Fay 🏳️‍🌈

@mynacol @IzzyOnDroid

as for rbtlog: forking my original github repo (without the existing recipes, the code branch is meant for exactly that purpose) and using the existing github actions is probably one of the easiest ways to run a small builder of your own without having to set up any servers yourself

currently, Izzy's builder is focused on IoD and keeping us quite busy and mine is focused on further development of the code instead of building more than a handful of apps

perhaps bg443, who runs a small independent builder, would be interested in collaborating with you

we of course very much welcome people running their own independent builders for apps we don't cover as well as to verify our results independently :)

foss, techbros, anarchism

@IzzyOnDroid has been doing an amazing job getting our repo to over 30% of apps being reproducible. Maintaining a rebuilder takes a lot of constant work. Thank you!

As I've written before:

[...] the ecosystem is constantly moving: old toolchain and dependency bugs get fixed, but new ones keep popping up. [...] Reproducible Builds are not just an item on a checklist [...] It's an ongoing process involving not just upstream app developers, but also maintainers of repositories, clients, and rebuilders; those involved in outreach and writing documentation; developers and maintainers of tooling, toolchains, and dependencies. And often requires a lot of collaborative debugging :)

See also our "Review of 2024 and Outlook for 2025: Reproducible Builds, Security Measures and more":

https://android.izzysoft.de/articles/named/review-2024-outlook-2025

#IzzyOnDroid #ReproducibleBuilds

I accidentally found another security vulnerability in fdroidserver whilst working on something related to IzzyOnDroid.

We warned them months ago but were ignored *sigh*

"Another fdroidserver AllowedAPKSigningKeys certificate pinning bypass"

https://www.openwall.com/lists/oss-security/2025/01/03/1

#IzzyOnDroid #Security

new addition to my ublock origin filters:

github.com##.AppHeader-CopilotChat

I did some testing with zlib-ng, which Fedora and Arch are already using as a replacement for the original zlib and Debian plans to as well, and I'm not happy with what I found.

[...] With the original zlib, you will always get an identical output stream given the same input stream and compressor parameters [...] I expected that zlib-ng would often produce a different output steam than the original, but what I found was a lot more non-deterministic than just that.

With zlib-ng, feeding the data into the compressor in e.g. 1024-byte chunks always gave me a different output stream than using 4096-byte chunks [...] In fact, every chunk size I tried gave a different output. And that's with fixed size chunks, which is not a given if you're handling e.g. a stream of input.

Even using the same buffer size, I cannot get an identical compressed output stream with Python and Java any more [...]

https://lists.debian.org/debian-devel/2024/12/msg00356.html

#ReproducibleBuilds

I my friends

The October 2024 report from the Reproducible Builds project has just been published.

This month includes an Android toolchain bug I reported to Google having been fixed: "Number of cores affected Android compiler output".

And of course "@IzzyOnDroid passed 25% reproducible apps"

https://reproducible-builds.org/reports/2024-10/

#ReproducibleBuilds #IzzyOnDroid

Please try to support disabled and chronically ill people and include us in offline communities and support networks if you can. Many of us only have online spaces like fedi and e.g. cannot attend IRL meetings (without help).

So... this was a fun compiler bug: the D8 Java to DEX compiler (part of the Android toolchain) eliminated a redundant field load if running the class's static initialiser was known to be free of side effects, which ended up accidentally depending on the sharding of the input, which is dependent on the number of CPU cores used during the build.

https://issuetracker.google.com/issues/366412380

I made a small example to illustrate why this optimisation is only valid when the class initialiser doesn't have side effects (or the initialiser is guaranteed to have run already, which is the case for a base class of the current one):

https://gist.github.com/obfusk/83822140509dad4148b14bba41adf008

#ReproducibleBuilds