Wang / Cheung / Yu Managing Software Supply Chains

Theory and Practice
1. Auflage 2025
ISBN: 978-981-961797-5
Verlag: Springer Singapore
Format: PDF
Kopierschutz: 1 - PDF Watermark

E-Book, Englisch, 257 Seiten

Open-source software supply chains wield significant influence in the software industry, drawing substantial interest from enterprises, researchers, and policymakers. Leveraging third-party libraries to build software applications is a common practice aimed at cost savings and software quality enhancement. However, heavy reliance on external libraries often leads to a state of “dependency hell”, marked by issues like incompatibilities, conflicting versions, bloated dependencies, and the inclusion of vulnerable library versions. Despite extensive research on software dependency management and the evolution of software supply chains, questions linger regarding the variances in dependency challenges across programming language ecosystems and how best to address the dependency hell phenomenon from an ecosystem-wide perspective.

The aim of this book is to offer: (1) a comprehensive literature review on software supply chains, (2) discussions on modeling software supply chains and analyzing their evolutionary behaviors, (3) ecosystem-level strategies for diagnosing various dependency issues and automating problem resolution with cost-benefit analysis, and (4) provision of a toolkit and datasets to support future research and assist practitioners in addressing the challenges of dependency management. The methodologies outlined in this book have been previously presented in top-tier conferences and journals, with some techniques officially integrated into products by Microsoft Corporation and Huawei Technologies Co Ltd. This book is designed to provide readers with a solid understanding of software supply chain fundamentals and practical guidance on implementing theory and techniques in real-world industrial settings.

The book is chiefly intended for software engineering researchers and students with an academic background who are interested in learning about dependency management for third-party libraries, quality assurance for software supply chains, and the evolution of open-source software ecosystems. It will also be of interest to practitioners, including software engineers, quality assurance professionals, and software managers, as well as general readers. All will benefit from our systematic studies on the dependency hell phenomenon in various programming language communities and valuable associated artifacts.

Zielgruppe

Research

Autoren/Hrsg.

Wang, Ying

Cheung, Shing-Chi

Yu, Hai

Zhu, Zhiliang

Inhaltsverzeichnis

Part I. An Overview of Software Supply Chain Research.- Chapter 1. Introducing Software Supply Chain.- Part II. Modeling and Analyzing Software Supply Chain.- Chapter 2. Modeling Software Supply Chains and Analyzing Their Evolutionary Behaviors.- Part III. Dependency Issues in Software Supply Chain.- Chapter3. Common Types of Dependency Issues.- Part IV. Ecosystem Level Techniques Combating Dependency Issues.- Chapter4. Detecting Compatibility Issues for Machine Learning Libraries.- Chapter 5. Diagnosing NuGet Dependency Conflicts.- Chapter 6. Streamlining Software Bloated Dependencies.- Chapter 7. Exploring Cross Ecosystem Vulnerability Impacts.- Chapter 8. Boosting the Propagation of Vulnerability Fixes in the Ecosystem.- Part V. Tools and Datasets.- Chapter 9. “League of Legends”.- Chapter 10. Epilogue.

Über Autor(innen)

Ying Wang received her doctoral degree in software engineering from Northeastern University, China, in 2019. She is currently an associate professor at the Software College, Northeastern University, China. Her research interests include software supply chain, program analysis, dependency management, and software ecosystems. Her research work has been regularly published in top-tier journals and conferences in the research communities of software engineering, and has received two ACM SIGSOFT Distinguished Paper Awards (ICSE 2021 and ESEC/FSE 2023). She serves as an editorial board member of the journal IEEE Transactions on Software Engineering. She received the Outstanding Doctoral Dissertation Award of Liaoning Province (2021) and the Nominees Award for Outstanding Doctoral Dissertation of China Computer Federation (CCF) in 2020. She joined the Microsoft Research Asia StarTrack Program (2020). Dr. Wang Ying is the first scholar to organize the "Women Scholars Forum in Software Engineering" at the China Software Conference (ChinaSoft).

Shing-Chi Cheung received his bachelor’s degree in electrical and electronic engineering from the University of Hong Kong and his PhD degree in computing from the Imperial College London. After doctoral graduation, he joined the Hong Kong University of Science and Technology (HKUST), where he is a professor of computer science and engineering. He founded the CASTLE research group at HKUST and co-founded in 2006 the International Workshop on Automation of Software Testing (AST). He is an extended member of the ACM SIGSOFT executive committee. His research interests lie in boosting the quality of software applications using program analysis, testing, debugging, synthesis, repository mining, and artificial intelligence. Target applications include Android apps, open-source software, deep learning systems, smart contracts, and AI software. He is an IEEE Fellow and a Distinguished Member of the ACM.

Hai Yu received a BE degree in Electronic Engineering from Jilin University, China, in 1993 and a PhD degree in Computer Software and Theory from Northeastern University, China, in 2006. He is currently an associate professor of Software Engineering at the Northeastern University, China. His research interests include complex networks, chaotic encryption, software testing, software refactoring, and software architecture. At present, he serves as an associate editor for the , guest editor for , and guest editor for the . In addition, he was a lead guest editor for during 2013.

Zhiliang Zhu received an MS degree in Computer Applications and a PhD degree in Computer Science from Northeastern University, China. He is currently a full professor at Software College, Northeastern University, China. His main research interests include software engineering, complexity software systems, and applications of complex network theory. He has authored and co-authored over 130 international journal papers and 100 conference papers. In addition, he has published five books, including , etc. Prof. Zhu has served in different capacities at many international journals and conferences. Currently, he serves as co-chair of the 1st-19th International Workshop on Chaos-Fractals Theories and Applications.