一句话：对六大包生态各4000个包做实证分析，揭示可复现构建率差异，并证明简单基础设施与工具修补可大幅提升可复现性。
软件构建完整性是软件供应链安全的基础，但历史上关注有限，SolarWinds、event-stream 与 xz 等攻击凸显其风险；可复现构建是著名防御，却因技术与协作原因常被认为难以实现。本文在可复用组件打包这一新场景中研究可复现性，覆盖 npm、Maven、PyPI、Go、RubyGems 与 Cargo 六个生态，每个生态定量分析 4000 个代表性包。结果显示各生态可复现率差异巨大，有的全部可复现，有的几乎每个包都有问题；进一步发现只需相对直接的基础设施配置与构建工具修补，即可在所有研究生态中达到很高可复现率。若生态采纳这些建议，几乎全部已发布包无需开发者单独操作即可被独立确认构建过程，从而防范未来的供应链攻击。
The integrity of software builds is fundamental to the security of the software supply chain. While Thompson first raised the potential for attacks on build infrastructure in 1984, limited attention has been given to build integrity in the past 40 years, enabling recent attacks on SolarWinds, event-stream, and xz. The best-known defense against build system attacks is creating reproducible builds; however, achieving them can be complex for both technical and social reasons and thus is often viewed as impractical to obtain. In this paper, we analyze reproducibility of builds in a novel context: reusable components distributed as packages in six popular software ecosystems (npm, Maven, PyPI, Go, RubyGems, and Cargo). Our quantitative study on a representative sample of 4000 packages in each ecosystem raises concerns: Rates of reproducible builds vary widely between ecosystems, with some ecosystems having all packages reproducible whereas others have reproducibility issues in nearly every package. However, upon deeper investigation, we identified that with relatively straightforward infrastructure configuration and patching of build tools, we can achieve very high rates of reproducible builds in all studied ecosystems. We conclude that if the ecosystems adopt our suggestions, the build process of published packages can be independently confirmed for nearly all packages without individual developer actions, and doing so will prevent significant future software supply chain attacks.
DOI 原文 ·
@inproceedings{paperbot8713,
title = {An Empirical Study on Reproducible Packaging in Open-Source Ecosystems},
author = {Giacomo Benedetti and Oreofe Solarin and Courtney Miller and Greg Tystahl and William Enck and Christian Kästner and Alexandros Kapravelos and Alessio Merlo and Luca Verderame},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00136}
}