Systems Research and Architecture SRA
a SRA Theses Dependency Surface of Rust Crates

Trash or Treasure: Analyzing the Dependency Surface of Rust Crates

image

Current software ecosystems heavily aim to reuse code to save time and costs, and thus have a rising number of dependencies. This is intensified by many modern languages, which directly incorporate dependency managers, which greatly simplify this process of library use and creation. Examples for this are NPM for JS/TS, PIPY for Python, or Cargo for Rust.

However, the dependence on a large number of libraries also comes with downsides. Most dependency registries do not moderate libraries and their code. It is up to the developers to audit them. This opens the door for bad actors uploading malicious libraries or taking over legitimate but unmaintained libraries. In addition to injecting malicious code into the resulting application, these dependency managers often also allow executing code directly at install or build times on the developer machines or CI pipelines. This makes the ecosystem prone to worms (like Shai-Hulud) that steal developer credentials, take their libraries, and spread uncontrollably. Still, there is no perfect solution to protect against these supply-chain attacks. Every dependency is also a liability.

In this theses, we want to analyze dependency surfaces of Rust crates, to give developers the information necessary to remove unused dependencies or vendor specific functionalities of underutilized dependencies. Rust comes with some unique challenges: it has a powerful type system, generic functions, and dynamic dispatch. Most of this is inlined at compile-time and stripped from the resulting binaries. Therefore, we want to evaluate how well static analysis is able to find code and data structures used from libraries and help developers reduce their dependency- and attack-surface.

SPLC Conference B
Should I Bother? Fast Patch Filtering for Statically-Configured Software Variants
Tobias Landsberg, Christian Dietrich, Daniel LohmannProceedings of the 28th ACM International Systems and Software Product Line ConferenceAssociation for Computing Machinery2024.
PDF 10.1145/3646548.3672585 [] 
@inproceedings{landsberg:24:splc,
location = {New York, NY, USA},
author = {Landsberg, Tobias and Dietrich, Christian and Lohmann, Daniel},
booktitle = {Proceedings of the 28th ACM International Systems and Software Product Line Conference},
doi = {10.1145/3646548.3672585},
entrysubtype = {Conference},
isbn = {979-8-4007-0593-9},
keywords = {Patch Filtering, Software Evolution, Software Product Lines},
location = {Dommeldange, Luxembourg},
numpages = {12},
pages = {12–23},
publisher = {Association for Computing Machinery},
series = {SPLC '24},
title = {Should I Bother? Fast Patch Filtering for Statically-Configured Software Variants},
year = {2024},
}