一句话：为 Maven 引入 lockfile，冻结依赖及校验和，支持历史版本可重建与篡改检测。
现代软件项目依赖大量第三方库，使构建的可复现性与安全性变得困难。Maven 作为 Java 生态重要包管理器，原生缺乏 lockfile 支持。本文提出 Maven-Lockfile，用于生成和更新 lockfile，并支持从历史版本重建项目。其 lockfile 记录所有直接与传递依赖及其校验和，从而实现高完整性构建。评估表明，该工具能够复现历史提交的构建，并检测被篡改的构件；仅需少量配置即可为 Java 项目带来现代构建完整性和可复现性，并促进 Java 软件供应链安全研究。
Modern software projects depend on many third-party libraries, complicating reproducible and secure builds. Several package managers address this with the generation of a lockfile that freezes dependency versions and can be used to verify the integrity of dependencies. Yet, Maven, one of the most important package managers in the Java ecosystem, lacks native support for a lockfile. We present Maven-Lockfile to generate and update lockfiles, with support for rebuilding projects from past versions. Our lockfiles capture all direct and transitive dependencies with their checksums, enabling high integrity builds. Our evaluation shows that Maven-Lockfile can reproduce builds from historical commits and is able to detect tampered artifacts. With minimal configuration, Maven-Lockfile equips Java projects with modern build integrity and build reproducibility, and fosters future research on software supply chain security in Java. Demonstration: https://youtu.be/eGgR3toBgxU
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2510-00730,
title = {Maven-Lockfile: High Integrity Rebuild of Past Java Releases},
author = {Larissa Schmid and Elias Lundell and Yogya Gamage and Benoit Baudry and Martin Monperrus},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3774748.3787615}
}