Dependency Management

Building Confidence & Overcoming Insecurity

The ultimate software supply chain self-help guide
UD2.119
Jeff McAffer
The days of having only a few open source dependencies are over. Projects often have thousands of open source dependencies in their supply chain and companies may have millions. Even worse, risk is viral -- projects inherit and pass on the risks of all their dependencies. At the same time, software is shipping more frequently. This creates numerous challenges for commercial and open source projects of any size -- how to discover the myriad of components being used across a range of ecosystems and scenarios, where to get high quality data to drive smart decisions, how to capture and evaluate comprehensive policies. Enabling high-confidence, rapid delivery, requires integrating supply chain management automation deep into the engineering system. Core to this is accurate discovery and identification of dependencies and trustworthy, high-quality compliance and security data about the discovered components. In this talk we detail the challenges in this space, look at various approaches such as ClearlyDefined, a crowd-sourced, open source project aimed at discovering and curating compliance data about open source components, and relate experiences running high performance, massive scale compliance systems for a wide range of open source and commercial projects.

Additional information

Type devroom

More sessions

2/1/20
Dependency Management
Georgios Gousios
UD2.119
As recent events, such as the leftpad incident and the Equifax data breach, have demonstrated, dependencies on networks of external libraries can introduce projects to significant operational and compliance risks as well as difficult to assess security implications. FASTEN introduces fine-grained, method-level, tracking of dependencies on top of existing dependency management networks. In our talk, we will present how FASTEN works on top of the Rust/Cargo and Java/Maven ecosystems.
2/1/20
Dependency Management
UD2.119
The community seems to be rife with conversations about our sustainability problems. Do we actually have one? We’ll lead a discussion and debate around how we as a community can think about these issues, while drawing out the nuanced aspects of each as well as their potential solutions.
2/1/20
Dependency Management
Tom Mens
UD2.119
In the last couple of years, the Software Engineering Lab of the University of Mons has extensively studied different aspects of dependency management within and across different package management ecosystems, including Cargo, npm, Packagist, Rubygems, CPAN, CRAN and NuGet. These ecosystems contain a large number of package releases with many interdependencies. They face challenges related to their scale, complexity, and rate of evolution. Typical problems are backward incompatible package ...
2/1/20
Dependency Management
Douglas Creager
UD2.119
GitHub has recently added Code Navigation features (jump to definition and find all references) that let you navigate code directly on github.com. For the languages that we support, we extract and store symbol information for every named branch and tag, of every repository, public or private, with no configuration necessary. The compute and storage requirements to do this for all of the code on GitHub are quite large. In this talk, we'll discuss some of the trade-offs we've made to make this ...
2/1/20
Dependency Management
Todd Gamblin
UD2.119
Dependency resolution is deceptively complex; simply selecting a set of compatible versions for an arbitrary network of dependencies is NP-hard. Much effort has been spent on this problem for modern single-language ecosystems, but many of these ecosystems rely on natively compiled libraries, and dependency mangers often fail at managing the additional complexities that native libraries entail. Further, dependency resolution has traditionally been modeled as a SAT problem, where the package ...
2/1/20
Dependency Management
William Bartholomew
UD2.119
Package managers have become the default way for managing dependencies for most projects but they’re not without their challenges and risks. In this panel we bring together experts representing several popular package managers for a lively discussion on package management best practices, the state of package management communities, and a look forward at what we can expect to see in the future.