arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2501.15919cs.SE
收藏

功能包管理是否能够实现大规模可重复构建？是

Does Functional Package Management Enable Reproducible Builds at Scale? Yes

LTCI, Télécom Paris Institut Polytechnique de Paris（巴黎电信学院，巴黎理工学院）

Julien Malka, Stefano Zacchiroli, Théo Zimmermann

发表信息：
22nd International Conference on Mining Software Repositories, Apr 2025, Ottawa, Canada
阅读 PDF
arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文通过大规模研究Nix功能包管理器，验证了大规模可重复构建的可行性，发现位级可重复性率高达69%-91%，重新构建率超过99%。

摘要：

可重复构建（R-B）保证从源代码重新构建软件包会得到位级相同的产物。R-B是提高软件供应链完整性的有希望的方法，当安装第三方构建的开源软件时。不幸的是，尽管像Debian包中高构建可重复性水平的成功案例，领域专家对R-B在非常大的包仓库中的可扩展性仍存在不确定性。在本工作中，我们进行了首次大规模研究，针对Nix功能包管理器的位级可重复性，重新构建了709816个来自nixpkgs仓库历史快照的包，这是最大的跨生态系统开源软件发行版，在2017-2023年间采样。我们获得了非常高的位级可重复性率，介于69%到91%，并且有上升趋势，甚至更高的重新构建率，超过99%。我们调查了不可重复性原因，显示大约15%的失败是由于嵌入的构建日期。我们发布了一个新的数据集，包含所有构建状态、日志以及完整的''diffoscopes'': 递归差异，显示不可重复构建产物的不同之处。

英文摘要：

Reproducible Builds (R-B) guarantee that rebuilding a software package from source leads to bitwise identical artifacts. R-B is a promising approach to increase the integrity of the software supply chain, when installing open source software built by third parties. Unfortunately, despite success stories like high build reproducibility levels in Debian packages, uncertainty remains among field experts on the scalability of R-B to very large package repositories. In this work, we perform the first large-scale study of bitwise reproducibility, in the context of the Nix functional package manager, rebuilding 709 816 packages from historical snapshots of the nixpkgs repository, the largest cross-ecosystem open source software distribution, sampled in the period 2017-2023. We obtain very high bitwise reproducibility rates, between 69 and 91% with an upward trend, and even higher rebuildability rates, over 99%. We investigate unreproducibility causes, showing that about 15% of failures are due to embedded build dates. We release a novel dataset with all build statuses, logs, as well as full ''diffoscopes'': recursive diffs of where unreproducible build artifacts differ.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

↑