Problem
Research questions and friction points this paper is trying to address.
Reproducible Builds
Maven Ecosystem
Security Risk
Software Supply Chain
AROMA+: A Study of Factors Affecting Reproducible Builds in the Maven Ecosystem
🤖 AI Summary
研究针对Maven生态系统中构建可再现性问题，通过开发AROMA+工具自动化查找库源代码及恢复原始发布环境信息，实现高达99.8%的准确率。
📝 Abstract
Modern software engineering establishes software supply chains and relies on tools and libraries to improve productivity. However, reusing external software in a project presents a security risk when the source of the component is unknown or the consistency of a component cannot be verified. Reproducible builds present a mitigation strategy, as they can confirm the origin and consistency of reused components. A large reproducibility community has formed for Debian, but the reproducibility of the Maven ecosystem, the backbone of the Java supply chain, remains understudied in comparison. Reproducible Central is an initiative that curates a list of reproducible Maven libraries, but the list is limited and challenging to maintain due to manual efforts. Our research aims to support these efforts in the Maven ecosystem through automation. We investigate the feasibility of automatically finding the source code of a library from its Maven release and recovering information about the original release environment. Our tool, AROMA+, can obtain this critical information from the artifact and the source repository through several heuristics and we use the results for reproduction attempts of packages on Maven Central. Overall, our approach achieves an accuracy of up to 99.8% when compared field-by-field to the existing manual approach. In some instances, we even detected flaws in the manually maintained list, such as broken repository links. We reveal that automatic reproducibility is feasible for 32% of the packages on Maven Central using AROMA+, and 12% of these packages are fully reproducible. We demonstrate our ability to successfully reproduce new packages and have contributed some of them to the Reproducible Central repository. Additionally, we highlight actionable insights, outline future work in this area, and make our dataset and tools publicly available.
Innovation
Methods, ideas, or system contributions that make the work stand out.
Automatic Reproducibility
Maven Ecosystem
Source Code Recovery
Release Environment Information
🔎 Similar Papers
No similar papers found.
