Automatically Analyzing Reproducibility Issues in Java Maven

Sammanfattning

Reproducible builds are essential for verifying that an open-source artifact matches its published source. While ecosystems like Debian have made progress, Java projects remain largely nonreproducible, undermining verifiability and trust. This thesis studies reproducibility in the Java/Maven ecosystem using a dataset of 12,283 Diffoscope comparisons and evaluates the effect of canonicalization via the CHAINS-Rebuild tool, a fork of OSS-Rebuild. We introduce Diffonomy, an automated analyzer that classifies Diffoscope differences into a taxonomy of causes, and use it to quantify the most frequent issues and assess the impact of canonicalization. Date and timestamp differences emerged as the most frequent cause of non-reproducibility after canonicalization. Metadata files such as Software Bill of Materials (SBOMs), Java manifests, Maven Project Object Models (POMs), and reordering in generated files were also common sources of reproducibility issues. Canonicalization with CHAINS-Rebuild substantially reduced manifest and packaging metadata differences (−57% for manifests; −49% overall for packaging metadata) and dramatically reduced file-permission differences (−83%), while SBOMs, dependency metadata, and hash differences were unaffected. Approximately 3,036 artifacts (≈25%) became bit-for-bit identical after canonicalization. These findings can guide efforts within the Java ecosystem to improve reproducibility and extend tools such as OSS-Rebuild to address a broader range of reproducibility issues.