一句话：提出统一依赖图 UDG，融合静态与动态信息编码声明与实际依赖，实现高效精确的构建依赖错误检测工具 VeriBuild。
现代软件项目依赖构建系统与构建脚本生成可执行产物，但脚本中的依赖错误（缺失依赖、冗余依赖）十分常见，会导致构建失败、结果错误或增量/并行构建性能下降。现有检测技术因底层依赖图不足而效率低、误报高。本文提出统一依赖图 UDG，同时利用静态与动态信息，统一编码构建目标与文件之间的声明依赖和实际依赖；基于 UDG，仅需简单图遍历即可高效且精确地检测依赖错误。作者实现工具 VeriBuild，并在 42 个维护良好的开源项目上评估。结果显示，在不损失精度的情况下，VeriBuild 的开销比当前最优方法降低 58.2%，已有 398 个检测到的依赖问题被开发者确认。
Modern software projects rely on build systems and build scripts to assemble executable artifacts correctly and efficiently. However, developing build scripts is error-prone. Dependency-related errors in build scripts, mainly including missing dependencies and redundant dependencies, are common in various kinds of software projects. These errors lead to build failures, incorrect build results or poor performance in incremental or parallel builds. To detect such errors, various techniques are proposed and suffer from low efficiency and high false positive problems, due to the deficiency of the underlying dependency graphs. In this work, we design a new dependency graph, the unified dependency graph (UDG), which leverages both static and dynamic information to uniformly encode the declared and actual dependencies between build targets and files. The construction of UDG facilitates the efficient and precise detection of dependency errors via simple graph traversals. We implement the proposed approach as a tool, VeriBuild, and evaluate it on forty-two well-maintained open-source projects. The experimental results show that, without losing precision, VeriBuild incurs 58.2% less overhead than the state-of-the-art approach. By the time of writing, 398 detected dependency issues have been confirmed by the developers.
DOI 原文 ·
@inproceedings{paperbot6060,
title = {Escaping dependency hell: finding build dependency errors with the unified dependency graph},
author = {Gang Fan and Chengpeng Wang and Rongxin Wu and Xiao Xiao and Qingkai Shi and Charles Zhang},
booktitle = {ISSTA},
year = {2020},
doi = {10.1145/3395363.3397388}
}