Jetzt ist auch die deutschsprachige Version unseres "Jahresberichts" online:

Ein Blick zurück, ein Blick voraus: Wie war 2024 bei #IzzyOnDroid? Was mag Euch 2025 hier bringen, woran arbeiten wir?

android.izzysoft.de/articles/n…

Und wenn Euch jemand sagt, #security oder #reproducibleBuilds wären (einmal aufgesetzt) reine Selbstläufer: Lacht sie laut aus. Software entwickelt sich weiter – und so auch ihre Risiken und Threats…

Rückblick auf 2024 und Ausblick auf 2025: Reproducible Builds, Sicherheitsmaßnahmen, und mehr

2024 winkt zum Abschied, 2025 klopft an die Tür: Was haben wir 2024 erreicht, und was sind unsere Pläne und Hoffnungen für 2025? Werft mit uns einen Blick zurück auf die eingeführten Sicherheitsmaßnahmen, auf die Fortschritte bei Reproducible Builds …

^IzzyOnDroid

A look back, a look ahead: How was 2024 at IzzyOnDroid? What might 2025 bring you there, what are we working on?

android.izzysoft.de/articles/n…

And if anybody ever tells you #security or #reproducibleBuilds are "set-and-forget", laugh straight into their faces. Software evolves, and so do their threats and risks…

German readers: Die Deutsche Version folgt in Kürze…

#IzzyOnDroid

Review of 2024 and Outlook for 2025: Reproducible Builds, Security Measures and more

2024 waves goodbye, 2025 knocks at the door: what did we achieve in 2024, and what are our plans and hopes for 2025? Join us to take a look back at security measures established, at progress with Reproducible Builds – and for a look ahead of what mig…

^IzzyOnDroid

Welcome to the RB family, PuppyGit 🥳

apt.izzysoft.de/packages/com.c…

PuppyGit is a Git client for Android. Thanks to the enormous efforts by its developer who even rewrote their entire build workflow, PuppyGit was now confirmed reproducible

RB stats now: 376 apps (30.7%)

#reproducibleBuilds #IzzyOnDroid

„PuppyGit“ – IzzyOnDroid F-Droid Repository

An Android Git Client

^{IzzyOnDroid App Repo}

I did some testing with zlib-ng, which Fedora and Arch are already using as a replacement for the original zlib and Debian plans to as well, and I'm not happy with what I found.

[...] With the original zlib, you will always get an identical output stream given the same input stream and compressor parameters [...] I expected that zlib-ng would often produce a different output steam than the original, but what I found was a lot more non-deterministic than just that.

With zlib-ng, feeding the data into the compressor in e.g. 1024-byte chunks always gave me a different output stream than using 4096-byte chunks [...] In fact, every chunk size I tried gave a different output. And that's with fixed size chunks, which is not a given if you're handling e.g. a stream of input.

Even using the same buffer size, I cannot get an identical compressed output stream with Python and Java any more [...]

lists.debian.org/debian-devel/…

#ReproducibleBuilds

Welcome to the RB family, Method Call 🥳

apt.izzysoft.de/packages/com.c…

Method Call is mapping phone numbers to a defined list of actions.

Thanks to combined efforts with its developer, this app is now RB

RB status: 374 apps (30.6%)

#IzzyOnDroid #reproducibleBuilds

„Method Call“ – IzzyOnDroid F-Droid Repository

Automate your Android with phone calls.

^{IzzyOnDroid App Repo}

@IzzyOnDroid @SylvieLorxu I would be happy to see your repo become #FreeSoftware! As you well know, F-Droid only endorses verifiable free software projects.

It is also great to see all your work on #ReproducibleBuilds. We are continuing to build upon our years of effort there. Our approach is focused on identifying issues and getting things fixed upstream as much as possible. Then devs do not need to use any special tools to achieve reproducible builds.

@SylvieLorxu @IzzyOnDroid

Yes, there is plenty of low hanging fruit like embedded timestamps or nondeterministic ordering. Many apps are already easily reproducible or require only small fixes.

But the ecosystem is constantly moving: old toolchain and dependency bugs get fixed, but new ones keep popping up.

Reproducible Builds are not just an item on a checklist, something you (ask upstreams to) enable and then you're done. Especially when it's a hard requirement like at F-Droid where new builds no longer being reproducible means users will not be able to get updates.

It's an ongoing process involving not just upstream app developers, but also maintainers of repositories, clients, and rebuilders; those involved in outreach and writing documentation; developers and maintainers of tooling, toolchains, and dependencies. And often requires a lot of collaborative debugging :)

It requires teamwork and an ongoing commitment to investigate and fix new issues when they pop up.

#ReproducibleBuilds

Welcome to the RB family, Neo Backup 🥳

apt.izzysoft.de/packages/com.m…

Neo Backup is a fork of OAndBackup bringing support for new Android versions & updated looks. It lets you make and restore backups of apps on your device and save app data to a user-accessible location. Needs root.

After figuring how to get the zlib-ng issue disappear (not me!) the app is now RB & the new release tomorrow will have the green shield up

#reproducibleBuilds #IzzyOnDroid – now at 370 apps (30.2%) & growing

„Neo Backup“ – IzzyOnDroid F-Droid Repository

The open-source tool to backup your apps and data

^{IzzyOnDroid App Repo}

#AndroidAppRain at apt.izzysoft.de/fdroid today brings you 15 updated and 2 added apps:

* QuickEdit: a basic and lightweight Photo Editor 🛡️
* TriliumDroid: cross-platform hierarchical note taking app, for large personal knowledge bases 🛡️

And we reached a new milestone a few weeks earlier than expected: 30% of the apps at #IzzyOnDroid are now #reproducibleBuilds 🥳

Enjoy your #free #Android #apps with the #IzzyOnDroid repo

IzzyOnDroid F-Droid Repository

This is a repository of apps to be used with your F-Droid client. Applications in this repository are official binaries built by the original application developers, taken from their resp. repositories (mostly Github, GitLab, Codeberg).

^{IzzyOnDroid App Repo}

The year's not yet up, but our RB statistics already have their days full:

365 apps (29.9%)

So while we started establishing RB for our repo only in February this year, we have added more than 1 app each day, on average. Just a little more, and we cross the 30% mark 🥳

#reproducibleBuilds #IzzyOnDroid

Welcome to the RB family, LibChecker 🥳

apt.izzysoft.de/packages/com.a…

LibChecker is an application to view and analyze the third-party libraries used by a given app.

Thanks to the help of its author, we now succeeded to build it reproducibly – bringing the number of RB apps to a "full circle" of 360° (360 apps (29.4%))

#reproducibleBuilds #IzzyOnDroid

„LibChecker“ – IzzyOnDroid F-Droid Repository

Viewing architecture of applications

^{IzzyOnDroid App Repo}

Welcome to the RB family, Rsync for Tasker 🥳

apt.izzysoft.de/packages/com.n…

Rsync for Tasker provides Tasker plugin actions to allow running rsync over SSH.

Thanks to the joint efforts with its developer (mostly THEIR efforts!), we just now were able to make it RB

#reproducibleBuilds #IzzyOnDroid

„Rsync for Tasker“ – IzzyOnDroid F-Droid Repository

^{IzzyOnDroid App Repo}

Welcome to the RB family, OpenAthena™ 🥳

apt.izzysoft.de/packages/com.o…

OpenAthena™ is a project that enables consumer and professional drones to identify precise locations based on their images.

After getting rid of some Umlaut in a file name, the code did not only compile – but resulted in a reproducible build. So the new release that shows up in about 2 hours from now will have the green shield up

#reproducibleBuilds #IzzyOnDroid

„OpenAthena™ for Android“ – IzzyOnDroid F-Droid Repository

OpenAthena™ lets common drones spot precise locations

^{IzzyOnDroid App Repo}

Welcome to the RB family, Subway Tooter! 🥳

apt.izzysoft.de/packages/jp.ju…

Subway Tooter is a Mastodon client for Android 8.0 or later.

With a little help from its dev, the libre (aka NoFcm) variant has now been confirmed to be reproducible

Bringing the RB status to: 345 apps (28.5%) (and the "egg status" to 3.5).

#reproducibleBuilds #IzzyOnDroid

„Subway Tooter“ – IzzyOnDroid F-Droid Repository

Simple, and powerful Mastodon client app.

^{IzzyOnDroid App Repo}

Welcome to the RB family, OpenSCQ30 🥳

apt.izzysoft.de/packages/com.o…

OpenSCQ30 is free software for controlling settings for the Soundcore Q30 headphones.

Took us (the author and IoD) quite some efforts to get the "rusty" things at bay, but we finally succeeded – thanks a lot, @oppzippy

Green shield will show up with the new release on the next sync around 7 pm UTC.

#reproducibleBuilds #IzzyOnDroid

„OpenSCQ30“ – IzzyOnDroid F-Droid Repository

controll settings of Soundcore Q30 headphones

^{IzzyOnDroid App Repo}

Welcome to the RB family, Canta 🥳

apt.izzysoft.de/packages/org.s…

Canta allows you to uninstall any app from your device, even if you don't have root access.

Once more, joint efforts by IzzyOnDroid and the author led to a successful RB

RB status at IoD now: 341 apps (28.2%)

#reproducibleBuilds #IzzyOnDroid

„Canta“ – IzzyOnDroid F-Droid Repository

Uninstall any app without root!

^{IzzyOnDroid App Repo}

Yesterday added to the #IzzyOnDroid repo – today made RB: welcome to the RB family, TubeSync! 🥳

apt.izzysoft.de/packages/tubes…

TubeSync lets you sync YouTube playlists offline. After we figured the Flutter version used "upstream", we could successfully prove the app as one of the #reproducibleBuilds

„TubeSync“ – IzzyOnDroid F-Droid Repository

Sync YouTube playlists offline. Because YT Music is too costly

^{IzzyOnDroid App Repo}

#AndroidAppRain at apt.izzysoft.de/fdroid today brings you 16 updated and 1 new apps:

* rbtlui: if you always wanted to explore our #reproducibleBuilds this app is for you: rbtlui provides a graphical interface to explore the builders verifying the apps (and the verified apps themselves) provided by IzzyOnDroid on reproducibility. Of course rbtlui is RB itself 🛡️

So thanks to @bg443 for rbtlui! And enjoy your #free #Android #apps with the #IzzyOnDroid repo

IzzyOnDroid F-Droid Repository

This is a repository of apps to be used with your F-Droid client. Applications in this repository are official binaries built by the original application developers, taken from their resp. repositories (mostly Github, GitLab, Codeberg).

^{IzzyOnDroid App Repo}

Welcome to the RB family, MultiLocale 🥳

apt.izzysoft.de/packages/io.ni…

MultiLocale enables you to add additional (or "unsupported") languages to your device's locale settings, if the OEM doesn't let you.

With joint efforts, the app's author and I got it RB. The repo here should reflect that with the next release.

#reproducibleBuilds #IzzyOnDroid

„MultiLocale“ – IzzyOnDroid F-Droid Repository

add languages to your device's locale

^{IzzyOnDroid App Repo}

WLED Native now got entirely rid of the last proprietary components and no longer needs a separate FOSS flavor. What's more: it was just confirmed to be reproducible 🥳

apt.izzysoft.de/packages/ca.cg…

WLED - Native lets you easily and efficiently manage and control all your WLED light devices from your Android device.

#reproducibleBuilds #FOSS #IzzyOnDroid

„WLED Native“ – IzzyOnDroid F-Droid Repository

Find, manage and control all your WLED devices from your android device

^{IzzyOnDroid App Repo}

Welcome to the RB family, Habit Builder 🥳

apt.izzysoft.de/packages/com.o…

Habit Builder provides you with the right tools to keep track of your habits and understand your progress.

Once more, joint efforts with the developer managed to get the app reproducible

#reproducibleBuilds #IzzyOnDroid

„Habit Builder“ – IzzyOnDroid F-Droid Repository

Simple habit tracker with insights

^{IzzyOnDroid App Repo}

Welcome to the RB family, Beans 🥳

apt.izzysoft.de/packages/net.h…

Beans is a scratchmap of the world that lets you keep track of your discovery of the world on a colorful visual map.

Joint efforts with its developer succeeded in making this app reproducible

#reproducibleBuilds #IzzyOnDroid

„Beans“ – IzzyOnDroid F-Droid Repository

A virtual scratchmap of the world

^{IzzyOnDroid App Repo}

The October 2024 report from the Reproducible Builds project has just been published.

This month includes an Android toolchain bug I reported to Google having been fixed: "Number of cores affected Android compiler output".

And of course "@IzzyOnDroid passed 25% reproducible apps"

reproducible-builds.org/report…

#ReproducibleBuilds #IzzyOnDroid

#AndroidAppRain at apt.izzysoft.de/fdroid today brings you 12 updated and 3 added apps:

* Aurora Store: the inofficial PlayStore client has been added on special request. At IoD it's one of the #reproducibleBuilds 🛡️
* Aegis: the 2FA app has been added at special request, too
* OpenBible: download & read the bible in different languages 🛡️

RB: 320 apps (26.5%)

Enjoy your #free #Android #apps with the #IzzyOnDroid repo

IzzyOnDroid F-Droid Repository

This is a repository of apps to be used with your F-Droid client. Applications in this repository are official binaries built by the original application developers, taken from their resp. repositories (mostly Github, GitLab, Codeberg).

^{IzzyOnDroid App Repo}

#AndroidAppRain at apt.izzysoft.de/fdroid today brings you 5 updated and 1 added apps:

* File Explorer: a full-featured and lightweight file manager (successor of the app by the same name, entirely rewritten)

Further, I succeeded in establishing some more apps as #reproducibleBuilds – bringing the count up to 318 apps (26.4%).

At apt.izzysoft.de/magisk 6 #Magisk #modules have been updated.

Enjoy your #free #Android #apps with the #IzzyOnDroid repo

IzzyOnDroid F-Droid Repository

This is a repository of apps to be used with your F-Droid client. Applications in this repository are official binaries built by the original application developers, taken from their resp. repositories (mostly Github, GitLab, Codeberg).

^{IzzyOnDroid App Repo}

Welcome to the RB family, Innertune 🥳

apt.izzysoft.de/packages/com.m…

InnerTune is a fork of InnerTune – a Material 3 YouTube Music client for Android.

Thanks to Malopieds (the author of this fork) for making this possible

#reproducibleBuilds #IzzyOnDroid

„InnerTune“ – IzzyOnDroid F-Droid Repository

A fork of InnerTune, a Material 3 YouTube Music client for Android

^{IzzyOnDroid App Repo}

#AndroidAppRain at apt.izzysoft.de/fdroid today brought you 16 updated apps, but also 2 apps were removed:

* DiviDoc contains a self-updater, and its author did not respond to our issue
* URL to PDF was rebranded to WebCapture more than a month ago, so the "old" app was removed

Further, several more apps could be confirmed as #reproducibleBuilds – bringing their total number here up to 315 (or relative: 26.2%).

Enjoy your #free #Android #apps with the #IzzyOnDroid repo

IzzyOnDroid F-Droid Repository

This is a repository of apps to be used with your F-Droid client. Applications in this repository are official binaries built by the original application developers, taken from their resp. repositories (mostly Github, GitLab, Codeberg).

^{IzzyOnDroid App Repo}

And welcome to the RB family, Telewatch 🥳

apt.izzysoft.de/packages/com.g…

Telewatch is a Telegram client for Android watches.

#reproducibleBuilds #IzzyOnDroid

„Telewatch“ – IzzyOnDroid F-Droid Repository

Telegram for watch

^{IzzyOnDroid App Repo}

Welcome to the RB family, Soul Searching 🥳

apt.izzysoft.de/packages/com.g…

Soul Searching is an offline music application for Android 8 and above. It's a rework of the native mobile application Sweet Music using Jetpack Compose.

This was quite a journey fighting compression algorithms (Fedora using zlib-ng instead of zlib), but thanks to joint efforts and hard work of the author (thanks entername74!), it was finally made RB

Btw: 313 apps / 26% now 😉

#reproducibleBuilds #IzzyOnDroid

„Soul Searching“ – IzzyOnDroid F-Droid Repository

^{IzzyOnDroid App Repo}

So... this was a fun compiler bug: the D8 Java to DEX compiler (part of the Android toolchain) eliminated a redundant field load if running the class's static initialiser was known to be free of side effects, which ended up accidentally depending on the sharding of the input, which is dependent on the number of CPU cores used during the build.

issuetracker.google.com/issues…

I made a small example to illustrate why this optimisation is only valid when the class initialiser doesn't have side effects (or the initialiser is guaranteed to have run already, which is the case for a base class of the current one):

gist.github.com/obfusk/8382214…

#ReproducibleBuilds

issuetracker.google.com/issues/366412380

https://issuetracker.google.com/issues/366412380. GitHub Gist: instantly share code, notes, and snippets.

^Gist

Welcome to the RB family, Hash Checker 🥳

apt.izzysoft.de/packages/com.s…

Hash Checker is an app for generating and comparison MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512 and CRC-32 hashes from files or text. Thanks to the efforts by its dev, today's release is now RB

#reproducibleBuilds #IzzyOnDroid

#AndroidAppRain at apt.izzysoft.de/fdroid today brings you 10 updated & 1 removed apps:

SwiftNotes had to be removed again due to license/copyright reasons (a fork without giving credits), it's repo is meanwhile unavailable too.

Updated apps include Catima, fixing a regression introduced with yesterday's update (yupp, @SylvieLorxu is fast with fixing and really taking care! 😍).

All 7 #reproducibleBuilds succeeded as well!

Enjoy your #free #Android #apps with the #IzzyOnDroid repo

IzzyOnDroid F-Droid Repository

This is a repository of apps to be used with your F-Droid client. Applications in this repository are official binaries built by the original application developers, taken from their resp. repositories (mostly Github, GitLab, Codeberg).

^{IzzyOnDroid App Repo}

Welcome to the RB family, Privacy Lock 🥳

apt.izzysoft.de/packages/com.p…

Privacy Lock offers an extra layer of security on top of Android’s built-in features – like "shake to lock". Its next release should show the "green shield".

#reproducibleBuilds #IzzyOnDroid

„Paranoid's Pal - Privacy Lock“ – IzzyOnDroid F-Droid Repository

Protecting Your Digital Identity

^{IzzyOnDroid App Repo}

Welcome to the RB family, OwnDroid 🥳

apt.izzysoft.de/packages/com.b…

OwnDroid lets you use Device admin and Device owner privilege to fully manage your Android device. Thanks to joint efforts with its author, this app is now reproducible (starting with v6.1 which will go live with the next sync in less than 6 hours)

#reproducibleBuilds #IzzyOnDroid

„OwnDroid“ – IzzyOnDroid F-Droid Repository

Manage your device with Device owner privilege

^{IzzyOnDroid App Repo}

Welcome to the RB family, WikiReader 🥳

apt.izzysoft.de/packages/org.n…

WikiReader is a lightweight Android app for reading Wikipedia articles distraction-free. Supports light mode, dark mode and Material You dynamic colors.

Thanks to Nishant's work on it, we were now able to build it reprocucibly

#reproducibleBuilds #IzzyOnDroid

„WikiReader“ – IzzyOnDroid F-Droid Repository

Read Wikipedia pages distraction-free

^{IzzyOnDroid App Repo}

🇩🇪 "In jedem vierten Ei!" 🎶

Jupp, es ist soweit: 305 apps (25%) bei #IzzyOnDroid sind jetzt #reproducibleBuilds 🥳

Ich fürchte das heißt aber auch: keine "Eier-Toots" bis auf weiteres – das "dritte Ei" liegt in zu weiter Ferne, das wird dieses Jahr nichts mehr 🤣

Oh, well, that brings us to the "4th egg" now:

305 apps (25%) are #reproducibleBuilds now at #IzzyOnDroid 🥳