Causes and Canonicalization of Unreproducible Builds in Java

ReproBuild is a comprehensive web-based application designed to analyze, detect, and mitigate unreproducible builds in Java software ecosystems. Developed using Java with Spring Boot for the backend and ReactJS with Tailwind CSS for the frontend, the system provides a secure, scalable, and user-friendly platform for multiple stakeholders, including Admin and regular Users. The application enables efficient registration, login, artifact upload, reproducibility analysis using CHAINS-REBUILD and JNORM canonicalization techniques, and comprehensive result tracking based on clearly defined user roles illustrated in the system flow diagram. MySQL is used as the primary database for reliable storage and management of user data, artifact metadata, reproducibility results, and taxonomy information. The system implements the novel taxonomy of six root causes of unreproducibility as identified in the IEEE TSE 2026 research paper: Build Manifest, Software Bill of Materials (SBOM), Filesystem, JVM Bytecode, Versioning Properties, and Timestamps. Additionally, the system integrates Rabin-Karp pattern matching algorithm for efficient detection of non-deterministic patterns and implements artifact canonicalization via CHAINS-REBUILD (improving reproducibility from 9.48% to 26.60%) and bytecode canonicalization via JNORM. The Admin module manages users, monitors all uploaded artifacts, views platform statistics, and ensures data integrity, while users can upload reference and rebuild JAR files, view detailed reproducibility analysis, and track their upload history. Overall, the system improves build reproducibility, enhances software supply chain security, and provides actionable mitigation strategies based on academic research.

Keywords: ReproBuild, Reproducible Builds, CHAINS-REBUILD, JNORM, Spring Boot, ReactJS, Rabin-Karp Algorithm, Canonicalization, Java Ecosystem, Software Supply Chain Security, Build Manifest, SBOM, JVM Bytecode, IEEE TSE 2026.