AROMA+：Maven生态系统中影响可复现构建的因素研究
AROMA+: A Study of Factors Affecting Reproducible Builds in the Maven Ecosystem
AI总结：
本研究针对Maven生态系统可复现构建研究不足的问题，开发工具AROMA+自动获取相关信息，准确率达99.8%，实现32%软件包自动可复现，贡献部分软件包至Reproducible Central并公开数据集与工具。
AI中文摘要：
现代软件工程构建了软件供应链，并依赖工具和库来提高生产力。然而，在项目中复用外部软件时，若组件来源未知或其一致性无法验证，就会带来安全风险。可复现构建是一种缓解策略，可确认复用组件的来源和一致性。Debian已形成了庞大的可复现性社区，但作为Java供应链核心支柱的Maven生态系统的可复现性却研究不足。Reproducible Central是一项整理可复现Maven库列表的倡议，但该列表范围有限，且因依赖人工维护而难以持续。本研究旨在通过自动化支持Maven生态系统中的相关工作，探究从Maven发布版本自动查找库的源代码并恢复原始发布环境信息的可行性。我们的工具AROMA+可通过多种启发式方法从构件和源代码仓库中获取此类关键信息，并将结果用于Maven Central上软件包的复现尝试。总体而言，与现有人工方法逐字段对比，本方法的准确率高达99.8%；在部分案例中，我们甚至检测到人工维护列表中的缺陷，如仓库链接失效。研究表明，使用AROMA+对Maven Central上32%的软件包可实现自动可复现性，其中12%的软件包可完全复现。我们成功复现了新软件包，并将部分软件包贡献至Reproducible Central仓库；此外，我们还提出了可操作的见解，概述了该领域的未来工作，并公开了我们的数据集和工具。
英文摘要：
Modern software engineering establishes software supply chains and relies on tools and libraries to improve productivity. However, reusing external software in a project presents a security risk when the source of the component is unknown or the consistency of a component cannot be verified. Reproducible builds present a mitigation strategy, as they can confirm the origin and consistency of reused components. A large reproducibility community has formed for Debian, but the reproducibility of the Maven ecosystem, the backbone of the Java supply chain, remains understudied in comparison. Reproducible Central is an initiative that curates a list of reproducible Maven libraries, but the list is limited and challenging to maintain due to manual efforts. Our research aims to support these efforts in the Maven ecosystem through automation. We investigate the feasibility of automatically finding the source code of a library from its Maven release and recovering information about the original release environment. Our tool, AROMA+, can obtain this critical information from the artifact and the source repository through several heuristics and we use the results for reproduction attempts of packages on Maven Central. Overall, our approach achieves an accuracy of up to 99.8% when compared field-by-field to the existing manual approach. In some instances, we even detected flaws in the manually maintained list, such as broken repository links. We reveal that automatic reproducibility is feasible for 32% of the packages on Maven Central using AROMA+, and 12% of these packages are fully reproducible. We demonstrate our ability to successfully reproduce new packages and have contributed some of them to the Reproducible Central repository. Additionally, we highlight actionable insights, outline future work in this area, and make our dataset and tools publicly available.
