kpcyrd 🏴 (@kpcyrd.chaos.social.ap.brid.gy)

kpcyrd: 2025 wrapped Same as last year, this is a summary of what I’ve been up to throughout the year. See also the recap/retrospection published by my friends (antiz, jvoisin, orhun). * Uploaded 467 packages to Arch Linux * Most of them being reproducible, meaning I provably didn’t abuse my position of compiling the binaries * 35 of them are signal-desktop * 29 of them are metasploit * Made 53 uploads to Debian * All of them being related to my work in the debian-rust team, that I’ve been a part of since 2018 * Also applied for Debian Developer status (with 4 Debian Developers advocating for me) * Made 14 commits in Alpine Linux’ aports * 13 of them being package releases * Made 2 commits in NixOS’ nixpkgs * Also joined their Github org * Made 4 commits in homebrew-core * With special focus on polishing the Rust development experience for the RP2040 microcontroller * Lost Onion, my cat of 13 years, to inoperable cancer. He has been with me throughout my entire open source journey (sometimes being credited as co-author) and who looked after me for my entire adult life. You won’t be forgotten. 🐈‍⬛ * Developed 6 hand-held games with embedded Rust, most of them being birthday gifts for people close to me * game-taco-burglar * A motorcycling lockpicker * game-antifa-syndikitty * A nurse with a secret double life * At that point the longest and most in-depth game I built throughout my life * game-chop-chop * A French tetris-spinoff, this was one of my Fusion projects this year * The hardware was specifically designed to be easy to solder/make from readily available parts (~€5 per unit) * I gave away a few devices I made, some people successfully built one on their own * game-ratatat * A space-invader like game about a very enthusiastic seamster * game-octo-space-irs * As an employee of the intergalactic revenue service, you tax the rich through reversing and cracking computer programs * I gifted another copy to a Tor directory authority operator I’m friends with, who was very excited about the concept and levels I designed * game-the-curse-of-the-headless-goose * A turn-based game about an underground kickboxing club * This one was meant to be a rogue-lite (which I needed the savegame library for), but only managed to build the introduction/tutorial unfortunately * Picked up work on apt-swarm again * Replaced the old database code with a custom engine, reducing RAM usage from multiple gigabytes down to ~9MB * Ran a small p2p network all over the world, with ~10-15 locations/countries on average * As part of this, found a bug in tokio that could lead to silent data loss in some cases * Had 2 of my projects explicitly mentioned in the Debian release notes in their “What’s new in Debian 13” summary * Was mentioned in multiple academic papers on arxiv.org: * Reproducible Builds and Insights from an Independent Verifier for Arch Linux (explicitly in the “Acknowledgments” section) * Beneath the Mask: Can Contribution Data Unveil Malicious Personas in Open-Source Projects? * Wolves in the Repository: A Software Engineering Analysis of the XZ Utils Supply Chain Attack * Causes and Canonicalization of Unreproducible Builds in Java * Reproducible Builds for Quantum Computing (mentions rebuilderd) * Was referenced twice on LWN: * Hash-based module integrity checking (mentions me directly) * Fedora change aims for 99% package reproducibility (doesn’t mention me, but rebuilderd 10x) * Published a draft version of PlatypOS, an “Experimental toy unix-like userspace operating system with strong preference towards Rust”. As part of this: * Developed custom pacman-database tooling in Rust instead of bash * During this project I found and reported issues in uutils’ `install` (uutils/coreutils#8033) and `mv` (uutils/coreutils#8044) (both fixed shortly after) * The project stalled because it’s too big to side-quest * Had the first ever CVE issued for software I wrote: CVE-2025-52926 * Found, reported and fixed by a c’t Open Source editor * Published 9 repositories related to my embedded Rust work * embedded-mono-img for all the graphics in my games * rp2040-psp-joystick to demo use of an analog joystick input * rp2040-demo-st7789 to demo a higher resolution screen I experimented with * rp2040-demo-w25qxx to demo how to store data in NOR flash * rp2040-demo-at24cxx to demo how to store data in an EEPROM * embedded-graphics-colorcast a library I developed so I can keep using embedded-mono-img on ST7789/ILI9486 screens - I used tinybmp in one project but it was fairly slow * ch32v003-demo to demo and document the lowend ch32v003 RISC-V microcontroller, with devboards that are commonly sold for €0.50-0.70 on AliExpress (it’s cute but lacks the required 5.1kΩ resistors on the USB-C configuration pins that tell the host to provide 5V, so it won’t work with many USB-C chargers, which is quite annoying) * embedded-savegame an atomic/transactional savegame library, with powerfail-safety and wear-leveling, optimized for flash and EEPROM storage * djb2 a very lightweight non-cryptographic checksum algorithm that replaced my use of CRC32 in the embedded-savegame library, to make it more suitable for the ch32v003 * Contributed to the Reproducible Builds mailing list 30 times * Developed repro-threshold, an integration for apt to act as a rebuilderd client, enforcing a reproducible builds trust policy of your choice * The feature was suggested/requested by a CCC member during MiniDebConf Hamburg 2025 * Collaborated with an openSUSE engineer I’ve known for several years to debug and fix an issue in gtk-rs that caused indeterministic build output for many desktop programs * Volunteered at a soldering workshop for beginners for the 4th year in a row * Completed the first year of volunteering in an awareness team * Wrote 1 blog post (besides this one) * Attended FOSDEM, MiniDebConf, Fusion, the Reproducible Builds summit, the Arch Summit and 39c3 * Hosted sessions at both FOSDEM (1st time) and Fusion (2nd time) * Grew and harvested 2 plants * Traveled to * Denmark * Sweden * Turkey, visiting a good friend * Belgium * Austria * Made and printed * 2 new sticker designs * 2 new hoodie designs * Changed my medication plan * Got 4 new tattoos Thanks to everybody who has been part of my human experience, past or present. Especially those who’ve been closest. https://vulns.xyz/2025/12/2025-wrapped/