{"id":"https://openalex.org/W7166889393","doi":"https://doi.org/10.1145/3805773.3805997","title":"On the Variability of Source Code in Maven Package Rebuilds","display_name":"On the Variability of Source Code in Maven Package Rebuilds","publication_year":2026,"publication_date":"2026-06-30","ids":{"openalex":"https://openalex.org/W7166889393","doi":"https://doi.org/10.1145/3805773.3805997"},"language":null,"primary_location":{"id":"doi:10.1145/3805773.3805997","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3805773.3805997","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 ACM Secure Development Conference","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3805773.3805997","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5075091948","display_name":"Jens Dietrich","orcid":"https://orcid.org/0000-0001-9019-6550"},"institutions":[{"id":"https://openalex.org/I41156924","display_name":"Victoria University of Wellington","ror":"https://ror.org/0040r6f76","country_code":"NZ","type":"education","lineage":["https://openalex.org/I41156924"]}],"countries":["NZ"],"is_corresponding":false,"raw_author_name":"Jens Dietrich","raw_affiliation_strings":["Victoria University of Wellington, Wellington, New Zealand"],"raw_orcid":"https://orcid.org/0000-0001-9019-6550","affiliations":[{"raw_affiliation_string":"Victoria University of Wellington, Wellington, New Zealand","institution_ids":["https://openalex.org/I41156924"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5085376501","display_name":"Behnaz Hassanshahi","orcid":"https://orcid.org/0009-0006-6639-3056"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Behnaz Hassanshahi","raw_affiliation_strings":["Oracle, Brisbane, Australia"],"raw_orcid":"https://orcid.org/0009-0006-6639-3056","affiliations":[{"raw_affiliation_string":"Oracle, Brisbane, Australia","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"74","last_page":"80"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.5149999856948853,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.5149999856948853,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11675","display_name":"Open Source Software Innovations","score":0.28349998593330383,"subfield":{"id":"https://openalex.org/subfields/1706","display_name":"Computer Science Applications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10430","display_name":"Software Engineering Techniques and Practices","score":0.030799999833106995,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.7919999957084656},{"id":"https://openalex.org/keywords/open-source","display_name":"Open source","score":0.5831000208854675},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.5683000087738037},{"id":"https://openalex.org/keywords/codebase","display_name":"Codebase","score":0.49559998512268066},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4357999861240387},{"id":"https://openalex.org/keywords/open-source-software","display_name":"Open source software","score":0.367000013589859},{"id":"https://openalex.org/keywords/publication","display_name":"Publication","score":0.35899999737739563}],"concepts":[{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.7919999957084656},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.671500027179718},{"id":"https://openalex.org/C3018397939","wikidata":"https://www.wikidata.org/wiki/Q3644502","display_name":"Open source","level":3,"score":0.5831000208854675},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.5683000087738037},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.49720001220703125},{"id":"https://openalex.org/C51929080","wikidata":"https://www.wikidata.org/wiki/Q2425187","display_name":"Codebase","level":3,"score":0.49559998512268066},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4357999861240387},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.3788999915122986},{"id":"https://openalex.org/C2988343187","wikidata":"https://www.wikidata.org/wiki/Q1130645","display_name":"Open source software","level":3,"score":0.367000013589859},{"id":"https://openalex.org/C41458344","wikidata":"https://www.wikidata.org/wiki/Q732577","display_name":"Publication","level":2,"score":0.35899999737739563},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.3521000146865845},{"id":"https://openalex.org/C53942775","wikidata":"https://www.wikidata.org/wiki/Q1211721","display_name":"Code coverage","level":3,"score":0.35019999742507935},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.32850000262260437},{"id":"https://openalex.org/C3020440742","wikidata":"https://www.wikidata.org/wiki/Q1176855","display_name":"Software package","level":3,"score":0.32260000705718994},{"id":"https://openalex.org/C2983685735","wikidata":"https://www.wikidata.org/wiki/Q5227355","display_name":"Data source","level":2,"score":0.3107999861240387},{"id":"https://openalex.org/C121957198","wikidata":"https://www.wikidata.org/wiki/Q14365593","display_name":"KPI-driven code analysis","level":5,"score":0.28610000014305115},{"id":"https://openalex.org/C117447612","wikidata":"https://www.wikidata.org/wiki/Q1412670","display_name":"Software quality","level":4,"score":0.28119999170303345},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.2563000023365021},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.25220000743865967},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.25189998745918274}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3805773.3805997","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3805773.3805997","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 ACM Secure Development Conference","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3805773.3805997","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3805773.3805997","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 ACM Secure Development Conference","raw_type":"proceedings-article"},"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","score":0.6950876712799072,"id":"https://metadata.un.org/sdg/9"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W2014030636","https://openalex.org/W2128888088","https://openalex.org/W2170267084","https://openalex.org/W2597809331","https://openalex.org/W2962804757","https://openalex.org/W2999907777","https://openalex.org/W3046453918","https://openalex.org/W3212800749","https://openalex.org/W4220682629","https://openalex.org/W4225538569","https://openalex.org/W4310364134","https://openalex.org/W4327939507","https://openalex.org/W4384948741","https://openalex.org/W4388954907","https://openalex.org/W4391418772","https://openalex.org/W4391630087","https://openalex.org/W4400582851","https://openalex.org/W4411551801","https://openalex.org/W4415746147","https://openalex.org/W7125910396","https://openalex.org/W7125975653"],"related_works":[],"abstract_inverted_index":{"Rebuilding":[0],"packages":[1,91,102,122],"from":[2,103],"open":[3],"source":[4,32,73],"is":[5,18,28,75,138],"a":[6,37,41],"common":[7],"practice":[8],"to":[9,29,35,150,155],"improve":[10],"the":[11,31,50,68,71,87,96,128,135],"security":[12],"of":[13,119,130],"software":[14],"supply":[15],"chains,":[16],"and":[17,56,108,132],"now":[19],"done":[20],"at":[21,144],"an":[22],"industrial":[23],"scale.":[24],"The":[25],"basic":[26],"principle":[27],"acquire":[30],"code":[33,74,143],"used":[34,77],"build":[36,139,145],"package":[38,51],"published":[39],"in":[40,59],"repository":[42],"such":[43],"as":[44],"Maven":[45,93],"Central":[46],"(for":[47],"Java),":[48],"rebuild":[49],"independently":[52,100],"with":[53,90,95,99,123],"hardened":[54],"security,":[55],"publish":[57],"it":[58],"some":[60],"alternative":[61,80,117],"repository.":[62],"In":[63],"this":[64,157],"paper":[65],"we":[66,85],"test":[67],"assumption":[69],"that":[70,134,141],"same":[72],"being":[76],"by":[78],"those":[79],"builds.":[81],"To":[82],"study":[83,113],"this,":[84],"compare":[86],"sources":[88,97,115],"released":[89],"on":[92],"Central,":[94],"associated":[98],"built":[101],"Google's":[104],"Assured":[105],"Open":[106],"Source":[107],"Oracle's":[109],"Build-from-Source":[110],"projects.":[111],"We":[112,126,152],"non-equivalent":[114],"for":[116],"builds":[118],"28":[120],"popular":[121],"85":[124],"releases.":[125],"investigate":[127],"causes":[129],"non-equivalence,":[131],"find":[133],"main":[136],"cause":[137],"extensions":[140],"generate":[142],"time,":[146],"which":[147],"are":[148],"difficult":[149],"reproduce.":[151],"suggest":[153],"strategies":[154],"address":[156],"issue.":[158]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-07-02T00:00:00"}