Julien Malka aka Luj

Lila: Decentralized Build Reproducibility Monitoring for the Functional Package Management Model

Authors: J. Malka, A. Engelen Venue: MSR 2026 Award: MSR 2026 FOSS Award Preprint: arXiv:2601.20662 Abstract Ensuring the integrity of software build artifacts is an increasingly important concern for modern software engineering, driven by increasingly sophisticated attacks on build systems, distribution channels, and development infrastructures. Reproducible builds – where binaries built independently from the same source code can be verified to be bit-for-bit identical to the distributed artifacts – provide a principled foundation for transparency and trust in software distribution. Despite their potential, the large-scale adoption of reproducible builds faces two significant challenges: achieving high reproducibility rates across vast software collections and establishing reproducibility monitoring infrastructure that can operate at very large scale. While recent studies have shown that high reproducibility rates are achievable at scale – demonstrated by the Nix ecosystem...