*[Sylvain Beucler](https://blog.beuc.net/) published a blog post about his [latest progress in making reproducible Windows builds](https://blog.beuc.net/posts/Reproducible_Windows_builds/) using the [MXE](http://mxe.cc/) cross-build environment, [`SOURCE_DATE_EPOCH`](https://reproducible-builds.org/specs/source-date-epoch/), etc.
*A new version of the [u-boot Universal Boot Loader](https://www.denx.de/wiki/U-Boot) was released, merging a changeset from Vagrant Cascadian [fixing time and umask embedded into generated images](http://git.denx.de/?p=u-boot.git;a=commit;h=8664ab7debabfb6e1049c81030c2a18fd3eecb58).
*[Mon 04 19:05 -KGB-0:#debian-reproducible- https://tests.reproducible-builds.org/debian/repository/debian/gcc-7_7.3.0-26+really21.0\~reproducible0.dsc has just been uploaded to https://wiki.debian.org/ReproducibleBuilds/ExperimentalToolchain](https://wiki.debian.org/ReproducibleBuilds/ExperimentalToolchain)
*Within Debian, Holger enquired about the status of Debian bug [#802241](https://bugs.debian.org/802241)("`dpkg`: please store the hash of the installed `.deb` and allow one to query it") which resulted in bug [#774415](https://bugs.debian.org/774415)("Please add the `srebuild` wrapper for reproducible builds") being assigned to the [devscripts](https://salsa.debian.org/debian/devscripts) package.
*[debian-installer: Please make the generated images reproducible](https://bugs.debian.org/900918)
*Mattia Rizollo updated the [experimental Debian toolchain](https://wiki.debian.org/ReproducibleBuilds/ExperimentalToolchain) to update the [Debian gcc-7 package]((https://tracker.debian.org/pkg/debian-installer)).
* u-boot v2018.07-rc1 [merged patch fixing time and umask embedded into images](http://git.denx.de/?p=u-boot.git;a=commit;h=8664ab7debabfb6e1049c81030c2a18fd3eecb58).
Patches filed
-------------
* FIXME: h01ger pinged "#802241: dpkg: please store the hash of the installed .deb and allow to query it"
Chris Lamb [submitted a merge request to the Debian Installer](https://salsa.debian.org/installer-team/debian-installer/merge_requests/3) to make the installation images (ISO, hd-media, netboot, etc,) bit-for-bit reproducible.
*[Securing Debian Software Updates with Skipchains and Verified Builds accepted for DebConf18](https://debconf18.debconf.org/talks/46-securing-debian-software-updates-with-skipchains-and-verified-builds/)
It currently requires a rebuild of the [GNU mtools](https://www.gnu.org/software/mtools/) that has patches from Debian bugs [#900409](https://bugs.debian.org/900409) & [#900410](https://bugs.debian.org/900410) applied. A tracking bug for this feature was filed as [#900918](https://bugs.debian.org/900918) against the [debian-installer](https://tracker.debian.org/pkg/debian-installer) package.
*[Reproducible Buster and beyond talk accepted for DebConf18](https://debconf18.debconf.org/talks/80-reproducible-buster-and-beyond/)
*[openSUSE/acl](https://bugzilla.opensuse.org/show_bug.cgi?id=1095795) date
* On Wednesday 13th June, Chris Lamb will present at [foss-backstage.de](https://foss-backstage.de) in Berlin, Germany [on reproducible builds and how they prevent developers being targets for malicious attacks](https://foss-backstage.de/session/think-youre-not-target-tale-3-developers).
*[Kirill Nikitin](https://people.epfl.ch/kirill.nikitin)'s talk entitled "[Securing Debian Software Updates with Skipchains and Verified Builds](https://debconf18.debconf.org/talks/46-securing-debian-software-updates-with-skipchains-and-verified-builds/)" as accepted by the [DebConf18](https://debconf18.debconf.org) programme committee.
* Our talk on "[Reproducible Buster and beyond](https://debconf18.debconf.org/talks/80-reproducible-buster-and-beyond/)" was also accepted for DebConf18.
Documentation updates
---------------------
* Chris Lamb updated the [diffoscope.org](https://diffoscope.org/) to [rewrite call to the readdir\_r(3) to use readdir(3) instead](https://salsa.debian.org/reproducible-builds/disorderfs/commit/fbfd4d0) as the former has been deprecated in glibc 2.24. This silences a `-Wdeprecated-declarations` GCC warning.
* Mattia Rizzolo updated the various `README` files on how to release the tarballs after moving to new infrastructure. ([1](https://salsa.debian.org/reproducible-builds/strip-nondeterminism/commit/9f1c756), [2](https://salsa.debian.org/reproducible-builds/disorderfs/commit/4810a11), [3](https://salsa.debian.org/reproducible-builds/reprotest/commit/1140670)), [4](https://salsa.debian.org/reproducible-builds/trydiffoscope/commit/63ae0f7))
* Chris Lamb also updated our [reproducible-builds.org](https://reproducible-builds.org/) website to [add Steven Chamberlain's "Fun with .buildinfo"](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/e8ed178) and [update the entry our DebConf17 status update](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/c59f287) to the [Talks & Resources](https://reproducible-builds.org/resources/) page.
* Anxhelo Lushka from Ura Design [provided us with a new visual layout and style guide](https://lists.reproducible-builds.org/pipermail/rb-general/2018-June/001001.html) for our website. This will hopefully be integrated in the next week or so.
* This week, 40 package reviews were been added, 16 have been updated and 37 have been removed in this week, adding to our [knowledge about identified issues](https://tests.reproducible-builds.org/debian/index_issues.html).
jenkins.debian.net development
------------------------------
There were a number of changes to our [Jenkins](https://jenkins.io/)-based testing framework that powers [tests.reproducible-builds.org](https://tests.reproducible-builds.org/), including:
* Holger Levsen:
*[Disable HTTPS redirects for tests.reproducible-builds.org](https://salsa.debian.org/qa/jenkins.debian.net/commit/20101007).
*[Use our own SSL cert for tests.reproducible-builds.org](https://salsa.debian.org/qa/jenkins.debian.net/commit/98759b20).
* Update a number URLs to match the [migration to salsa.debian.org](https://wiki.debian.org/Salsa/AliothMigration). ([1](https://salsa.debian.org/qa/jenkins.debian.net/commit/f9777bdd), [2](https://salsa.debian.org/qa/jenkins.debian.net/commit/93970226), [3](https://salsa.debian.org/qa/jenkins.debian.net/commit/b6b60b84). [4](https://salsa.debian.org/qa/jenkins.debian.net/commit/f613997e). [5](https://salsa.debian.org/qa/jenkins.debian.net/commit/533f17f2))
*[Handle a false-positive diskspace issue when building clisp](https://salsa.debian.org/qa/jenkins.debian.net/commit/e23f278d).
* Jelle van der Waa:
*[Remove installationa of `pacman-git`](https://salsa.debian.org/qa/jenkins.debian.net/commit/c414ae7f) in [Arch Linux](https://www.archlinux.org/) reproducibility testing.
Misc.
-----
This week's edition was written by Bernhard M. Wiedemann, Chris Lamb, Holger Levsen, Vagrant Cascadian & reviewed by a bunch of Reproducible Builds folks on IRC & the mailing lists.
Chris Lamb authored56aee728