FASTEN presentation at FOSDEM 2022 : Making Dependency Management Intelligent
•
0 likes•24 views
The FASTEN project was presented for the third time at FOSDEM, on February 4-5, 2022, online, by Amir Mir from TUDelft.
Recommended
Recommended
More Related Content
Similar to FASTEN presentation at FOSDEM 2022 : Making Dependency Management Intelligent
Similar to FASTEN presentation at FOSDEM 2022 : Making Dependency Management Intelligent (20)
More from Fasten Project
More from Fasten Project (17)
Recently uploaded
Recently uploaded (20)
FASTEN presentation at FOSDEM 2022 : Making Dependency Management Intelligent
- 1. FASTEN Making Dependency Management Intelligent Amir M. Mir (TU Delft) @amir_mir93 s.a.m.mir@tudelft.nl
- 2. Open Source Software (OSS) ● Open-source libraries as a building block for creating new software
- 3. Dependencies
- 4. Package Dependency Networks (PDNs) ● Version constraints make these networks more complicated
- 5. Recent Failures with PDNs ● Leftpad in 2016 ● Equifax data breach in 2017 ● Log4j in 2021
- 6. Issues with PDNs ● The update problem ● The compliance problem ● The deprecation problem ● The lack of incentive problem
- 7. Existing Solutions to the Issues of PDNs ● Services like GitHub, Dependabot ● Problems: ○ No support for assessing updates ○ No help with impact assessment ○ False positives
- 8. The Root Cause Current Solutions Call Dependency Networks (CDNs)
- 9. The FASTEN Project ● Fine-Grained Analysis of Software Ecosystems as Network ● Aims at solving the issues of PDNs by making package management robust and intelligent ● A centralized service to host the graphs and serve the analyses
- 10. The FASTEN Solution ● More precise license compliance ○ Am I linking to GPL code? ● More precise risk profiling ○ Does this vulnerability affect my package? ● More precise change impact analysis ○ How many packages will I break if I change this function? ○ Can I safely update the dependencies of my package? ● Integration with package managers
- 11. Overview of the FASTEN Architecture Data streams Package repositories Vulnerability information FASTEN server Call graph generators Analysis layer Security Change impact Compliance Quality and Risk Storage layer REST API Web UI Continuous Integration servers
- 12. Examples of FASTEN Workflow Update with confidence Before FASTEN After FASTEN
- 13. Examples of FASTEN Workflow Deciding to use a library Before FASTEN After FASTEN
- 15. Questions? https://www.fasten-project.eu/ https://github.com/fasten-project https://twitter.com/fastenproject The FASTEN project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 825328.