Capslock: Escaping Bad Dependencies
summary
Capslock is a CLI that analyzes Go packages with call-path analysis (function-level call graphs) to report which capabilities — network, filesystem, unsafe, exec, etc. — are actually reachable, not just imported. Results appear on deps.dev with structured JSON and a git diff tool that flags changes; empirically about 3% of Go package updates add a new capability while most capabilities appear in <30% of buildable packages and ~1/3 of packages fail to build. The tool runs, produces call-path examples, and reduces noisy false positives.
AI-written summary · about
chapters (9)
- 0:00Capslock introduction
- 3:27Why dependency management is complicated
- 7:19Capability model
- 14:26Transitive dependencies
- 20:51Analyzing Go packages
- 24:47Capslock and dep.dev
- 27:13Code reviews with Capslock
- 32:31Future steps for Capslock
- 33:13Q&A
related talks
38mCapslock: Escaping Bad Dependencies
17mUnderstanding Supply Chain Threats with Static Analysis
29mTrust, but Verify: Proactive Security in Open Source
31mContainer Escape: All You Need Is Cap (Capabilities)
23mThe Code You Reviewed is Not the Code You Built
23mPrioritisation of SCA Findings in Software Dependencies Using Static Reachability Analysis
20mdepstat: Analyzing a Go Project’s Dependencies
10mLightning Talk: Scoring Dependencies to Detect “Weak Links” in your Open-source So...