Decentralized builds fail on artifact verification study finds
Research reveals 90% of decentralized-build artifacts can't be independently verified
Reproducible builds aren't enough for trust in decentralized package ecosystems. A new study measures artifact verifiability across four popular ecosystems using an independent verifier model that relies only on registry-derivable metadata. The resulting Artifact Verification Pipeline reveals that beyond build determinism, verifiability is limited by missing source and build metadata, implicit release transformations, and unconventional build practices. Provenance attestations and embedded VCS metadata help, but they don't provide complete rebuild specifications. The findings point to concrete metadata gaps and ecosystem-level changes needed to make artifact verification practical at package-registry scale.
- 90% of artifacts in decentralized-build ecosystems lack sufficient metadata for independent verification
- Key failure points include missing source states (65%), implicit release transformations (42%), and unconventional build practices (38%)
- Provenance attestations improve verification by 22% but don't provide complete rebuild specifications
Why It Matters
This research exposes critical security gaps in decentralized software supply chains that could enable compromised artifacts to go undetected.