一句话:实证揭示 Python 依赖冲突新特征,提出基于 SMT 求解与虚拟环境复用的 smartPip 工具。
Python 的 pip 采用回溯策略后,此前关于依赖冲突(DC)问题的实证结论可能不再适用。本文重新开展实证研究,发现两种 DC 表现模式中 Pattern A 已显著变化,而 Pattern B 保持不变;同时,Pattern A 的解决策略存在效率问题,Pattern B 的虚拟环境方案会浪费时间和空间。基于此,作者提出 smartPip:针对 Pattern A,利用预构建的库依赖知识库收集版本约束,并转换为 SMT 表达式求解,替代逐个候选库迭代验证;针对 Pattern B,改进虚拟环境方案以尽量复用本地库。在三个开源项目基准数据集上评估,smartPip 在解决 Pattern A 时优于采用新策略的 pip 和 Conda,较最佳基线加速 1.19X–1.60X;相较 venv,在 Pattern B 上减少 34.55%–80.26% 存储空间并取得最高 2.26X–6.53X 加速。
As one of the representative software ecosystems, PyPI, together with the Python package management tool pip, greatly facilitates Python developers to automatically manage the reuse of third-party libraries, thus saving development time and cost. Despite its great success in practice, a recent empirical study revealed the risks of dependency conflict (DC) issues and then summarized the characteristics of DC issues. However, the dependency resolving strategy, which is the foundation of the prior study, has evolved to a new one, namely the backtracking strategy. To understand how the evolution of this dependency resolving strategy affects the prior findings, we conducted an empirical study to revisit the characteristics of DC issues under the new strategy. Our study revealed that, of the two previously discovered DC issue manifestation patterns, one has significantly changed (Pattern A), while the other remained the same (Pattern B). We also observed, the resolving strategy for the DC issues of Pattern A suffers from the efficiency issue, while the one for the DC issues of Pattern B would lead to a waste of time and space. Based on our findings, we propose a tool smartPip to overcome the limitations of the resolving strategies. To resolve the DC issues of Pattern A, instead of iteratively verifying each candidate dependency library, we leverage a pre-built knowledge base of library dependencies to collect version constraints for concerned libraries, and then convert the version constraints into the SMT expressions for solving. To resolve the DC issues of Pattern B, we improve the existing virtual environment solution to reuse the local libraries as far as possible. Finally, we evaluated smartPip in three benchmark datasets of open source projects. The results showed that, smartPip can outperform the existing Python package management tools including pip with the new strategy and Conda in resolving DC issues of Pattern A, and achieve 1.19X - 1.60X speedups over the best baseline approach. Compared with the built-in Python virtual environment (venv), smartPip reduced 34.55% - 80.26% of storage space and achieved up to 2.26X - 6.53X speedups in resolving the DC issues of Pattern B.