Understanding Build Reproducibility in the F-Droid Ecosystem

• URL: http://arxiv.org/abs/2607.01890v1
• Date: Thu, 02 Jul 2026 08:41:22 GMT
• Title: Understanding Build Reproducibility in the F-Droid Ecosystem
• Abstract summary: We present the first empirical study of build in the F-Droid app ecosystem.<n>We evaluate how holds in time for fixed app versions, by attempting to rebuild 18 904 app versions that F-Droid had previously confirmed bitwise reproducible.<n>Findings show that while bitwise largely holds for apps that can be rebuilt, rebuildability itself is highly sensitive to temporal decay.
• Score: 7.364406840196505
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The security of open source applications benefits considerably from the possibility of rebuilding their source and verifying the output. F-Droid, a prominent distribution for open source Android applications, systematically rebuilds them from source and tests their bitwise reproducibility at app publishing time. However, F-Droid offers no guarantee that app reproducibility will continue to hold in the future. As software ecosystems evolve, reproducibility may degrade, with potential negative consequences for software preservation and security. We present the first empirical study of build reproducibility in the F-Droid app ecosystem. Analyzing historical reproducibility logs, we find that the overall bitwise reproducibility rate has been steadily increasing over time (as new versions of apps are published). We then evaluate how reproducibility holds in time for fixed app versions, by attempting to rebuild 18 904 app versions that F-Droid had previously confirmed bitwise reproducible, published between September 2018 and February 2026, achieving an 83% rebuild success rate, and identify missing dependencies as the dominant cause of failure, accounting for 76% of non-rebuildable cases. Among successfully rebuilt apps, 94% are also bitwise reproducible-i.e., they still yield bitwise identical artifacts upon rebuild. Together, these results show that while bitwise reproducibility largely holds for apps that can be rebuilt, rebuildability itself is highly sensitive to temporal decay.

Related papers

• DeepRepro: State-Aware Subplanning for Paper-to-Code Reproduction in Evolving Repositories [116.27249583403871]
  We propose a state-aware framework for paper-to-code reproduction based on execution-state-aware subplanning.<n>DeepRepro transforms evolving repository states and runtime feedback into fine-grained implementation subplans.<n>Experiments on PaperBench Code-Dev show that DeepRepro consistently outperforms strong scientific and commercial code-agent baselines.
  arXiv  Detail & Related papers  (2026-08-27T02:54:30Z)
• PixJail: Self-Evolving Paper-to-Pipeline Reproduction for Text-to-Image Jailbreak Evaluation [21.837531720036427]
  Text-to-Image jailbreak evaluation is not a single prompt-level test, but a pipeline-level problem shaped by multiple stages.<n>We propose PixJail, a self-evolving paper-to-pipeline agent framework for reproducible T2I jailbreak evaluation.<n>We reproduce eleven representative T2I jailbreak methods, including both code-available and code-unavailable papers.
  arXiv  Detail & Related papers  (2026-06-23T02:49:10Z)
• ReproRepo: Scaling Reproducibility Audits with GitHub Repository Issues [54.98461672730087]
  We introduce ReproRepo, a scalable framework for evaluation that leverages human-raised GitHub issues as naturally occurring supervision on realistic reproduction blockers.<n>We instantiate ReproRepo on 1,149 recent machine learning papers from major conferences and evaluate four frontier model-agent configurations.<n>Our results show that LLM agents, even without executing code, can identify many real-world problems from paper-repository pairs.
  arXiv  Detail & Related papers  (2026-06-16T17:58:05Z)
• Where did we fail? -- Reproducing build failures in embedded open source software [2.64399132991614]
  We present PhantomRun, a dataset that standardizes the retrieval, storage, and reproduction of continuous integration build logs and metadata.<n>Across 4628 failing CI runs, we reconstructed 91.8% of builds and preserved execution outcomes in 98% of evaluated cases.<n>An empirical evaluation shows that reproduced builds closely match their originals, typically differing only in timestamps or minor nondeterministic reordering.
  arXiv  Detail & Related papers  (2026-04-29T18:07:04Z)
• ARES: Scalable and Practical Gradient Inversion Attack in Federated Learning through Activation Recovery [73.8181449261685]
  Federated Learning (FL) enables collaborative model training by sharing model updates instead of raw data, aiming to protect user privacy.<n>Recent studies reveal that these shared updates can inadvertently leak sensitive training data through gradient inversion attacks (GIAs)
  arXiv  Detail & Related papers  (2026-03-18T11:40:44Z)
• NL2Repo-Bench: Towards Long-Horizon Repository Generation Evaluation of Coding Agents [79.29376673236142]
  Existing benchmarks fail to rigorously evaluate the long-horizon capabilities required to build complete software systems.<n>We present NL2Repo Bench, a benchmark explicitly designed to evaluate the long-horizon repository generation ability of coding agents.
  arXiv  Detail & Related papers  (2025-12-14T15:12:13Z)
• AutoReproduce: Automatic AI Experiment Reproduction with Paper Lineage [62.049868205196425]
  AutoReproduce is a framework capable of automatically reproducing experiments described in research papers in an end-to-end manner.<n>Results show that AutoReproduce achieves an average performance gap of $22.1%$ on $89.74%$ of the executable experiment runs.
  arXiv  Detail & Related papers  (2025-05-27T03:15:21Z)
• BugRepro: Enhancing Android Bug Reproduction with Domain-Specific Knowledge Integration [4.833035081314386]
  BugRepro is a novel technique that integrates domain-specific knowledge to enhance the accuracy and efficiency of bug reproduction.<n>BugRepro significantly outperforms two state-of-the-art methods.
  arXiv  Detail & Related papers  (2025-05-20T15:48:34Z)
• Causes and Canonicalization of Unreproducible Builds in Java [11.155099138622148]
  We introduce a conceptual framework for reproducible builds, analyze a large dataset from Reproducible Central, and develop a novel taxonomy of six root causes of unreproducibility.<n>We present Chains-Rebuild, a tool that achieve successfulcanonicalization for 26.60% on 12,803 unreproducible artifacts.
  arXiv  Detail & Related papers  (2025-04-30T14:17:54Z)
• Does Functional Package Management Enable Reproducible Builds at Scale? Yes [4.492444446637857]
  Reproducible Builds (R-B) guarantee that rebuilding a software package from source leads to bitwise identical artifacts.<n>We perform the first large-scale study of bitwise in the context of the Nix functional package manager.<n>We obtain very high bitwise rates, between 69 and 91% with an upward trend, and even higher rebuildability rates, over 99%.
  arXiv  Detail & Related papers  (2025-01-27T10:11:27Z)
• FRUIT: Faithfully Reflecting Updated Information in Text [106.40177769765512]
  We introduce the novel generation task of *faithfully reflecting updated information in text*(FRUIT) Our analysis shows that developing models that can update articles faithfully requires new capabilities for neural generation models.
  arXiv  Detail & Related papers  (2021-12-16T05:21:24Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.