OpenSSF Community Day North America 2026

Many package ecosystems produce a comprehensive list of dependencies known as a lockfile. These files serve several purposes, ranging from optimizing application assembly to verifying package integrity and ensuring reproducible builds. Newer package ecosystems such as npm, cargo, and go modules incorporated lockfiles in their designs from the start. More recently, the Python community adopted a lockfile standard that works across multiple packaging tools, and dnf is experimenting with its own lockfile standard for RPM packages.

Using recent academic research, this session will describe the key requirements for lockfiles and apply them to one of the most widely adopted package ecosystems: Apache Maven. Through the experiences of the Maven Lockfile Plugin project, you will learn the challenges of building a backwards-compatible lockfile and the barriers to generating complete Maven lockfiles in all situations. This session will conclude with other attempts within the Maven ecosystem to provide similar lockfile capabilities and the hurdles to making these features more widely adopted.