一句话：实证分析 Golang 生态漏洞生命周期，揭示 commit 依赖与去中心化依赖管理对补丁分发的影响。
开源软件极大便利了程序开发，但其大量漏洞令人担忧，较新的 Golang 生态也不例外。与其他常用 OSS 包管理器不同，Golang 中 commit 常被直接用作依赖版本，尚未进入官方发布，这使用户有机会在正式发布前及时采用补丁 commit；但 Golang 采用去中心化的依赖管理机制，依赖分布在不同仓库中维护与分发。这种机制可能导致补丁传播延迟和漏洞长期未修复。本文对 Golang 生态中漏洞生命周期进行实证分析，讨论上述版本与依赖管理特征对漏洞修复、补丁分发和未解决漏洞的影响。
Open-source software (OSS) greatly facilitates program development for developers. However, the high number of vulnerabilities in open-source software is a major concern, including in Golang, a relatively new programming language. In contrast to other commonly used OSS package managers, Golang presents a distinctive feature whereby commits are prevalently used as dependency versions prior to their integration into official releases. This attribute can prove advantageous to users, as patch commits can be implemented in a timely manner before the releases. However, Golang employs a decentralized mechanism for managing dependencies, whereby dependencies are upheld and distributed in separate repositories. This approach can result in delays in the dissemination of patches and unresolved vulnerabilities.
DOI 原文 ·
@inproceedings{paperbot11348,
title = {Empirical Analysis of Vulnerabilities Life Cycle in Golang Ecosystem},
author = {Jinchang Hu and Lyuye Zhang and Chengwei Liu and Sen Yang and Song Huang and Yang Liu},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639230}
}