The increasing complexity of software supply chains and the rise of supply chain attacks have elevated concerns around software integrity. Users and stakeholders face significant challenges in validating that a given software artifact corresponds to its declared source. Reproducible Builds address this challenge by ensuring that independently performed builds from identical source code produce identical binaries. However, achieving reproducibility at scale remains difficult, especially in Java, due to a range of non-deterministic factors and caveats in the build process. In this work, we focus on reproducibility in Java-based software, archetypal of enterprise applications. We introduce a conceptual framework for reproducible builds, we analyze a large dataset from Reproducible Central, and we develop a novel taxonomy of six root causes of unreproducibility. We study actionable mitigations: artifact and bytecode canonicalization using OSS-Rebuild and jNorm respectively. Finally, we present Chains-Rebuild, a tool that achieve successfulcanonicalization for 26.60% on 12,803 unreproducible artifacts To sum up, our contributions are the first large-scale taxonomy of build unreproducibility causes in Java, a publicly available dataset of unreproducible builds, and Chains-Rebuild, a canonicalization tool for mitigating unreproducible builds in Java.

翻译：软件供应链日益复杂化及供应链攻击的兴起，加剧了人们对软件完整性的担忧。用户与利益相关方在验证特定软件制品是否与其声明的源代码相符方面面临重大挑战。可复现构建通过确保基于相同源代码独立执行的构建能产生完全一致的二进制文件，以应对这一挑战。然而，由于构建过程中存在一系列非确定性因素及注意事项，在大规模实现可复现性仍然困难，尤其在Java生态中。本研究聚焦于企业级应用典型代表的Java软件的可复现性问题。我们提出了可复现构建的概念框架，分析了来自Reproducible Central的大规模数据集，并建立了六类不可复现性根本原因的新分类体系。我们研究了可行的缓解方案：分别使用OSS-Rebuild和jNorm进行制品与字节码规范化。最后，我们展示了Chains-Rebuild工具，该工具在12,803个不可复现制品中实现了26.60%的成功规范化率。总结而言，我们的贡献包括：首个Java构建不可复现性成因的大规模分类体系、公开可用的不可复现构建数据集，以及用于缓解Java不可复现构建的规范化工具Chains-Rebuild。