Dimitri John Ledkov: Security-only OpenSSL tarball releases for CVE-2026-2673
- OpenSSL 3.6.1+1 - OpenSSL 3.6.1 with fix for CVE-2026-2673
- OpenSSL 3.5.5+1 - OpenSSL 3.5.5 with fix for CVE-2026-2673
The Debian LTS Team, funded by [Freexian s Debian LTS offering]
(https://www.freexian.com/lts/debian/), is pleased to report its activities for
February.
lintian, autopkgtest, piuparts, blhc) on the built artifacts.
In addition we can run the autopkgtests of every other package in the
archive that depends on the built package, like britney does for testing
migration in Debian.
Some of these other packages may have currently-failing autopkgtests
that have nothing to do with the changes in the upload under test.
For example:
regression_tracking=true feature, and have enabled it in the
upload-to-* workflows on debusine.debian.net.
With this enabled, you ll get a new QA tab on your debian_pipeline
workflows that shows the trend of each test:
debian:qa-results collection used for analyzing regressions is
specified to the debian_pipeline with the
regression_tracking_qa_results lookup parameter.
On debusine.debian.net we have configured a debian:qa-results
collection for sid that can be referenced and added to by tasks in
any workspace.
Regressions can be more subtle than a simple Success Failure.
If the number of autopkgtests that fail increases, or the number of
lintian tags emitted increases, those are also considered a regressions.
upload-to-* workflows on
debusine.debian.net.
To disable, pass -O debusine_workflow_data.enable_regression_tracking=false when you dput
an upload to debusine.
To use the regression-tracking in your own workflows, use a
debian_pipeline workflow that is configured with
enable_regression_tracking=true.
This will require a qa_suite to be specified, pointing to the
baseline suite.
We hope this will make it easier to check QA results for packages tested
on debusine.debian.net.
On our way to Austria last week, on March 6th, we left my daughter's laptop on a train: ICE 1201 (Hamburg-Harburg to Bludenz).
The laptop is a Lenovo X230 notebook. The most obvious distinguishing feature is a Mathilda Hands sticker in the middle of the lid:
The keyboard layout is British (with a above the 3).
It was left in coach 24 of ICE 1201, next to seats 51-54, in the luggage gap between the seats, on the floor.
My hope is that whoever found it will end up searching for Mathilda Hands and see this. If that's how you got here, please email me:
phil-lostlaptop2026@hands.com - doing so will make Mathilda (and me) most cheerful.
A maintenance release 0.9.14 of the RcppClassic
package arrived earlier today on CRAN, and has been built for r2u. This package
provides a maintained version of the otherwise deprecated initial Rcpp
API which no new projects should use as the normal and current
Rcpp API is so much better.
A few changes had cumulated up since the last release in late 2022.
We updated continuous integration scripts a few times, switched to
Authors@R in DESCRIPTION, and rejigged build scripts a
little to accommodate both possible build architectures for macOS. We
also updated the vignette by updating all reference and switching the
new asis vignette builder now available in Rcpp.
CRANberries
also reports the changes relative to the
previous release from 3 1/2 years ago. Questions, comments etc
should go to the rcpp-devel
mailing list off the R-Forge page.
This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. If you like this or other open-source work I do, you can now sponsor me at GitHub.
Yet another maintenance release of the tidyCpp
package arrived on CRAN this morning, a mere week and a half after the
previous release. It has been built for r2u as well. The package
offers a clean C++ layer (as well as one small C++ helper class) on top
of the C API for R which aims to make use of this robust (if awkward) C
API a little easier and more consistent. See the vignette for motivating
examples.
This release, just like the preceding
one less than two weeks ago, had its hand forced by an overnight
change in R-devel. The breakage this created has since been reverted in
R-devel but as the writing is on the wall are now removing the
definition involving these accessors preemptively. We were also missing
version checks for two newly added alternates.
Changes are summarized in the NEWS entry that follows.
Thanks to my CRANberries, there is also a diffstat report for this release. For questions, suggestions, or issues please use the issue tracker at the GitHub repo.Changes in tidyCpp version 0.0.10 (2026-03-15)
- Hide five accessors as underlying macros removed from Rinternals
- Preemptively hide another accessor
- Ensure two definitions are conditional on R 4.5.0 or later
This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. If you like this or other open-source work I do, you can now sponsor me at GitHub.
Recently I found myself with a few hours to kill, but with the only
available connectivity provided by an annoying firewall which would
normally allow requests only to a few very specific web sites.
This post shows how to work around this kind of restrictions by hiding
SSH in an HTTPS connection, which then can be used as a SOCKS proxy to
allow general connectivity.
socat
does all the hard work.
First, create two self-signed RSA keys pairs, one for the client
(bongo) and one for the server (attila):
domain=bongo.example.net openssl req -x509 -newkey rsa:2048 -days 7300 \ -subj /CN=$domain -addext "subjectAltName = DNS:$domain" \ -keyout socat.key -nodes \ -out socat.pemThen, concatenate the public and private keys to create the file provided to the
cert option, and use the public key as
the file for the cafile option on the other
side.
On the client side, if you normally would connect to
attila.example.net then you can add something like this to
~/.ssh/config:
Host httpstunnel-attila.example.net ProxyCommand socat --statistics STDIO OPENSSL:attila.example.net:443, cert=$HOME/.ssh/socat-bongo.pem,cafile=$HOME/.ssh/socat-attila.pem, snihost=$ SOCAT_SNI:-x.com DynamicForward 1080 Compression yes HostKeyAlias attila.example.net ControlMaster yes ControlPath ~/.ssh/.control_attila.example.net_22_%rThe
ProxyCommand directive uses socat to
provide the connectivity which ssh will use over stdio
instead of connecting to port 22 of the server.
The snihost option is enough to make many firewalls
believe that this is an authorized HTTPS request.
On the server side we use a simple systemd unit to start a forking
instance of socat, which will accept and process requests
from the client (and from random crawlers on the Internet: expect a lot
of cruft in that log...):
[Unit] Description=socat tunnel After=network.target [Service] Type=exec ExecStart=socat -ly OPENSSL-LISTEN:443,fork,reuseaddr, cert=%d/tlskey,cafile=%d/tlsca TCP:localhost:22 SuccessExitStatus=143 LoadCredential=tlskey:/etc/ssh/socat-attila.pem LoadCredential=tlsca:/etc/ssh/socat-bongo.pem Restart=on-abnormal RestartSec=5s DynamicUser=yes PrivateDevices=yes PrivateTmp=yes ProtectClock=yes ProtectControlGroups=yes ProtectHome=yes ProtectHostname=yes ProtectKernelLogs=yes ProtectKernelModules=yes ProtectKernelTunables=yes ProtectProc=invisible ProtectSystem=strict RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX RestrictNamespaces=yes RestrictRealtime=yes RestrictSUIDSGID=yes LockPersonality=yes MemoryDenyWriteExecute=yes NoNewPrivileges=yes AmbientCapabilities=CAP_NET_BIND_SERVICE CapabilityBoundingSet=CAP_NET_BIND_SERVICE SystemCallArchitectures=native SystemCallErrorNumber=EPERM SystemCallFilter=@system-service SystemCallFilter=~@resources SystemCallFilter=~@privileged [Install] WantedBy=multi-user.targetStrong sandboxing is enabled, so the
socat instance
is confined with very limited privileges. An interesting point is the
use of systemd credentials
to provide the cryptographic keys, since it allows to store them in a
part of the file system which would not be accessible to the program.
Advanced users can use this method to provide the keys from secure
storage.
# dig -t txt _spf.google.com grep spf1 _spf.google.com. 300 IN TXT "v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ~all" # dig -t txt outlook.com grep spf1 outlook.com. 126 IN TXT "v=spf1 include:spf2.outlook.com -all" # dig -t txt _spf.mail.yahoo.com grep spf1 _spf.mail.yahoo.com. 1800 IN TXT "v=spf1 ptr:yahoo.com ptr:yahoo.net ip4:34.2.71.64/26 ip4:34.2.75.0/26 ip4:34.2.84.64/26 ip4:34.2.85.64/26 ip4:34.2.64.0/22 ip4:34.2.68.0/23 ip4:34.2.70.0/23 ip4:34.2.72.0/22 ip4:34.2.78.0/23 ip4:34.2.80.0/23 ip4:34.2.82.0/23 ip4:34.2.84.0/24 ip4:34.2.86.0" "/23 ip4:34.2.88.0/23 ip4:34.2.90.0/23 ip4:34.2.92.0/23 ip4:34.2.85.0/24 ip4:34.2.94.0/23 ?all" # dig -t txt icloud.com grep spf1 icloud.com. 3586 IN TXT "v=spf1 ip4:17.41.0.0/16 ip4:17.58.0.0/16 ip4:17.142.0.0/15 ip4:17.57.155.0/24 ip4:17.57.156.0/24 ip4:144.178.36.0/24 ip4:144.178.38.0/24 ip4:112.19.199.64/29 ip4:112.19.242.64/29 ip4:222.73.195.64/29 ip4:157.255.1.64/29" " ip4:106.39.212.64/29 ip4:123.126.78.64/29 ip4:183.240.219.64/29 ip4:39.156.163.64/29 ip4:57.103.64.0/18" " ip6:2a01:b747:3000:200::/56 ip6:2a01:b747:3001:200::/56 ip6:2a01:b747:3002:200::/56 ip6:2a01:b747:3003:200::/56 ip6:2a01:b747:3004:200::/56 ip6:2a01:b747:3005:200::/56 ip6:2a01:b747:3006:200::/56 ~all"In most IM systems there is a strong connection between people who communicate. If I send you two direct messages they will appear in the same room, and if someone else tries forging messages from me (EG by replacing the c and e letters in my address with Cyrillic letters that look like them or by mis-spelling my name) a separate room will be created and it will be obvious that something unexpected is happening. Protecting against the same attacks in email requires the user carefully reading the message, given that it s not uncommon for someone to start a message to me with Hi Russel (being unable to correctly copy my name from the To: field of the message they are writing) it s obvious that any security measure relying on such careful reading will fail. The IM protections against casual forgery also apply to rooms with multiple users, a new user can join a room for the purpose of spamming but they can t send a casual message impersonating a member of the room. A user can join a Matrix room I m in with the name Russell from another server but the potential for confusion will be minimised by a message notifying everyone that another Russell has joined the room and the list of users will show two Russells. For email the protections against forgery when sending to a list server are no different than those when sending to an individual directly which means very weak protections. Authenticating the conversation context once as done with IM is easier and more reliable than authenticating each message independently. Is Email Sucking the Main Technical Difference? It seems that the problems with forgery, spam, and general confusion when using email are a large part of the difference between email and IM. But in terms of technical issues the fact that email has significantly more users (if only because you need an email account to sign up for an IM system) is a major difference. Internet email is currently a universal system (apart from when it breaks from spam) and it has historically been used to gateway to other email systems like Fidonet, Uucp, and others. The lack of tight connection between parties that exchange messages in email makes it easier to bridge between protocols but harder to authenticate communication. Most of the problems with Internet email are not problems for everyone at all times, they are technical trade-offs that work well for some situations and for some times. Unfortunately many of those trade-offs are for things that worked well 25+ years ago. The GUI From a user perspective there doesn t have to be a great difference between email and IM. Email is usually delivered quickly enough to be in the same range as IM. The differences in layout between IM client software and email client software is cosmetic, someone could write an email client that organises messages in the same way as Slack or another popular IM system such that the less technical users wouldn t necessarily know the difference. The significant difference in the GUI for email and IM software was a design choice. Conversation Organisation The most significant difference in the operation of email and IM at the transport level is the establishment of connections in IM. Another difference is the fact that there are no standards implemented for the common IM implementations to interoperate which is an issue of big corporations creating IM systems and deliberately making them incompatible. The methods for managing email need to be improved. Having an inbox that s an unsorted mess of mail isn t useful if you want to track one discussion, breaking it out into different sub folders for common senders (similar to IM folders for DMs) as a standard feature without having to setup rules for each sender would be nice. Someone could design an email program with multiple layouts, one being the traditional form (which seems to be copied from Eudora [3]) and one with the inbox (or other folders) split up into conversations. There are email clients that support managing email threads which can be handy in some situations but often isn t the best option for quickly responding to messages that arrived recently. Archiving Most IM systems have no method for selectively archiving messages, there s a request open for a bookmark function in Matrix and there s nothing stopping a user from manually copying a message. But there s nothing like the convenient ability to move email to an archive folder in most IM systems. Without good archiving IM is a transient medium. This is OK for conversations but not good for determining the solutions to technical problems unless there is a Wiki or other result which can be used without relying on archives. Composing Messages In a modern email client when sending a message it prompts you for things that it considers complete, so if you don t enter a Subject or have the word attached in the message body but no file is attached to the message then it will prompt you to confirm that you aren t making a mistake. In an IM client the default is usually that pressing ENTER sends the message so every paragraph is a new message. IM clients are programmed to encourage lots of short messages while email clients are programmed to encourage more complete messages. Social Issues Quality The way people think about IM and email is very different, as one example there was never a need for a site like nohello.net for email. The idea that it s acceptable to use even lower quality writing in IM than people tend to use in email seems to be a major difference between the communication systems. It can be a good thing to have a chatty environment with messages that are regarded as transient for socialising, but that doesn t seem ideal for business use. Ownership Email is generally regarded as being comparable to physical letters. It is illegal and widely considered to be socially wrong to steal a letter from someone s letterbox if you regret sending it. In email the only unsend function I m aware of is that in Microsoft software which is documented to only work within the same organisation, and that only works if the recipient hasn t read the message. The message is considered to be owned by the recipient. But for IM it s a widely supported and socially acceptable function to delete or edit messages that have been sent. The message is regarded as permanently the property of the sender. What Should We Do? Community Creators When creating a community (and I use this in the broadest sense including companies) you should consider what types of communication will work well. When I started the Flounder group [4] I made a deliberate decision that non-free communication systems go against the aim of the group, I started it with a mailing list and then created a Matrix room which became very popular. Now the list hardly gets any use. It seems that most of the communication in the group is fairly informal and works better with IM. Does it make sense to use both? Should IM systems be supplemented with other systems that facilitate more detail such as a Wiki or a Lemmy room/instance [5] to cover the lack of long form communication? I have created a Lemmy room for Flounder but it hasn t got much interest so far. It seems that almost no-one makes a strategic decision about such issues. Software Developers It would be good to have the same options for archiving IM as there are for email. Also some options to encourage quality in IM communication similar to the way email clients want confirmation before sending messages without a subject or that might be missing an attachment. It would also be good to have better options for managing conversations in email. The Inbox as currently used is good for some things but a button to switch between that and a conversation view would be good. There are email clients that allow selecting message sort order and aggregation (kmail has a good selection of options) but they are designed for choosing a single setup that you like not between multiple views based on the task you are doing. It would be good to have links between different communication systems, if users had the option of putting their email address in their IM profile it would make things much easier. Having entirely separate systems for email and IM isn t good for users. Users The overall communications infrastructure could be improved if more people made tactical decisions about where and how to communicate. Keep the long messages to email and the chatty things to IM. Also for IM just do the communication not start with hello . To discourage wasting time I generally don t reply to messages that just say hello unless it s the first ever IM from someone. Conclusion A large part of the inefficiencies in electronic communication are due to platforms and usage patterns evolving with little strategic thought. The only apparent strategic thought is coming from corporations that provide IM services and have customer lock in at the core of their strategies. Free software developers have done great work in developing software to solve tactical problems but the strategies of large scale communications aren t being addressed. Email is loosely coupled and universal while IM is tightly coupled, authenticated, and often siloed. This makes email a good option for initial contact but a risk for ongoing discussions. There is no great solution to these issues as they are largely a problem due to the installed user base. But I think we can mitigate things with some GUI design changes and strategic planning of communication.
What led to this experiment? Well, for one, Well, for one, there was a thought
shared by Andrej Karpathy regarding the shift towards "Agentic" workflows.
"The future of software is not just 'tools', but 'agents' that can navigate complex tasks on your behalf."Recently, I spoke with Ritesh, who mentioned his success using the Gemini CLI to debug an idle power drain issue on his laptop. I wanted to experiment with this myself, and I had the perfect use case: configuring the Hyprland Window Manager on my aging laptop. The machine is nearly eight years old with 12GB of RAM (upgraded from the original 4GB). I found that GNOME and KDE were becoming overkill, often leading to system freezes when running multiple AI-powered IDEs like Antigravity and VS Code with Co-pilot. Coincidentally, I noticed my Jio number had a "Google One 2TB" and "Google AI Premium" plan available to claim. I claimed it, and now here I am, experimenting with the Gemini CLI.
npm install -g @google/gemini-cliNext, we need to create a context for Gemini a set of instructions for it to follow throughout the project. This is managed via a GEMINI.md file. I went to Google Gemini, explained my requirements, and asked it to generate one for me. My requirements were:
# Role: Hyprland Configuration Specialist (Minimalist & High-Performance)
You are a Linux Systems Engineer specializing in migrating users from heavy
Desktop Environments to minimalist, tiling-based Wayland sessions on Debian.
Your goal is to maximize available RAM for heavy applications while maintaining
essential desktop features.
## 1. Environment & Persona
- **Target OS:** Debian (Linux)
- **Target WM:** Hyprland
- **Hardware:** ThinkPad E470 (i5-7th Gen, 12GB RAM)
- **User Profile:** Emacs user, prioritizes "anti-gravity" (zero bloat).
- **Tone:** Technical, concise, and security-conscious.
## 2. Core Functional Requirements
- **Status Bar:** waybar (with CPU, RAM, Network, and Battery icons).
- **Wallpaper:** swww or hyprpaper .
- **Screen Lock:** hyprlock + hypridle .
- **Input Mapping:** Swap Control and Caps Lock ( kb_options = ctrl:nocaps ).
## 3. Operational Constraints
- **Permission First:** Ask before using sudo or writing outside the work directory.
- **Inspection:** Use hyprctl , lsmod , or gsettings for compatibility checks.
- **Artifact Management:** Update MEMORY.md after every major step.
Read MEMORY.md and GEMINI.md. Based on my hardware, give me a shell script to inspect my current GNOME environment so we can start replicating the session basics.
Another maintenance release of the RcppCNPy
package arrived on CRAN today,
and has already been built as an r2u binary. RcppCNPy
provides R with read and write access to NumPy files thanks to the cnpy library by Carl Rogers
along with Rcpp for the glue to R.
The changes are minor and similar to other recent changes. We aid Rcpp in the transition away from calling
Rf_error() by relying in Rcpp::stop() which
has better behaviour and unwinding when errors or exceptions are
encountered. So once again no user-facing changes. Full details are
below.
CRANberries also provides a diffstat report for the latest release. As always, feedback is welcome and the best place to start a discussion may be the GitHub issue tickets page. If you like this or other open-source work I do, you can now sponsor me at GitHub.Changes in version 0.2.15 (2026-03-13)
- Replaced Rf_error with Rcpp::stop in three files
- Maintenance updates to continuous integration
This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.
git clone https://gitlab.com/hoexter-experiments/ech
cd ech
buildah build --layers -f Dockerfile -t echtest
podman run -ti echtest /usr/local/bin/curl \
--ech true --doh-url https://one.one.one.one/dns-query \
https://crypto.cloudflare.com/cdn-cgi/trace.cgi
fl=48f121
h=crypto.cloudflare.com
ip=2.205.251.187
ts=1773410985.168
visit_scheme=https
uag=curl/8.19.0
colo=DUS
sliver=none
http=http/2
loc=DE
tls=TLSv1.3
sni=encrypted
warp=off
gateway=off
rbi=off
kex=X25519
It also builds nginx and you can use that for a local test within
the image. More details in the
README.
Hello world. I have been doing a lot after my internship with Outreachy. We are still working on some tasks :
As I am moving around constantly, there are problems I had encountered when changing my networks. I had to connect my virtual machine to different networks and the network would not reflect within the machine. From terminal I edited the virtual machine XML settings:
su -// input password sudo virsh edit <machine_name> #its openqa for me// Look for the interface within devices and replace this:<interface type=&aposnetwork&apos> <source network=&aposdefault&apos/> #some other code in here </interface>// With just this then restart your machine:<interface type=&aposuser&apos> <model type=&aposvirtio&apos/></interface>
Hopefully the above will help someone out there. I am still working on a lot of tasks regarding the conference, so much to do and so little time. I am hoping I won t get any burnout during this period. I won t be updating much further till the conference. Have a nice time
314. This version includes the following changes:
[ Chris Lamb ]
* Don't run "test_code_is_black_clean" test in autopkgtests.
(Closes: #1130402)
[ Michael R. Crusoe ]
* Reformat using Black 26.1.0. (Closes: #1130073)
Welcome to the February 2026 report from the Reproducible Builds project!
These reports outline what we ve been up to over the past month, highlighting items of news from elsewhere in the increasingly-important area of software supply-chain security. As ever, if you are interested in contributing to the Reproducible Builds project, please see the Contribute page on our website.
The last year has seen the introduction, development and deployment of reproduce.debian.net. In technical terms, this is an instance of rebuilderd, our server designed monitor the official package repositories of Linux distributions and attempt to reproduce the observed results there.
This month, however, Holger Levsen added suite-based navigation (eg. Debian trixie vs forky) to the service (in addition to the already existing architecture based navigation) which can be observed on, for instance, the Debian trixie-backports or trixie-security pages.
diffoscope is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb made a number of changes, including preparing and uploading versions, 312 and 313 to Debian.
In particular, Chris updated the post-release deployment pipeline to ensure that the pipeline does not fail if the automatic deployment to PyPI fails [ ]. In addition, Vagrant Cascadian updated an external reference for the 7z tool for GNU Guix. [ ]. Vagrant Cascadian also updated diffoscope in GNU Guix to version 312 and 313.
In Debian this month:
sbom-toolkit package was uploaded, which provides a collection of scripts for generating SBOM. This is the tooling used in Apertis to generate the Licenses SBOM and the Build Dependency SBOM. It also includes dh-setup-copyright, a Debhelper addon to generate SBOMs from DWARF debug information, which are extracted from DWARF debug information by running dwarf2sources on every ELF binaries in the package and saving the output.
Lastly, Bernhard M. Wiedemann posted another openSUSE monthly update for their work there.
pimsync in the GNU Guix review process
50.beta regressed in reproducibility compared to 49.0. Specifically, the new generated .oga files differ in their Serial No. and Checksum [fields] . However, Jeremy ended up fixing the issue by replacing ffmpeg with oggenc.
archlinux-dev-public mailing list on our mailing list this month after a discussion at our latest Summit meeting on the topic of Link-Time Optimisation (LTO) specifically on the reasons why LTO often needs to be disabled in relation to Arch Linux s approach to binary hardening.
0) may materially differ from using SOURCE_DATE_EPOCH) when a situation demands the use of a fixed timestamp.
pnut, a C compiler capable of bootstrapping itself and TCC from any POSIX-compliant shell and human-readable source files.
bitsnpicas.fonts-topaz-unicode.bitsnpicas.
Once again, there were a number of improvements made to our website this month including:
repro-build to the Tools page. [ ]
.properties files. [ ]
Julien Malka and Arnout Engelen published a paper titled Lila: Decentralized Build Reproducibility Monitoring for the Functional Package Management Model:
[While] recent studies have shown that high reproducibility rates are achievable at scale demonstrated by the Nix ecosystem achieving over 90% reproducibility on more than 80,000 packages the problem of effective reproducibility monitoring remains largely unsolved. In this work, we address the reproducibility monitoring challenge by introducing Lila, a decentralized system for reproducibility assessment tailored to the functional package management model. Lila enables distributed reporting of build results and aggregation into a reproducibility database [ ].A PDF of their paper is available online.
Javier Ron and Martin Monperrus of KTH Royal Institute of Technology, Sweden, also published a paper, titled Verifiable Provenance of Software Artifacts with Zero-Knowledge Compilation:
Verifying that a compiled binary originates from its claimed source code is a fundamental security requirement, called source code provenance. Achieving verifiable source code provenance in practice remains challenging. The most popular technique, called reproducible builds, requires difficult matching and reexecution of build toolchains and environments. We propose a novel approach to verifiable provenance based on compiling software with zero-knowledge virtual machines (zkVMs). By executing a compiler within a zkVM, our system produces both the compiled output and a cryptographic proof attesting that the compilation was performed on the claimed source code with the claimed compiler. [ ]A PDF of the paper is available online.
Oreofe Solarin of Department of Computer and Data Sciences, Case Western Reserve University, Cleveland, Ohio, USA, published It s Not Just Timestamps: A Study on Docker Reproducibility:
Reproducible container builds promise a simple integrity check for software supply chains: rebuild an image from its Dockerfile and compare hashes. We built a Docker measurement pipeline and apply it to a stratified sample of 2,000 GitHub repositories that contained a Dockerfile. We found that only 56% produce any buildable image, and just 2.7% of those are bitwise reproducible without any infrastructure configurations. After modifying infrastructure configurations, we raise bitwise reproducibility by 18.6%, but 78.7% of buildable Dockerfiles remain non-reproducible.A PDF of Oreofe s paper is available online.
Lastly, Jens Dietrich and Behnaz Hassanshahi published On the Variability of Source Code in Maven Package Rebuilds:
[In] this paper we test the assumption that the same source code is being used [by] alternative builds. To study this, we compare the sources released with packages on Maven Central, with the sources associated with independently built packages from Google s Assured Open Source and Oracle s Build-from-Source projects. [ ]A PDF of their paper is available online.
#reproducible-builds on irc.oftc.net.
rb-general@lists.reproducible-builds.org
Another minor maintenance release for the RcppBDT
package is now on CRAN, and had
been built as binary for r2u.
The RcppBDT
package is an early adopter of Rcpp
and was one of the first packages utilizing Boost and its Date_Time
library. The now more widely-used package anytime is a
direct descentant of RcppBDT.
This release is again primarily maintenance. We aid Rcpp in the transition away from calling
Rf_error() by relying in Rcpp::stop() which
has better behaviour and unwinding when errors or exceptions are
encountered. No feature or interface changes.
The NEWS entry follows:
Courtesy of my CRANberries, there is also a diffstat report for this release. For questions, suggestions, or issues please use the issue tracker at the GitHub repo.Changes in version 0.2.8 (2026-03-12)
- Replaced Rf_error with Rcpp::stop in three files
- Maintenance updates to continuous integration
This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. If you like this or other open-source work I do, you can now sponsor me at GitHub.
On 25th Oct 2025, I announced via my personal blog and on Mastodon that Fre(i)e Software GmbH was hiring. The hiring process was a mix of asking developers I know and waiting for new people to apply.
At the beginning of November 2025 / in mid November 2025, we started with 13 developers (all part-time) to work on various topics around Lomiri (upstream and downstream).
Note that the below achievements don't document the overall activity in the Lomiri project, but that part that our team at Fre(i)e Software GmbH contributed to.
Organizational Achievements
$ dig +short IN HTTPS cloudflare-ech.com
1 . alpn="h3,h2" ipv4hint=104.18.10.118,104.18.11.118 ech=AEX+DQBBFQAgACDBFqmr34YRf/8Ymf+N5ZJCtNkLm3qnjylCCLZc8rUZcwAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA= ipv6hint=2606:4700::6812:a76,2606:4700::6812:b76
Another maintenance release of our RcppDE package arrived
at CRAN, and has been built for
r2u. RcppDE is a port
of DEoptim, a
package for derivative-free optimisation using differential evolution,
from plain C to C++. By using RcppArmadillo the
code became a lot shorter and more legible. Our other main contribution
is to leverage some of the excellence we get for free from using Rcpp, in particular the ability to
optimise user-supplied compiled objective functions which can
make things a lot faster than repeatedly evaluating interpreted
objective functions as DEoptim does (and
which, in fairness, most other optimisers do too). The gains can be
quite substantial.
This release is again maintenance. We aid Rcpp in the transition away from calling
Rf_error() by relying in Rcpp::stop() which
has better behaviour and unwinding when errors or exceptions are
encountered. We also overhauled the references in the vignette, added an
Armadillo version getter and made the regular updates to continuous
integration.
Courtesy of my CRANberries, there
is also a diffstat
report. More detailed information is on the RcppDE page,
or the repository.
This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. If you like this or other open-source work I do, you can sponsor me at GitHub.
We are pleased to announce that Infomaniak has
committed to sponsor DebConf26 as a Platinum
Sponsor.
Infomaniak is an independent, employee-owned Swiss technology company that
designs, develops, and operates its own cloud infrastructure and digital
services entirely in Switzerland. With over 300 employees more than 70%
engineers and developers the company reinvests all profits into R&D. Its
public cloud is built on OpenStack, with managed Kubernetes, Database as a
Service, object storage, and sovereign AI services accessible via OpenAI-
compatible APIs, all running on its own Swiss infrastructure. Infomaniak also
develops a sovereign collaborative suite messaging, email, storage, online
office tools, videoconferencing, and a built-in AI assistant developed in-
house and as a privacy-respecting solution to proprietary platforms. Open
source is central to how Infomaniak operates. Its latest data center (D4) runs
on 100% renewable energy and uses no traditional cooling: all the heat
generated by its servers is captured and fed into Geneva's district heating
network, supplying up to 6,000 homes in winter and hot water year-round. The
entire project has been documented and open-sourced at d4project.org.
With this commitment as Platinum Sponsor, Infomaniak is contributing to the
Debian annual Developers' conference, directly supporting the progress of
Debian and Free Software. Infomaniak contributes to strengthen the community
that collaborates on Debian projects from all around the world throughout all
of the year.
Thank you very much, Infomaniak, for your support of DebConf26!
Become a sponsor too!
DebConf26 will take place from 20th to July
25th 2026 in Santa Fe, Argentina, and will be preceded by DebCamp, from 13th
to 19th July 2026.
DebConf26 is accepting sponsors! Interested companies and organizations may
contact the DebConf team through
sponsors@debconf.org, and visit the DebConf26
website at
https://debconf26.debconf.org/sponsors/become-a-sponsor/.
Next.