🤖 AI Summary
This work addresses the lack of effective mechanisms to verify the consistency between distributed software artifacts and their source code in large-scale software distribution. To this end, we propose Lila, the first decentralized, reproducible build monitoring framework tailored to functional package management models. By aggregating distributed build reports into a reproducibility database, Lila enables continuous monitoring of over 80,000 software packages and sustains a reproducible build rate exceeding 90%. Our system not only fills a critical gap in reproducibility monitoring within functional package ecosystems but also bridges academic research and real-world deployment needs by delivering a scalable, decentralized infrastructure.
📝 Abstract
Ensuring the integrity of software build artifacts is an increasingly important concern for modern software engineering, driven by increasingly sophisticated attacks on build systems, distribution channels, and development infrastructures. Reproducible builds $\unicode{x2013}$ where binaries built independently from the same source code can be verified to be bit-for-bit identical to the distributed artifacts $\unicode{x2013}$ provide a principled foundation for transparency and trust in software distribution. Despite their potential, the large-scale adoption of reproducible builds faces two significant challenges: achieving high reproducibility rates across vast software collections and establishing reproducibility monitoring infrastructure that can operate at very large scale. While recent studies have shown that high reproducibility rates are achievable at scale $\unicode{x2013}$ demonstrated by the Nix ecosystem achieving over 90% reproducibility on more than 80,000 packages $\unicode{x2013}$ the problem of effective reproducibility monitoring remains largely unsolved. In this work, we address the reproducibility monitoring challenge by introducing Lila, a decentralized system for reproducibility assessment tailored to the functional package management model. Lila enables distributed reporting of build results and aggregation into a reproducibility database, benefiting both practitioners and future empirical build reproducibility studies.