Free software activities in July 2026

Here is my monthly update covering what I have been doing in the free software world during July 2026 (previous month):

Reproducible Builds

One of the original promises of open source software is that distributed peer review and transparency of process results in enhanced end-user security. However, whilst anyone may inspect the source code of free and open source software for malicious flaws, almost all software today is distributed as pre-compiled binaries. This allows nefarious third-parties to compromise systems by injecting malicious code into ostensibly secure software during the various compilation and distribution processes.

This month, I:

• Kept isdebianreproducibleyet.com up to date. [...]

• Submitted a patches to fix a reproducibility-related toolchain issue within the towncrier package. [...]

• I also submitted over 11 patches to fix specific reproducibility issues in eyes17-manuals, fontforge, go-dlib, golang-github-tidwall-wal, grout, libpsl, libslow5lib, lightproof, node-grunt-contrib-internal, siso & spopt, etc.

• Categorised a large number of packages and issues in the Reproducible Builds notes.git repository.

• Drafted, published and publicised our monthly report for June 2026.

• Updated the main Reproducible Builds website and documentation. By request of Digital Ocean, use the referral link so that they can track clicks [...], and push a number of changes to the Tools page [...].

Elsewhere in our tooling, I made the following changes to diffoscope, including preparing and uploading versions 324, 325 and 326 to Debian:

• Fix tests to work with zipdetails 4.0008. (#1141359)
• Bump debhelper compatibility level to 13. [...]
• Update copyright years. [...]

I also made changes to disorderfs, our FUSE-based filesystem that deliberately introduces non-determinism into directory system calls in order to flush out reproducibility issues, including:

• Bump Standards-Version to 4.7.4. [...]

… and merged some changes by Christelle Gloor to add the option to sort by ctime as returned by the lstat(2) syscall.

Debian

• bfs (4.1.4-1) — New upstream release.

• lastpass-cli (1.6.1-5) — Update packaging (and orphan package.

• memcached (1.6.45-1) — New upstream release.

• python-django:

  • 5.2.16-1 — New upstream security release.
  • 6.1~rc1-1 — New upstream security release.

Debian LTS

This month I have worked 30 hours on Debian Long Term Support (LTS) and on its sister Extended LTS (ELTS) project.

• Frontdesk duties, responding to user/developer questions, reviewing others' packages, participating in mailing list discussions, etc.

• Issued DLA 4682-1 as it was discovered that there were two issues in Redis, the in-memory key/value database:

  • CVE-2026-23631: An authenticated attacker could have exploited the master-replica synchronization mechanism to trigger a use-after-free on replicas where "replica-read-only" was disabled.

  • CVE-2026-25243: The RESTORE command did not properly validate serialized values. An authenticated attacker with permission to execute RESTORE could have suppleed a crafted serialized payload that triggers invalid memory access and this could have led to remote code execution.

• Issued ELA-1764-1 for Debian stretch and buster because two issues were discovered in librabbitmq, a C-language client library used to communicate with RabbitMQ servers using the Advanced Message Queuing Protocol (AMQP).

• Issued DLA 4691-1 as it was discovered that there was an origin-validation vulnerability in rtpengine, an open-source media proxy for real-time audio and video traffic.

• Issued DLA 4690-1 for xz-utils, the popular data-compression utility and library. This was to address a potential buffer overflow vulnerability.

You can find out more about the Debian LTS project via the following video:

You can subscribe to new posts via email or RSS.