可复现性不足：去中心化构建包生态系统中的工件可验证性研究
原标题：Reproducibility is Not Enough: Artifact Verifiability in Decentralized-Build Package Ecosystems
AI 摘要
该论文研究了四个去中心化构建的包生态系统（Crates.io、npm、PyPI、RubyGems）中工件可验证性的问题。作者提出了独立验证者模型和分层等价比较模型，并实现了工件验证流水线（AVP），对34005个包进行了实证测量。结果显示，约53%-87%的完成重建可验证，但恢复源代码提交是主要障碍；来源证明和嵌入的VCS元数据能改善验证，但不足以提供完整的重建规范。研究指出了具体的元数据缺口和生态系统级改进需求，以支持可验证性作为软件供应链防御。
正文节选
Reproducibility is Not Enough: Artifact Verifiability in Decentralized-Build Package Ecosystems Abstract Reproducible and verifiable builds increase trust in distributed software artifacts by enabling independent parties to detect artifacts produced by compromised build or release pipelines. However, artifact verification requires more than deterministic builds: a verifier must also recover the source state, build environment, dependencies, and build instructions that produced the artifact. Dece