  Reproducibility is the ability of recreating identical binaries under
pre-defined build environments. Due to the need of quality assurance and the
benefit of better detecting attacks against build environments, the practice of
reproducible builds has gained popularity in many open-source software
repositories such as Debian and Bitcoin. However, identifying the
unreproducible issues remains a labour intensive and time consuming challenge,
because of the lacking of information to guide the search and the diversity of
the causes that may lead to the unreproducible binaries.
  In this paper we propose an automated framework called RepLoc to localize the
problematic files for unreproducible builds. RepLoc features a query
augmentation component that utilizes the information extracted from the build
logs, and a heuristic rule-based filtering component that narrows the search
scope. By integrating the two components with a weighted file ranking module,
RepLoc is able to automatically produce a ranked list of files that are helpful
in locating the problematic files for the unreproducible builds. We have
implemented a prototype and conducted extensive experiments over 671 real-world
unreproducible Debian packages in four different categories. By considering the
topmost ranked file only, RepLoc achieves an accuracy rate of 47.09%. If we
expand our examination to the top ten ranked files in the list produced by
RepLoc, the accuracy rate becomes 79.28%. Considering that there are hundreds
of source code, scripts, Makefiles, etc., in a package, RepLoc significantly
reduces the scope of localizing problematic files. Moreover, with the help of
RepLoc, we successfully identified and fixed six new unreproducible packages
from Debian and Guix.
