more systematic overview -
by following our monthly blog and reading up on "older" posts from the last 12 months.
# Real world success stories: What we know works
This is from [hamburg2023]({{"/events/hamburg2023/success" | relative_url}})
- clear cases
-`SOURCE_DATE_EPOCH`*widely* honored and standardized
- ElectroBSD (distribution tar balls amd64)
- near 500 Java project produce RB releases (see Reproducible Central)
- Yocto base
- NixOS minimal installation ISO reproducible
- Tails ISO
- Tor Browser is reproducible
- Debian docker images
- diverse double compilation to encounter Trusting-trust attacs
- Debian policy
- bitcoin core
- find+fix corruption bugs
- nobody knows (missing docs etc)
- zig
- go toolchain?
- android
- Spoon: An AST parsing and transformation library for Java
https://github.com/INRIA/spoon
- openSUSE at 97%
- GitHub reproroducible build badge
- spytrap-adb
- F-Droid 90% new apps included are reproducible
- bootstrappable.org
- coreboot
- deveoper stories
# Real world success stories we need or are searching for
(RB Success Stories Desired)
## column 1: < 100%
* 96% binary pkg reproducible debian cloud image
* K && N trust in GNU Guix substitues by default
* Debug Packages
* Debian Install Images reproducible
## column 2
* 150 java projects try fail at getting RB release (really hard to read) J
* f-droid: older apps RB verify but not yet switched
* only release reproducible packages (stage until verified)
## column 3
* Reproducible compilers built with other compilers. e.g. gcc built via clang then rebuild gcc with that
* setting up CI RB system for FEdora RPMs
* Install images rebuilt on different distro
* Install images rebuilt by different organisations
* Repo reproducible as opposed to deterministic build
