{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,24]],"date-time":"2026-09-24T18:50:04Z","timestamp":1790275804597,"version":"4.1.0"},"reference-count":65,"publisher":"Association for Computing Machinery (ACM)","issue":"FSE","license":[{"start":{"date-parts":[[2024,7,12]],"date-time":"2024-07-12T00:00:00Z","timestamp":1720742400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"This study is funded by a European H2020 project, FASTEN","award":["825328"],"award-info":[{"award-number":["825328"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Proc. ACM Softw. Eng."],"published-print":{"date-parts":[[2024,7,12]]},"abstract":"<jats:p>\n                    Modern software engineering establishes software supply chains and relies on tools and libraries to improve productivity. However, reusing external software in a project presents a security risk when the source of the component is unknown or the consistency of a component cannot be verified. The SolarWinds attack serves as a popular example in which the injection of malicious code into a library affected thousands of customers and caused a loss of billions of dollars. Reproducible builds present a mitigation strategy, as they can confirm the origin and consistency of reused components. A large reproducibility community has formed for Debian, but the reproducibility of the\n                    <jats:sc>Maven<\/jats:sc>\n                    ecosystem, the backbone of the Java supply chain, remains understudied in comparison. Reproducible Central is an initiative that curates a list of reproducible\n                    <jats:sc>Maven<\/jats:sc>\n                    libraries, but the list is limited and challenging to maintain due to manual efforts. Our research aims to support these efforts in the\n                    <jats:sc>Maven<\/jats:sc>\n                    ecosystem through automation. We investigate the feasibility of automatically finding the source code of a library from its\n                    <jats:sc>Maven<\/jats:sc>\n                    release and recovering information about the original release environment. Our tool, AROMA, can obtain this critical information from the artifact and the source repository through several heuristics and we use the results for reproduction attempts of\n                    <jats:sc>Maven<\/jats:sc>\n                    packages. Overall, our approach achieves an accuracy of up to 99.5% when compared field-by-field to the existing manual approach. In some instances, we even detected flaws in the manually maintained list, such as broken repository links. We reveal that automatic reproducibility is feasible for 23.4% of the\n                    <jats:sc>Maven<\/jats:sc>\n                    packages using AROMA, and 8% of these packages are fully reproducible. We demonstrate our ability to successfully reproduce new packages and have contributed some of them to the Reproducible Central repository. Additionally, we highlight actionable insights, outline future work in this area, and make our dataset and tools available to the public.\n                  <\/jats:p>","DOI":"10.1145\/3643764","type":"journal-article","created":{"date-parts":[[2024,7,12]],"date-time":"2024-07-12T10:22:09Z","timestamp":1720779729000},"page":"836-858","source":"Crossref","is-referenced-by-count":12,"title":["AROMA: Automatic Reproduction of Maven Artifacts"],"prefix":"10.1145","volume":"1","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8647-0067","authenticated-orcid":false,"given":"Mehdi","family":"Keshani","sequence":"first","affiliation":[{"name":"Delft University of Technology, Delft, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-7260-4957","authenticated-orcid":false,"given":"Tudor-Gabriel","family":"Velican","sequence":"additional","affiliation":[{"name":"Delft University of Technology, Amsterdam, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-0179-4109","authenticated-orcid":false,"given":"Gideon","family":"Bot","sequence":"additional","affiliation":[{"name":"Delft University of Technology, Delft, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1856-9361","authenticated-orcid":false,"given":"Sebastian","family":"Proksch","sequence":"additional","affiliation":[{"name":"Delft University of Technology, Delft, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,7,12]]},"reference":[{"key":"e_1_3_1_2_2","doi-asserted-by":"publisher","unstructured":"Rabe Abdalkareem Olivier Nourry Sultan Wehaibi Suhaib Mujahid and Emad Shihab. 2017. Why Do Developers Use Trivial Packages? An Empirical Case Study on npm. In Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering. https:\/\/doi.org\/10.1145\/3106237.3106267 10.1145\/3106237.3106267","DOI":"10.1145\/3106237.3106267"},{"key":"e_1_3_1_3_2","unstructured":"Apache. 2023. apache repository. https:\/\/infra.apache.org\/blog\/relocation-of-apache-git-repositories. Accessed: 2023-08-22."},{"key":"e_1_3_1_4_2","unstructured":"Apache. 2023. Replacing Build-Jdk with Build-Jdk-Spec Github. https:\/\/Github.com\/apache\/Maven-archiver\/pull\/2\/files. Accessed: 2023-09-25."},{"key":"e_1_3_1_5_2","unstructured":"Apache. 2023. Replacing Build-Jdk with Build-Jdk-Spec Jira. https:\/\/issues.apache.org\/jira\/browse\/MSHARED-797. Accessed: 2023-09-26."},{"key":"e_1_3_1_6_2","doi-asserted-by":"publisher","DOI":"10.1007\/S10664-014-9325-9"},{"key":"e_1_3_1_7_2","doi-asserted-by":"publisher","unstructured":"Amine Benelallam Nicolas Harrand C\u00e9r Soto-Valero Benoit Baudry and Olivier Barais. 2019. The Maven dependency graph: a temporal graph-based representation of Maven Central. In 2019 IEEE\/ACM 16th International Conference on Mining Software Repositories (MSR). https:\/\/doi.org\/10.1109\/MSR.2019.00060 10.1109\/MSR.2019.00060","DOI":"10.1109\/MSR.2019.00060"},{"key":"e_1_3_1_8_2","unstructured":"Reproducible Builds. 2023. Reproducible Builds. https:\/\/reproducible-builds.org. Accessed: 2023-09-13."},{"key":"e_1_3_1_9_2","doi-asserted-by":"publisher","DOI":"10.1007\/S11219-022-09607-Z"},{"key":"e_1_3_1_10_2","unstructured":"Reproducible Central. 2023. RC default Maven. https:\/\/Github.com\/jvm-repo-rebuild\/reproducible-central\/blob\/844298749c5f78b2a914f9180b949d9e1fc2bc56\/doc\/BUILDSPEC.md#format. Accessed: 2023-09-28."},{"key":"e_1_3_1_11_2","unstructured":"Reproducible Central. 2023. Reproducible Central Repo. https:\/\/Github.com\/jvm-repo-rebuild\/reproducible-central. Accessed: 2023-06-20."},{"key":"e_1_3_1_12_2","unstructured":"Cisecurity. 2023. SolarWinds attack. https:\/\/www.cisecurity.org\/solarwinds. Accessed: 2023-09-28."},{"key":"e_1_3_1_13_2","doi-asserted-by":"publisher","DOI":"10.1007\/S10664-021-09980-6"},{"key":"e_1_3_1_14_2","doi-asserted-by":"publisher","unstructured":"Xavier de Carn\u00e9e Carnavalet and Mohammad Mannan. 2014. Challenges and implications of verifiable builds for security-critical open-source software. Proceedings of the 30th Annual Computer Security Applications Conference. https:\/\/doi.org\/10.1145\/2664243.2664288 10.1145\/2664243.2664288","DOI":"10.1145\/2664243.2664288"},{"key":"e_1_3_1_15_2","unstructured":"Debian. 2023. DebainRepStats. https:\/\/reproducible-builds.org\/citests\/. Accessed: 2023-09-19."},{"key":"e_1_3_1_16_2","unstructured":"Diffoscope. 2023. diffoscope. https:\/\/diffoscope.org\/. Accessed: 2023-09-25."},{"key":"e_1_3_1_17_2","doi-asserted-by":"crossref","DOI":"10.1145\/3472811","article-title":"Analyzing the Direct and Transitive Impact of Vulnerabilities onto Different Artifact Repositories","author":"D\u00fcsing Johannes","year":"2022","unstructured":"Johannes D\u00fcsing and Ben Hermann. 2022. Analyzing the Direct and Transitive Impact of Vulnerabilities onto Different Artifact Repositories. Digital Threats: Research and Practice (2022).","journal-title":"Digital Threats: Research and Practice"},{"key":"e_1_3_1_18_2","doi-asserted-by":"publisher","unstructured":"Mehdi Keshani .. 2023. Replication package. https:\/\/doi.org\/10.5281\/zenodo.8380775 10.5281\/zenodo.8380775. Accessed: 2023-09-27.","DOI":"10.5281\/zenodo.8380775"},{"key":"e_1_3_1_19_2","doi-asserted-by":"publisher","unstructured":"Marcel Fourn Dominik Wermke William Enck Sascha Fahl and Yasemin Acar. 2023. It\u2019s like flossing your teeth: On the Importance and Challenges of Reproducible Builds for Software Supply Chain Security. In 44th IEEE Symposium on Security and Privacy (2023). https:\/\/doi.org\/10.1109\/SP46215.2023.10179320 10.1109\/SP46215.2023.10179320","DOI":"10.1109\/SP46215.2023.10179320"},{"key":"e_1_3_1_20_2","doi-asserted-by":"publisher","unstructured":"Paul Gazzillo. 2017. Kmax: Finding all configurations of kbuild makefiles statically. Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering. https:\/\/doi.org\/10.1145\/3106237.3106283 10.1145\/3106237.3106283","DOI":"10.1145\/3106237.3106283"},{"key":"e_1_3_1_21_2","unstructured":"Git. 2023. Git Newline. https:\/\/www.git-scm.com\/book\/en\/v2\/Customizing-Git-Git-Configuration. Accessed: 2023-09-28."},{"key":"e_1_3_1_22_2","unstructured":"Git. 2023. Git tagging. https:\/\/git-scm.com\/book\/en\/v2\/Git-Basics-Tagging. Accessed: 2023-09-28."},{"key":"e_1_3_1_23_2","unstructured":"Git. 2023. VCS ranking. https:\/\/survey.stackoverflow.co\/2022\/#section-version-control-version-control-systems. Accessed: 2023-09-28."},{"key":"e_1_3_1_24_2","doi-asserted-by":"publisher","unstructured":"Foyzul Hassan and Xiaoyin Wang. 2018. Hirebuild: An automatic approach to history-driven repair of build scripts. Proceedings of the 40th International Conference on Software Engineering (2018). https:\/\/doi.org\/10.1145\/3180155.3180181 10.1145\/3180155.3180181","DOI":"10.1145\/3180155.3180181"},{"key":"e_1_3_1_25_2","doi-asserted-by":"publisher","unstructured":"Hongjun He Jicheng Cao Lesheng Du Hao Li Shilong Wang and Shengyu Cheng. 2020. ConstBin: A Tool for Automatic Fixing of Unreproducible Builds. 2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW). https:\/\/doi.org\/10.1109\/ISSREW51248.2020.00044 10.1109\/ISSREW51248.2020.00044","DOI":"10.1109\/ISSREW51248.2020.00044"},{"key":"e_1_3_1_26_2","doi-asserted-by":"crossref","unstructured":"Andrea H\u00f6ller Nermin Kajtazovic Tobias Rauter Kay R\u00f6mer and Christian Kreiner. 2015. Evaluation of diverse compiling for software-fault detection. 2015 Design Automation & Test in Europe Conference & Exhibition (DATE) (2015).","DOI":"10.7873\/DATE.2015.0118"},{"key":"e_1_3_1_27_2","unstructured":"JDK. 2023. Maven Package: com.crawljax.crawljax-cli. https:\/\/mvnrepository.com\/artifact\/org.infinispan\/infinispancommons-jdk21. Accessed: 2023-08-01."},{"key":"e_1_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.14279\/TUJ.ECEASST.63.926"},{"key":"e_1_3_1_29_2","doi-asserted-by":"publisher","unstructured":"Vassilios Karakoidas Dimitrios Mitropoulos Panos Louridas Georgios Gousios and Diomidis Spinellis. 2015. Generating the blueprints of the Java ecosystem. IEEE International Working Conference on Mining Software Repositories (2015). https:\/\/doi.org\/10.1109\/MSR.2015.76 10.1109\/MSR.2015.76","DOI":"10.1109\/MSR.2015.76"},{"key":"e_1_3_1_30_2","doi-asserted-by":"publisher","unstructured":"Mehdi Keshani. 2021. Scalable call graph constructor for Maven. 2021 IEEE\/ACM 43rd International Conference on Software Engineering: Companion Proceedings (ICSE-Companion). https:\/\/doi.org\/10.1109\/ICSE-COMPANION52605.2021.00046 10.1109\/ICSE-COMPANION52605.2021.00046","DOI":"10.1109\/ICSE-COMPANION52605.2021.00046"},{"key":"e_1_3_1_31_2","doi-asserted-by":"publisher","DOI":"10.1007\/S10664-023-10388-7"},{"key":"e_1_3_1_32_2","doi-asserted-by":"publisher","DOI":"10.1016\/J.JSS.2023.111738"},{"key":"e_1_3_1_33_2","unstructured":"Raula Gaikovina Kula Coen De Roover Daniel M. German Takashi Ishio and Katsuro Inoue. 2017. Modeling Library Popularity within a Software Ecosystem. Tech. Rep. (2017)."},{"key":"e_1_3_1_34_2","doi-asserted-by":"publisher","unstructured":"Raula Gaikovina Kula Daniel M German Takashi Ishio and Katsuro Inoue. 2015. Trusting a library: A study of the latency to adopt the latest Maven release. 2015 IEEE 22nd International Conference on Software Analysis Evolution and Reengineering (SANER) (2015). https:\/\/doi.org\/10.1109\/SANER.2015.7081869 10.1109\/SANER.2015.7081869","DOI":"10.1109\/SANER.2015.7081869"},{"key":"e_1_3_1_35_2","doi-asserted-by":"publisher","unstructured":"Raula Gaikovina Kula Daniel M. German Takashi Ishio Ali Ouni and Katsuro Inoue. 2017. An exploratory study on library aging by monitoring client usage in a software ecosystem. 2017 IEEE 24th International Conference on Software Analysis Evolution and Reengineering (SANER) (2017). https:\/\/doi.org\/10.1109\/SANER.2017.7884643 10.1109\/SANER.2017.7884643","DOI":"10.1109\/SANER.2017.7884643"},{"key":"e_1_3_1_36_2","article-title":"Reproducible builds: Increasing the integrity of software supply chains","author":"Lamb Chris","year":"2021","unstructured":"Chris Lamb and Stefano Zacchiroli. 2021. Reproducible builds: Increasing the integrity of software supply chains. IEEE Software (2021).","journal-title":"IEEE Software"},{"key":"e_1_3_1_37_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2021.3086494"},{"key":"e_1_3_1_38_2","doi-asserted-by":"publisher","unstructured":"Yiling Lou Junjie Chen Lingming Zhang Dan Hao and Lu Zhang. 2019. History-driven build failure fixing: how far are we?. Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis (2019). https:\/\/doi.org\/10.1145\/3293882.3330578 10.1145\/3293882.3330578","DOI":"10.1145\/3293882.3330578"},{"key":"e_1_3_1_39_2","doi-asserted-by":"publisher","unstructured":"Yiling Lou Zhenpeng Chen Yanbin Cao Dan Hao and Lu Zhang. 2020. Understanding build issue resolution in practice: symptoms and fix patterns. Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (2020). https:\/\/doi.org\/10.1145\/3368089.3409760 10.1145\/3368089.3409760","DOI":"10.1145\/3368089.3409760"},{"key":"e_1_3_1_40_2","unstructured":"Xinlei Ma and Yan Liu. 2020. An Empirical Study of Maven Archetype. SEKE (2020)."},{"key":"e_1_3_1_41_2","unstructured":"Maven. 2023. Maven Index. https:\/\/repo.Maven.apache.org\/Maven2\/.index\/. Accessed: 2023-10-28."},{"key":"e_1_3_1_42_2","unstructured":"Maven. 2023. Maven Model. https:\/\/Maven.apache.org\/ref\/3.0.4\/Maven-model\/apidocs\/org\/apache\/Maven\/model\/Model.html. Accessed: 2023-06-12."},{"key":"e_1_3_1_43_2","unstructured":"Maven. 2023. Maven Plugin. https:\/\/Maven.apache.org\/plugins\/Maven-compiler-plugin\/. Accessed: 2023-06-13."},{"key":"e_1_3_1_44_2","unstructured":"Maven. 2023. Maven POM. https:\/\/Maven.apache.org\/pom.html. Accessed: 2023-06-05."},{"key":"e_1_3_1_45_2","unstructured":"Maven. 2023. Maven requirentments. https:\/\/central.sonatype.org\/publish\/requirements\/#developer-information. Accessed: 2023-08-23."},{"key":"e_1_3_1_46_2","unstructured":"Maven. 2023. Maven SCM requirenment. https:\/\/central.sonatype.org\/publish\/requirements\/#scm-information. Accessed: 2023-09-28."},{"key":"e_1_3_1_47_2","unstructured":"Maven. 2023. Maven version plugin. https:\/\/www.mojohaus.org\/versions\/versions-Maven-plugin\/index.html. Accessed: 2023-09-27."},{"key":"e_1_3_1_48_2","unstructured":"Maven. 2023. Plugin Management. https:\/\/Maven.apache.org\/pom.html#Plugin_Management. Accessed: 2023-06-13."},{"key":"e_1_3_1_49_2","unstructured":"Maven. 2023. ReproducibleBuildMavenPlugin. https:\/\/zlika.Github.io\/reproducible-build-Maven-plugin\/. Accessed: 2024-02-11."},{"key":"e_1_3_1_50_2","doi-asserted-by":"publisher","unstructured":"Amir M Mir Mehdi Keshani and Sebastian Proksch. 2023. On the Effect of Transitivity and Granularity on Vulnerability Propagation in the Maven Ecosystem. 2023 IEEE International Conference on Software Analysis Evolution and Reengineering (SANER) (2023). https:\/\/doi.org\/10.1109\/SANER56733.2023.00028 10.1109\/SANER56733.2023.00028","DOI":"10.1109\/SANER56733.2023.00028"},{"key":"e_1_3_1_51_2","doi-asserted-by":"publisher","unstructured":"Dimitris Mitropoulos Vassilios Karakoidas Panos Louridas Georgios Gousios and Diomidis Spinellis. 2014. The Bug Catalog of the Maven Ecosystem. Proceedings of the 11th Working Conference on Mining Software Repositories (2014). https:\/\/doi.org\/10.1145\/2597073.2597123 10.1145\/2597073.2597123","DOI":"10.1145\/2597073.2597123"},{"key":"e_1_3_1_52_2","doi-asserted-by":"publisher","unstructured":"Omar S Navarro Leija Kelly Shiptoski Ryan G Scott Baojun Wang Nicholas Renner Ryan R Newton and Joseph Devietti. 2020. Reproducible containers. Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems (2020). https:\/\/doi.org\/10.1145\/3373376.3378519 10.1145\/3373376.3378519","DOI":"10.1145\/3373376.3378519"},{"key":"e_1_3_1_53_2","doi-asserted-by":"publisher","unstructured":"Marc Ohm Henrik Plate Arnold Sykosch and Michael Meier. 2020. Backstabbers knife collection: A review of open source software supply chain attacks. Detection of Intrusions and Malware and Vulnerability Assessment: 17th International Conference DIMVA 2020 Lisbon Portugal June 24-26 2020 Proceedings 17 (2020). https:\/\/doi.org\/10.1007\/978-3-030-52683-2_2 10.1007\/978-3-030-52683-2_2","DOI":"10.1007\/978-3-030-52683-2_2"},{"key":"e_1_3_1_54_2","doi-asserted-by":"publisher","unstructured":"Steven Raemaekers Arie Van Deursen and Joost Visser. 2013. The Maven Repository Dataset of Metrics Changes and Dependencies. 2013 10th Working Conference on Mining Software Repositories (MSR) (2013). https:\/\/doi.org\/10.1109\/MSR.2013.6624031 10.1109\/MSR.2013.6624031","DOI":"10.1109\/MSR.2013.6624031"},{"key":"e_1_3_1_55_2","doi-asserted-by":"publisher","unstructured":"Zhilei Ren He Jiang Jifeng Xuan and Zijiang Yang. 2018. Automated localization for unreproducible builds. Proceedings of the 40th International Conference on Software Engineering (2018). https:\/\/doi.org\/10.1145\/3180155.3180224 10.1145\/3180155.3180224","DOI":"10.1145\/3180155.3180224"},{"key":"e_1_3_1_56_2","doi-asserted-by":"publisher","unstructured":"Zhilei Ren Changlin Liu Xusheng Xiao He Jiang and Tao Xie. 2019. Root cause localization for unreproducible builds via causality analysis over system call tracing. 2019 34th IEEE\/ACM International Conference on Automated Software Engineering (ASE) (2019). https:\/\/doi.org\/10.1109\/ASE.2019.00056 10.1109\/ASE.2019.00056","DOI":"10.1109\/ASE.2019.00056"},{"key":"e_1_3_1_57_2","doi-asserted-by":"publisher","unstructured":"Zhilei Ren Shiwei Sun Jifeng Xuan Xiaochen Li Zhide Zhou and He Jiang. 2022. Automated Patching for Unreproducible Builds. Proceedings of the 44th International Conference on Software Engineering (2022). https:\/\/doi.org\/10.1145\/3510003.3510102 10.1145\/3510003.3510102","DOI":"10.1145\/3510003.3510102"},{"key":"e_1_3_1_58_2","doi-asserted-by":"publisher","unstructured":"Yong Shi Mingzhi Wen Filipe R Cogo Boyuan Chen and Zhen Ming Jiang. 2021. An experience report on producing verifiable builds for large-scale commercial systems. IEEE Transactions on Software Engineering (2021). https:\/\/doi.org\/10.1109\/TSE.2021.3092692 10.1109\/TSE.2021.3092692","DOI":"10.1109\/TSE.2021.3092692"},{"key":"e_1_3_1_59_2","doi-asserted-by":"publisher","unstructured":"Thodoris Sotiropoulos Stefanos Chaliasos Dimitris Mitropoulos and Diomidis Spinellis. 2020. A model for detecting faults in build specifications. Proceedings of the ACM on Programming Languages (2020). https:\/\/doi.org\/10.1145\/3428212 10.1145\/3428212","DOI":"10.1145\/3428212"},{"key":"e_1_3_1_60_2","doi-asserted-by":"publisher","unstructured":"C\u00e9r Soto-Valero Amine Benelallam Nicolas Harrand Olivier Barais and Benoit Baudry. 2019. The emergence of software diversity in Maven Central. 2019 IEEE\/ACM 16th International Conference on Mining Software Repositories(MSR) (2019). https:\/\/doi.org\/10.1109\/MSR.2019.00059 10.1109\/MSR.2019.00059","DOI":"10.1109\/MSR.2019.00059"},{"key":"e_1_3_1_61_2","doi-asserted-by":"publisher","unstructured":"C\u00e9r Soto-Valero Nicolas Harrand Martin Monperrus and Benoit Baudry. 2021. A comprehensive study of bloated dependencies in the Maven ecosystem. Empirical Software Engineering (2021). https:\/\/doi.org\/10.1007\/S10664-020-09914-8 10.1007\/S10664-020-09914-8","DOI":"10.1007\/S10664-020-09914-8"},{"key":"e_1_3_1_62_2","doi-asserted-by":"publisher","unstructured":"Ahmed Tamrawi Hoan Anh Nguyen Hung Viet Nguyen and Tien N Nguyen. 2012. Build code analysis with symbolic evaluation. 2012 34th International Conference on Software Engineering (ICSE) (2012). https:\/\/doi.org\/10.1109\/ICSE.2012.6227152 10.1109\/ICSE.2012.6227152","DOI":"10.1109\/ICSE.2012.6227152"},{"key":"e_1_3_1_63_2","doi-asserted-by":"publisher","unstructured":"Ken Thompson. 1984. Reflections on trusting trust. Commun. ACM (1984). https:\/\/doi.org\/10.1145\/358198.358210 10.1145\/358198.358210","DOI":"10.1145\/358198.358210"},{"key":"e_1_3_1_64_2","doi-asserted-by":"publisher","unstructured":"Michele Tufano Fabio Palomba Gabriele Bavota Massimiliano Di Penta Rocco Oliveto Andrea De Lucia and Denys Poshyvanyk. 2017. There and back again: Can you compile that snapshot?. Journal of Software: Evolution and Process (2017). https:\/\/doi.org\/10.1002\/SMR.1838 10.1002\/SMR.1838","DOI":"10.1002\/SMR.1838"},{"key":"e_1_3_1_65_2","doi-asserted-by":"publisher","unstructured":"David A Wheeler. 2005. Countering trusting trust through diverse double-compiling. 21st Annual Computer Security Applications Conference (ACSAC05) (2005). https:\/\/doi.org\/10.1109\/CSAC.2005.17 10.1109\/CSAC.2005.17","DOI":"10.1109\/CSAC.2005.17"},{"key":"e_1_3_1_66_2","doi-asserted-by":"publisher","unstructured":"Chen Zhang Bihuan Chen Junhao Hu Xin Peng and Wenyun Zhao. 2022. BuildSonic: Detecting and Repairing Performance-Related Configuration Smells for Continuous Integration Builds. 37th IEEE\/ACM International Conference on Automated Software Engineering (2022). https:\/\/doi.org\/10.1145\/3551349.3556923 10.1145\/3551349.3556923","DOI":"10.1145\/3551349.3556923"}],"container-title":["Proceedings of the ACM on Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3643764","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3643764","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,4]],"date-time":"2026-02-04T07:57:08Z","timestamp":1770191828000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3643764"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,7,12]]},"references-count":65,"journal-issue":{"issue":"FSE","published-print":{"date-parts":[[2024,7,12]]}},"alternative-id":["10.1145\/3643764"],"URL":"https:\/\/doi.org\/10.1145\/3643764","relation":{},"ISSN":["2994-970X"],"issn-type":[{"value":"2994-970X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,7,12]]}}}