一句话：扩展 Macaron 框架，自动化从源码重建 Maven 构件，提升开源供应链安全与可复现性。
Maven Central 等生态中二进制与源码分离，构建环境不透明，约 84% 的常用 top artifacts 未通过透明 CI/CD 构建，用户需信任源码及构建环境，带来供应链安全风险。从源码重建可审查代码、验证二进制-源码等价并控制依赖，但环境差异（如 JDK 版本、构建命令）和复杂依赖图易导致失败。本文扩展 Macaron 框架，自动化从源码重建 Maven 构件，改进源码检测性能，自动提取 GitHub Actions 构建规格，并对 Java 项目构建失败进行根因分析，提出可扩展方案。方法在 Java 上展示，也可扩展至 Python 与 npm。
Software ecosystems like Maven Central play a crucial role in modern software supply chains by providing repositories for libraries and build plugins. However, the separation between binaries and their corresponding source code in Maven Central presents a significant challenge, particularly when it comes to linking binaries back to their original build environment. This lack of transparency poses security risks, as approximately 84% of the top 1200 commonly used artifacts are not built using a transparent CI/CD pipeline. Consequently, users must place a significant amount of trust not only in the source code but also in the environment in which these artifacts are built.Rebuilding software artifacts from source provides a robust solution to improve supply chain security. This approach allows for a deeper review of code, verification of binary-source equivalence, and control over dependencies. However, challenges arise due to variations in build environments, such as JDK versions and build commands, which can lead to build failures. Additionally, ensuring that all dependencies are rebuilt from source across large and complex dependency graphs further complicates the process. In this paper, we introduce an extension to Macaron, an industry-grade open-source supply chain security framework, to automate the rebuilding of Maven artifacts from source. Our approach improves upon existing tools, by offering better performance in source code detection and automating the extraction of build specifications from GitHub Actions workflows. We also present a comprehensive root cause analysis of build failures in Java projects and propose a scalable solution to automate the rebuilding of artifacts, ultimately enhancing security and transparency in the open-source supply chain. While we demonstrate our approach for Java, our solution is easily extensible to other languages and ecosystems like Python and npm packages.
DOI 原文 ·
@inproceedings{paperbot9268,
title = {Unlocking Reproducibility: Automating re-Build Process for Open-Source Software},
author = {Behnaz Hassanshahi and Trong Nhan Mai and Benjamin Selwyn Smith and Nicholas Allen},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00280}
}