Description
The Linux ecosystem supports a diverse set of methods for assembling complete, bootable systemsโranging from binary distributions to source-based systems, embedded platforms, and container-native environments. Despite differences in tooling and architecture, all of these systems face shared challenges: managing build complexity, ensuring security and reproducibility, maintaining cross-platform compatibility, and responding to increasing regulatory and supply chain scrutiny.
Building on the success of last yearโs microconference, we invite the community to continue the conversation with a broadened scope in 2025. This year, we aim to explore the intersection of build systems with CI/CD pipelines, supply chain security, critical infrastructure, secure development practices, and the potential use of machine learning and AI techniques to improve build systems, CI/CD pipelines, and supply chain analysis. With legislation such as the Cyber Resilience Act, rising expectations for Software Bill of Materials (SBOMs), and mandates for reproducible and auditable builds, collaboration across the ecosystem has never been more essential.
This microconference provides a venue for architects, maintainers, and practitioners from all facets of the Linux build and distribution ecosystem to come together and share ideas, discuss pain points, and identify potential shared solutions.
Target communities and projects include (but are not limited to):
- General-purpose distributions: Debian, Fedora, Ubuntu, Arch Linux, openSUSE, Red Hat
- Source-based systems: Gentoo, NixOS, Guix, CRUX
- Embedded platforms: Yocto Project, OpenEmbedded, Buildroot, OpenWRT/LEDE, Android
- Container ecosystems: Docker, Podman, OCI, BuildKit, distrobuilders
- Immutable, image-based distributions: Flatcar, ParticleOS, Fedora Silverblue, Talos
- RTOS and hybrid build systems: Zephyr, RIOT, Mbed OS, FreeRTOS
- CI/CD and build orchestration: BuildStream, Buildbarn, Bazel, Jenkins, GitLab CI, GitHub Actions
- ML/AI-assisted tooling and infrastructure: anomaly detection, dependency analysis, build optimization, and CI/CD intelligence systems
- Compliance and supply chain security: SPDX, OSI, SBOM tooling, sigstore
- Broader open-source infrastructure efforts and standards bodies
Proposed discussion topics:
- Bootstrapping build systems and managing cross-compilation
- Integration of CI/CD pipelines into build workflows
- Securing the build lifecycle: from developer systems to package publication
- SBOM generation, license auditing, and legal/policy alignment
- Attestation, signing, and ensuring software chain-of-trust
- Handling insecure or volatile upstream language-specific ecosystems (e.g., PyPI, npm, crates.io)
- Reproducible builds and deterministic output across toolchains
- Secure and scalable container build systems and image validation
- Immutable build pipelines for image-based systems and update strategies
- Applying ML/AI to build systems (failure prediction, caching strategies, scheduling, test selection)
- Anomaly detection in build pipelines and supply chain events
- Dependency analysis, risk scoring, and automated patch or update prioritization
- Resilience in build infrastructure for critical systems and edge deployments
- Patch sharing, lifecycle tracking, and cross-distro patch coordination
- Documentation, onboarding, and reducing the learning curve of complex build systems
- Long-term sustainability: mentoring, diversity, and community health of build toolchains
We welcome proposals beyond this list, particularly those that address emerging issues in the creation, validation, maintenance, and secure delivery of Linux-based software systems.
Improving coordination across build systems strengthens the foundations of the open-source ecosystem. Whether youโre maintaining a distro, building firmware, managing containers, applying intelligent systems to improve build and release workflows, or designing infrastructure for high-assurance or real-time systems, this microconference is your forum to advance the state of Linux software construction and security.
-
Krish Pandya (Undergraduate Researcher)
Sugar has been in tree since April 2006. Its last toolkit transition, GTK2 to GTK3, ran from October 2011 to the 0.98 release in November 2012. The current one, GTK3 to GTK4 and X11 to Wayland, is in its second year across twelve repositories. I ported the toolkit and presented that work at GNOME Asia Summit 2025; this year I mentor the two contributors...
Go to contribution page -
Khem Raj (Qualcomm)
Most of Linux distros who follow time based releases, do have LTS release policy e.g. Ubuntu, Yocto, Debian, buildroot to name a few, and then there are rolling releases like archlinux and its family of distros. This talk is to discuss the LTS in the wake of genAI coding agents. There is a fair bit of coding agents at work for yocto project and other distributions doing different functions...
Go to contribution page -
286. The last step to secure reproducible distribution kernels: Hash-based module integrity checkingThomas Weiรschuh (Linutronix)
The kernels current module signature scheme does not work well together with reproducible builds. If the key is generated at build-time the build is not reproducible. A static key that is known to the public does not provide security, but a static key not known to the public does prevent public rebuilds of the kernel for validation purposes.
Currently distributions need to make a...
Go to contribution page -
Alejandro Hernandez Samaniego
Modern embedded Linux build systems such as Yocto and Buildroot rely on complex pipelines that reuse intermediate artifacts and external inputs. While this improves performance and reproducibility, it also creates opportunities for supply chain attacks that are difficult to detect.
This talk demonstrates practical attack vectors targeting build systems at different stages of the pipeline....
Go to contribution page -
Joshua Lilly (Meta)
A build is bitwise reproducible when compiling the same source with the same configuration and toolchain yields byte-for-byte identical output โ an identical vmlinux and bzImage, verifiable by a simple sha256sum. For a normal kernel this is a hygiene property; for a Trusted Execution Environment it is foundational. A platform that measures the code it boots and reports a cryptographic hash is...
Go to contribution page -
Denver Gingerich (Software Freedom Conservancy)
OpenWrt has been fully reproducible for a few months now, the culmination of many years of work to achieve this important milestone. In this talk we'll discuss how we got here, what it took, and tips for other build systems that are looking for the same, including how to handle the unique challenges of reproducibility across multiple cross-compilation targets.
We'll also go into some of...
Go to contribution page