Investigating The Reproducibility of NPM Packages
Investigating The Reproducibility of NPM Packages
复制标题
DOI：
10.1109/icsme46990.2020.00071
复制
发表时间：
2020-05
期刊：
影响因子：
--
通讯作者：
Pronnoy Goswami;Saksham Gupta;Zhiyuan Li;Na Meng;Daphne Yao
中科院分区：
文献类型：
--
作者：
Pronnoy Goswami;Saksham Gupta;Zhiyuan Li;Na Meng;Daphne Yao
Node.js已广泛用于Web应用程序开发，部分原因是其大型软件生态系统称为NPM（节点包管理器）包。在使用开源NPM包时，大多数开发人员会在npmjs.com上下载预构建的包，而不是从可用的源代码构建这些包，并隐含地信任下载的包。然而，不知道盲目信任的预构建NPM包是否是可再现的（即，是否总是存在从源代码到任何已发布的NPM包的可验证路径）。因此，在本文中，我们进行了一项实证研究，以检查NPM软件包的可复制性，并了解为什么有些软件包是不可复制的。具体来说，我们下载了226个最常用的NPM软件包的版本/发行版，然后使用GitHub上的可用源代码构建每个版本。接下来，我们应用了一个差异化工具来比较我们构建的版本与从NPM下载的版本，并进一步检查任何报告的差异。在226个软件包的3,390个版本中，只有2,087个版本是可复制的。根据我们的手动分析，多种因素导致了不可再现性问题，例如package.json文件中灵活的版本信息以及构建过程中使用的不同版本的工具之间的差异行为。我们的调查揭示了用现有工具验证NPM再现性的挑战，并为未来可验证的构建程序提供了见解。
Node.js has been popularly used for web application development, partially because of its large software ecosystem known as NPM (Node Package Manager) packages. When using open-source NPM packages, most developers download prebuilt packages on npmjs.com instead of building those packages from available source, and implicitly trust the downloaded packages. However, it is unknown whether the blindly trusted prebuilt NPM packages are reproducible (i.e., whether there is always a verifiable path from source code to any published NPM package). Therefore, for this paper, we conducted an empirical study to examine the reproducibility of NPM packages, and to understand why some packages are not reproducible.Specifically, we downloaded versions/releases of 226 most popularly used NPM packages and then built each version with the available source on GitHub. Next, we applied a differencing tool to compare the versions we built against versions downloaded from NPM, and further inspected any reported difference. Among the 3,390 versions of the 226 packages, only 2,087 versions are reproducible. Based on our manual analysis, multiple factors contribute to the non-reproducibility issues, such as flexible versioning information in package.json file and the divergent behaviors between distinct versions of tools used in the build process. Our investigation reveals challenges of verifying NPM reproducibility with existing tools, and provides insights for future verifiable build procedures.