Maven-Lockfile: High Integrity Rebuild of Past Java Releases
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2025
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866911193829998592 |
|---|---|
| author | Schmid, Larissa Lundell, Elias Gamage, Yogya Baudry, Benoit Monperrus, Martin |
| author_facet | Schmid, Larissa Lundell, Elias Gamage, Yogya Baudry, Benoit Monperrus, Martin |
| contents | Modern software projects depend on many third-party libraries, complicating reproducible and secure builds. Several package managers address this with the generation of a lockfile that freezes dependency versions and can be used to verify the integrity of dependencies. Yet, Maven, one of the most important package managers in the Java ecosystem, lacks native support for a lockfile. We present Maven-Lockfile to generate and update lockfiles, with support for rebuilding projects from past versions. Our lockfiles capture all direct and transitive dependencies with their checksums, enabling high integrity builds. Our evaluation shows that Maven-Lockfile can reproduce builds from historical commits and is able to detect tampered artifacts. With minimal configuration, Maven-Lockfile equips Java projects with modern build integrity and build reproducibility, and fosters future research on software supply chain security in Java. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2510_00730 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Maven-Lockfile: High Integrity Rebuild of Past Java Releases Schmid, Larissa Lundell, Elias Gamage, Yogya Baudry, Benoit Monperrus, Martin Software Engineering Cryptography and Security Modern software projects depend on many third-party libraries, complicating reproducible and secure builds. Several package managers address this with the generation of a lockfile that freezes dependency versions and can be used to verify the integrity of dependencies. Yet, Maven, one of the most important package managers in the Java ecosystem, lacks native support for a lockfile. We present Maven-Lockfile to generate and update lockfiles, with support for rebuilding projects from past versions. Our lockfiles capture all direct and transitive dependencies with their checksums, enabling high integrity builds. Our evaluation shows that Maven-Lockfile can reproduce builds from historical commits and is able to detect tampered artifacts. With minimal configuration, Maven-Lockfile equips Java projects with modern build integrity and build reproducibility, and fosters future research on software supply chain security in Java. |
| title | Maven-Lockfile: High Integrity Rebuild of Past Java Releases |
| topic | Software Engineering Cryptography and Security |
| url | https://arxiv.org/abs/2510.00730 |