Search papers, labs, and topics across Lattice.
This paper investigates the verifiability of software artifacts in decentralized-build ecosystems, highlighting the challenges posed by heterogeneous tools and fragmented metadata. The authors introduce an independent verifier model and an artifact comparison model to assess verifiability across four popular ecosystems, revealing that missing source and build metadata significantly hinder verification efforts. Key findings indicate that while provenance attestations and embedded version control system (VCS) metadata enhance verification, they are insufficient for complete rebuild specifications, necessitating ecosystem-level changes to improve artifact trustworthiness.
Verifiability of software artifacts in decentralized ecosystems is severely limited by metadata gaps, revealing a critical need for systemic improvements to enhance trust in distributed builds.
Reproducible and verifiable builds increase trust in distributed software artifacts by enabling independent parties to detect artifacts produced by compromised build or release pipelines. However, artifact verification requires more than deterministic builds: a verifier must also recover the source state, build environment, dependencies, and build instructions that produced the artifact. Decentralized-build ecosystems make this difficult because artifacts are produced through heterogeneous tools, maintainer-controlled workflows, and fragmented metadata. As a result, it remains unclear how often artifacts in these ecosystems can be independently verified. This paper studies artifact verifiability across four popular decentralized-build package ecosystems. We define an independent verifier model that relies only on registry-derivable metadata and an artifact comparison model with tiered equivalence levels. We implement these models in an Artifact Verification Pipeline and use it to measure artifact verifiability across the target ecosystems. Our results show that, beyond build determinism, verifiability is limited by missing source and build metadata, implicit release transformations, and unconventional build practices. Provenance attestations and embedded VCS metadata improve verification, but they do not provide complete rebuild specifications. These findings identify concrete metadata gaps and ecosystem-level changes needed to make artifact verification practical at package-registry scale.
