Research
AROMA+ Finds Only 12% of Automatically Reproducible Maven Central Packages Are Actually Fully Reproducible
AROMA+ automates the manual work behind Reproducible Central by recovering a library's source repository and original release environment from its Maven artifact using heuristics, reaching up to 99.8% field-by-field accuracy against the hand-maintained list and catching flaws in it such as broken repository links. Applied at scale, automatic reproduction is feasible for 32% of packages on Maven Central, and 12% of those are fully reproducible. For anyone depending on the Java supply chain, that is a concrete ceiling on how much of it can currently be verified byte-for-byte, and the dataset and tools are public.
↳ Follow the thread