#ReproducibleBuilds talk at #FOSSY2025 went pretty well today, presented by myself and my colleague Chris Lamb...
For bonus fun, I used the #MNTReform to present!
Slides available:
people.debian.org/~vagrant/fos…
... as well as a .buildinfo file if you want to try and bit-for-bit reproduce the slides, although I did it using an arm64 machine:
people.debian.org/~vagrant/fos…
Video should be available in a month or so, hopefully?
W00t, w00t! New NeoStore (one of our F-Droid clients) arrived, now showing the RB status directly next to the versions of each app 🥳
#IzzyOnDroid #reproducibleBuilds
I believe it will be recorded and live streamed ... presuming, of course, no serious intervention by gremlins!
I have not followed closely, but always glad to see all the work done verifying android apps!
#ReproducibleBuilds has definitely grown to span many different types of software, and really it should be helpful everywhere!
will the session be recorded, for those who cannot attend in person? Running multiple RB verification builders for Android apps ourselves (see e.g. android.izzysoft.de/articles/n… and codeberg.org/IzzyOnDroid/rbtlo… plus codeberg.org/bg443/rbtlog / shields.rbtlog.dev/), we're of course interested in what you and Chris have to say 🤗
Spannende Neuigkeiten im IzzyOnDroid Repo: Jetzt haben wir reproduzierbare Builds, spezifische Unterstützung durch einige der beliebtesten F-Droid-Clients und mehr!IzzyOnDroid
Welcome to the RB family, FlorisBoard 🥳
apt.izzysoft.de/packages/dev.p…
FlorisBoard is your versatile keyboard app, loaded with many features, keyboard layouts, skins and more. At IzzyOnDroid, we ship the "early birds": alpha & beta versions.
Thanks to the hard work of the FlorisBoard team (thank you so much, Patrick & lm41!), the app is finally RB!
#reproducibleBuilds #IzzyOnDroid
Beta of FlorisBoard, the open-source keyboard which respects your privacy.IzzyOnDroid Repo Browser
(2/2)
And just 15 days before the first anniversary of our public RB GoLive (which happened on August 1st, 2024), we've reached 50% coverage:
Every 2nd app at IzzyOnDroid is now RB! 🥳
Welcome to the RB family, KeePassDX 🥳
Both, the libre and the free flavor were just confirmed:
apt.izzysoft.de/packages/com.k…
apt.izzysoft.de/packages/com.k…
KeePassDX is a password safe and manager allows editing encrypted data in a single file in the open KeePass format and fill in the forms in a secure way, requires no Internet connection and integrates Android design standards.
#reproducibleBuilds #IzzyOnDroid
Secure open-source password safe and managerIzzyOnDroid Repo Browser
June news at reproducible-builds.org have been released, stating IzzyOnDroid passed 48% coverage (48.8% now), and that @bg443 made shields available to show the current RB status of an app. And on we go!
reproducible-builds.org/report…
#IzzyOnDroid #reproducibleBuilds
Welcome to the RB family, OPN2 MIDI Player 🥳
apt.izzysoft.de/packages/ru.wo…
OPN2 MIDI Player is a a MIDI-player based on emulator of a Frequency Modulation chip Yamaha OPN2 (YM2612).
With the help of its developer, we finally managed to confirm it as reproducible build, so its shield is up now 
#reproducibleBuilds #IzzyOnDroid
Simple MIDI-player for Android based on libOPNMIDI libraryIzzyOnDroid Repo Browser
Welcome to the RB Family, Jerboa 🥳
apt.izzysoft.de/packages/com.j…
Jerboa is a client for Lemmy, made by Lemmy's developers. And Lemmy is the Fediverse alternative to Reddit, Lobste.rs, HN & Co.
The current version finally passed RB, so the shield is up now!
#reproducibleBuilds #IzzyOnDroid
An app for Lemmy, a federated reddit alternative.IzzyOnDroid Repo Browser
sorry, but I had to boost this again now. @fdroidorg can you please make optically clear which APKs you reproduced? Developers knock our doors wondering why we say their app is not RB, while you claim it is – and checking, EACH SINGLE TIME we find the app is NOT set up RB at your end, and the JSON at your verification server clearly states you verified YOUR OWN build. Yes, that might show your build is deterministic – but not that theirs is RB. It's confusing.
So I had some more thoughts about FOSS sustainability. I've had them for some time. But this weeks issues reminded me of them.
So here's a mild spruik for some of the orgs who make my digital spaces for myself and my project and also package @librecast
onepict.com/20250628-plussusta…
Speaking of RB:
DavDroid 4.5.1 unfortunately failed RB. Which shows the thin line between "deterministic" and "reproducible":
We were able to build the app umpteen times, and got the very same, byte identical APK on each build: deterministic. So, it was reproducible, right? Well: no. It didn't match the APK built by the developer. A very slight difference in this case, an "off-by-one" in the baseline (so don't you worry, it's just the optimizer).
#reproducibleBuilds #IzzyOnDroid (1/2)
#AndroidAppRain at apt.izzysoft.de/fdroid today with 14 updated and 1 added apps:
* Pomozen: a Pomodoro timer designed to boost productivity and focus 🛡️
Enjoy your (1315) #free #Android #apps with the #IzzyOnDroid repo – 627 of them (47.7%) are #reproducibleBuilds
This is a repository of apps to be used with your F-Droid client. Applications in this repository are official binaries built by the original application developers, taken from their resp. repositories (mostly Github, GitLab, Codeberg).IzzyOnDroid App Repo
Welcome to the RB family, Aegis 🥳
apt.izzysoft.de/packages/com.b…
Aegis Authenticator is a free, secure and open source app to manage your 2-step verification tokens for your online services.
Thanks to the help of the Aegis team, the app is now finally RB – expect the green shield coming up in a few hours
#reproducibleBuilds #IzzyOnDroid
Free, secure and open source 2FA app to manage tokens for your online servicesIzzyOnDroid App Repo
Btw: kudos for this go to @bg443 – who runs an independent builder (i.e. Ben is not a member of IzzyOnDroid himself, but his builder covers several of our apps. So it's verifying our builders are telling the truth, so to say).
So while IoD takes the APKs directly from the devs, our builders verify they were indeed built from the source code the devs claim to – while independents like Ben verify we're not "cheating". The winners are YOU
Dear developers of #Android #apps which are listed at #IzzyOnDroid and have been confirmed as #reproducibleBuilds by one (or more) of our builders:
I've been told by a dev:
> There are only 3 things devs want. Stickers, badges and a good dev environment (and I'm not sure the last one is important)
So there you go if you want to show the RB status of your app:
#AndroidAppRain at apt.izzysoft.de/fdroid today brings you 13 updated and 1 added apps:
* App2Proxy: redirect the traffic of selected apps through a local proxy using iptables (root needed) 🛡️
And with that, we reached a new milestone: 600 of the apps at #IzzyOnDroid are #reproducibleBuilds now 🥳
Enjoy your #free #Android #apps with the #IzzyOnDroid repo
This is a repository of apps to be used with your F-Droid client. Applications in this repository are official binaries built by the original application developers, taken from their resp. repositories (mostly Github, GitLab, Codeberg).IzzyOnDroid App Repo
oof, misconfiguration at our end 🙈 Sincere apologies! Corrected now, 0.62.9 will show up with the next sync (and future releases in time again).
Oh, and btw: at #IzzyOnDroid of course as #reproducibleBuilds
#AndroidAppRain today brings 16 updated and removes 1 app: Infinity for Reddit was removed as it was not fully FOSS (no offense to the dev, but that branch the APK was built from is not public).
How did we figure? Well, ALL attempts to achieve #reproducibleBuilds failed, as the commit the APK was built from could not be found. That's what we mean when we say RB proves it's build from that exact code, with NOTHING ADDED or taken away.
So: enjoy your 46.1% RB apps with the #IzzyOnDroid repo!
Welcome to the RB family, QRServ 🥳
apt.izzysoft.de/packages/dev.u…
QRServ takes any selected file on your device and makes it available through its own HTTP server at an unused port number. The selected file can then be downloaded via web browser on another device or software that allows file downloads over HTTP from QR codes.
This was made possible thanks to the efforts by its author – and thanks to his SteamDeck running our RB framework
#reproducibleBuilds #IzzyOnDroid #SteamDeck
Transfer files with ease over a network.IzzyOnDroid App Repo
IzzyOnDroid got mentioned in the reproducible-builds.org blog for the April report with a huge block of multiple paragraphs 🥳
reproducible-builds.org/report…
Yes, our RB-framework is available for everyone to use. And today, we even got the first report of an installation running on a Steam Deck
We have no new apps to report today (well, 10 updated apps is also good, right?) – but reached round numbers with our RBs once more:
590 apps (45%) of the #android #apps at the #IzzyOnDroid repo are now #reproducibleBuilds
Welcome to the RB family, LinkGuardian 🥳
apt.izzysoft.de/packages/dev.e…
LinkGuardian is an Android client for Linkwarden, helping you to manage your link collection. Thanks to joint efforts with its developer, @elbullazul, the app is now RB
#reproducibleBuilds #IzzyOnDroid
Android client for Linkwarden built with Jetpack ComposeIzzyOnDroid App Repo
Thanks for giving us a boost 🤗 And as you use the 🛡️ symbol: #IzzyOnDroid also supports #reproducibleBuilds (yes, we can also build from source – but we ALWAYS ship the APKs provided by their resp. developers), see android.izzysoft.de/articles/n…
(our toots use the 🛡️ to indicate RB. Our repo browser indicates RBs by shields, too, for the apps covered by one of our builders)
Spannende Neuigkeiten im IzzyOnDroid Repo: Jetzt haben wir reproduzierbare Builds, spezifische Unterstützung durch einige der beliebtesten F-Droid-Clients und mehr!IzzyOnDroid
Welcome to the RB family, MSM 🥳
apt.izzysoft.de/packages/com.p…
MSM works as wrapper around your Media server (emby, jellyfin, kodi, plex) and helps you to manage your media files.
Thanks to the help from its developer, starting with v1.9.0 the app is now reproducible
You're interested in Reproducible Builds for Android apps? We've just updated our Wiki on those:
gitlab.com/IzzyOnDroid/repo/-/…
There are new pages for setting up build recipes, and debugging/fixing RBs – which should help you when running your own builder. Which you btw can set up on your Linux machine within 5 minutes using the scripts provided at codeberg.org/IzzyOnDroid/rbuil…
Developers also find pages there on making/keeping their apps RB.
Welcome to the RB family, Farhan 🥳
apt.izzysoft.de/packages/ly.co…
Farhan empowers you to take control of your digital experience. Say goodbye to manipulative strategies used by other apps and get ready to focus on what matters to you.
Thanks to the work of Taha Ben Ashur, its developer, the app is now RB
#reproducibleBuilds #IzzyOnDroid
Farhan offers different tools that can help you with smartphone addictionIzzyOnDroid App Repo
Welcome to the RB family, WalkersGuide 🥳
apt.izzysoft.de/packages/org.w…
WalkersGuide is a navigational aid primarily intended for blind and visual impaired pedestrians. It calculates routes and shows nearby points of interest.
Thanks to the help by its developer, the app is RB now
#reproducibleBuilds #IzzyOnDroid
Free navigational aid for the blind and visual impaired based on OpenStreetMapIzzyOnDroid App Repo
Welcome to the RB family, Rattlegram 🥳
apt.izzysoft.de/packages/com.a…
Rattlegram lets you transmit short text messages over COFDMTV encoded audio signals.
Thanks to joined efforts with its developer, Rattlegram (along with its 2 sister-apps) is now RB
#reproducibleBuilds #IzzyOnDroid
Transmit short text messages over COFDMTV encoded audio signalsIzzyOnDroid App Repo
Welcome to the RB family, Inure 🥳
Inure is a powerful open source applications manager and analyzer with a good-looking & easy to use interface.
Joint efforts from 3 parties at work here. Most work was done by the developer (thank you, Hamza!) F-Droid devs joined in, and IzzyOnDroid's new builder tools finally brought in the victory on the developer's side. With the next sync, Inure will be available at IoD and F-Droid as RB
#reproducibleBuilds #IzzyOnDroid
An elegant and beautiful premium Android app manager for rooted and non-rooted devices with a built-in terminal, analytics, debloat, stats and various other features with an custom theme engine, de...GitHub
Oh, and the Readme of the rbuilder_setup repo needed a few updates as well 🙈 Done now: codeberg.org/IzzyOnDroid/rbuil…
If you've set up a builder, we'd love to hear from your experiences – concerning the setup (was it easy enough and straight-forward?) as well as from operation
Scripts to automate setup of rbtlog, rbhelper, and their dependenciesForgejo: Beyond coding. We Forge.
With our rbuilder_setup scripts now ready, the wiki page on Verification Builders has been updated, too:
gitlab.com/IzzyOnDroid/repo/-/…
#reproducibleBuilds #IzzyOnDroid
The F-Droid compatible repo at https://apt.izzysoft.de/fdroid/GitLab
Wanted to run your own builder for #reproducibleBuilds and were disappointed our RBuilder Setup was only available for Debian-based systems? Then we have good news for you: a few min ago, 2 PRs have been merged. The setup scripts now also support RPM & Arch based systems 🥳
RPM/Arch lack packages for apksigner & dexdiff (which are needed for debugging). We're on it, those will follow hopefully soon™.
Thanks to @Iamlooker and Patrick (from FlorisBoard) for your help!
codeberg.org/IzzyOnDroid/rbuil…
Scripts to automate setup of rbtlog, rbhelper, and their dependenciesForgejo: Beyond coding. We Forge.
We just got our first feedback on our RB builder setup scripts (codeberg.org/IzzyOnDroid/rbuil…) today, and that made us really happy, seeing a goal achieved:
> I did set up and ran your scripts in my Ubuntu server (noble) and found the process of setting it up a breeze, and it helped me a lot into finding the source of the issue.
So if you're an Android dev looking into getting your app RB, it might be worth a try!
#IzzyOnDroid #reproducibleBuilds
Scripts to automate setup of rbtlog, rbhelper, and their dependenciesForgejo: Beyond coding. We Forge.
For our "automated builder setup", I've just prepared a PR adding support for RPM based systems. The PR is still marked WIP as I don't have any RPM test system at hand here – so I'm calling out for help:
Anybody willing to test the setup scripts on Fedora, RHEL, CentOS or the likes? 🙏
(more tests on Debian-based systems (Debian, Ubuntu, Mint …) are of course welcome, too)
codeberg.org/IzzyOnDroid/rbuil…
Fixes #2 This adds support for installing the builder package on RPM based systems. Testing needed: someone running an RPM based system, please give it a try!Codeberg.org
Welcome to the RB family, Minimo Launcher 🥳
apt.izzysoft.de/packages/com.m…
Designed for users who want to de-clutter their home screen, Minimo offers a clean and intuitive minimalist interface that prioritizes functionality without unnecessary distractions.
And thanks to the efforts by its developer, its new release today is RB
RB status at IoD now: 530 apps (41.7%)
#IzzyOnDroid #reproducibleBuilds
Home screen without distractions. Improve your focus and productivity.IzzyOnDroid App Repo
Welcome to the RB family, RadioUpnp 🥳
apt.izzysoft.de/packages/com.w…
RadioUpnp reads any internet radio. Minimalist and full customizable. With support for UPnP/DLNA. And thanks to the efforts by its developer, with its latest release today it is reproducible
So the current RB status at the IzzyOnDroid repo is: 508 apps (40.6%)
#reproducibleBuilds #IzzyOnDroid
Clean designed internet radio player with integrated UPnP/DLNA functionIzzyOnDroid App Repo
🐣 oops… the Easter egg hatched early! We've just reached a goal we hoped to achieve around Easter:
At #IzzyOnDroid 40% – so 2 out of every 5 apps – are now #reproducibleBuilds 🥳
So whenever you see one or more green shields next to the version of an app in our repo browser at apt.izzysoft.de/fdroid you can be sure: this was built exactly from the source code it claims to be, nothing added or taken away.
Oh, and we should roll out those new shields soon™, so you see the independent builders 😉
This is a repository of apps to be used with your F-Droid client. Applications in this repository are official binaries built by the original application developers, taken from their resp. repositories (mostly Github, GitLab, Codeberg).IzzyOnDroid App Repo
