Search papers, labs, and topics across Lattice.
This study introduces AROMA+, an automated tool designed to enhance reproducibility in the Maven ecosystem by accurately retrieving source code and release environment information for Maven libraries. The research reveals that AROMA+ can achieve up to 99.8% accuracy compared to manual methods, identifying flaws in existing repositories and demonstrating that automatic reproducibility is achievable for 32% of Maven Central packages, with 12% being fully reproducible. By contributing new packages to the Reproducible Central repository, this work significantly advances the reliability of software supply chains in Java development.
Automatic reproducibility for 32% of Maven Central packages reveals critical flaws in manual curation efforts and sets a new standard for software reliability.
Modern software engineering establishes software supply chains and relies on tools and libraries to improve productivity. However, reusing external software in a project presents a security risk when the source of the component is unknown or the consistency of a component cannot be verified. Reproducible builds present a mitigation strategy, as they can confirm the origin and consistency of reused components. A large reproducibility community has formed for Debian, but the reproducibility of the Maven ecosystem, the backbone of the Java supply chain, remains understudied in comparison. Reproducible Central is an initiative that curates a list of reproducible Maven libraries, but the list is limited and challenging to maintain due to manual efforts. Our research aims to support these efforts in the Maven ecosystem through automation. We investigate the feasibility of automatically finding the source code of a library from its Maven release and recovering information about the original release environment. Our tool, AROMA+, can obtain this critical information from the artifact and the source repository through several heuristics and we use the results for reproduction attempts of packages on Maven Central. Overall, our approach achieves an accuracy of up to 99.8% when compared field-by-field to the existing manual approach. In some instances, we even detected flaws in the manually maintained list, such as broken repository links. We reveal that automatic reproducibility is feasible for 32% of the packages on Maven Central using AROMA+, and 12% of these packages are fully reproducible. We demonstrate our ability to successfully reproduce new packages and have contributed some of them to the Reproducible Central repository. Additionally, we highlight actionable insights, outline future work in this area, and make our dataset and tools publicly available.
