I am proud to announce that my research article “Understanding Build Reproducibility in the F-Droid Ecosystem“, written with Julien Malka, Stefano Zacchiroli, Théo Zimmermann and Gabriele D’Angelo, has been accepted at 2026 ACM Conference on Reproducibility and Replicability (ACM REP ’26).
In this paper, we studied the historical reproducibility data of the applications in the F-Droid store, and we evaluated the rebuildability and reproducibility of historically reproducible apps by rebuilding them with the F-Droid server.
I’m sharing the full text here before the final publication and I would appreciate any comments, particularly because I will be able to make minor improvements to the paper based on your feedback until July 1st.
Did you find any information about reproducible application count per framework/stack/technology? For example I have a flutter app on fdroid (which I think is a bit exotic here) and had some trouble making it reproducible due to differences in the build setup in gh actions and on fdroid-server. I had to make some weird changes in the build config to make the reproducability check pass. Nice paper!
Wow, that project behind that paper sounds like quite an untertaking! It is perfect timing, we just started another round of work on our build infrastructure to make reproducible builds. Blog post announcement coming soon. I’ll read the paper as soon as possible, and come back with questions.
My first question is: what can we do to make projects like yours easier to run? We want more people doing mass rebuilds and analyzing them.
Hey! I did not have insights per technology yet. Since this paper is the baseline for my master thesis I am planning to extend a bit the result section to add more historical insight. However, this will depend on if I will actually have time to work more on it. I will post about the final result anyway, and I will explicitly point out the additions if I make some!
I didn’t have time to dig deeper inside the verification server, my work was only based on the F-Droid server. The hardest part was to rebuild older apps that are not compatible with the current basebox used by the F-Droid server. Something that would be very useful would be to log also the specific information on the environment the apps are built into. I know that you currently have the monitoring system that show the commit of the build server, it would indeed help to also store this information somewhere.
