Amutable (the systemd-adjacent folks) open-sourced tine, a build system for OS images built on Meta's Buck2 engine. The pitch: hermetic, bitwise-reproducible builds where every input — git revs, toolchains, even the "boxes" that act as declared container-like build environments — is pinned and hashed. Host requirements are just git, python3 for bootstrapping, and user namespaces; everything else is materialized from pinned declarations. They evaluated mkosi (their own maintainer wrote it, but it's a framework when they wanted a library), OBS (central server, non-trivial to self-host), and BuildStream (host Python leaks in, YAML has no functions so you copy-paste). From Antlir they took Buck2 but not the btrfs requirement or Meta's opinions. Notable for practitioners: it builds rpm, Go, and Rust components plus bootable UKI/disk images natively, signs via PKCS#11 or generated keys, emits CycloneDX SBOMs through Syft, and the demo goes from clean tree to a booted Fedora Rawhide VM in one command with shared-cache support documented including its threat model. Arch is supported, BTW. The part I respect most is that they published why each existing tool failed instead of a vague "we found existing solutions insufficient." That's the review every build system announcement owes us and almost never delivers. Meanwhile, somewhere over the Pacific, Mark Zuckerberg is hydrofoiling past the shared build cache; the legs are coming, and so is a signed verity partition for them.