From SBOM to Call Graphs: Harnessing OSS Tools to Streamline Update Impact Analys...
summary
Prototype Python + Jenkins pipeline reconstructs package trees from SBOM-based update simulation, pulls repo tags with npm, decodes source maps and extracts commits, uses g tre/gumtree for semantic diffs, Jelly to build JS/TS call graphs and NetworkX for call graph reachability. Experiments detect ~40,000 semantic function changes in a bulk update but only 69 reachable changes that map to a single call path, reduce review to ~10 commits in one case, and find 5 semantic changes that propagate widely. The system works and is integrated into PSIRT.
AI-written summary · about
chapters (15)
- 0:00SBOM and call graphs intro
- 1:05Supply chain attacks and SBOM
- 3:17SBOM tools in DevOps
- 5:26Dependency update challenges
- 6:09Update impact analysis
- 7:40System architecture and pipeline
- 8:25Stage 1: Docker update sim
- 9:07Stage 2: Semantic code changes
- 11:59Stage 3: Call graphs with Jelly
- 13:43Stage 4: Reachability with NetworkX
- 14:50Stage 5: Git commit mapping
- 18:26Results with three use cases
- 25:46Key takeaways
- 27:35Future work
- 29:08Q&A
related talks
40mUnderstanding OSS Risk Beyond Code Vulnerabilities
26mLeveraging SBOMS to Automate Packaging, Transfer, and Reporting of D...
36mSo I generated over 3000 SBOMS for the CNCF ecosystem
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
21mKnow Your JS: SBOMs for Frontend Devs
39mSBOM Automation - Making Compliance Effortless by Consuming, Enrichin...
30mContinuous Compliance in Open Source: Safety Assurance Through S...
46mTurn CRA Awareness into Action