Buildless Dependency Fetching for Missing Build Instructions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The complexity and limitations of build instructions in software development lead to challenges in determining build dependencies and supporting security analyses when instructions are incomplete, unavailable, or inconsistent, limiting the availability and efficiency of security and licensing analyses.
Innovation Solution
A buildless dependency fetching method that extracts dependency information from a program file, constructs a dependency set, and generates program representations without building the program, using a dependency extraction tool to facilitate security and licensing analyses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional build instructions are used to determine program dependencies, then build process reliability is improved, but analysis availability deteriorates when build instructions are incomplete or unavailable
Solution Approach 1:
The patent segments the dependency resolution process into two independent paths: one using build instructions (when available) and another using source code analysis (when instructions are missing). This segmentation allows the system to maintain reliability through build instructions while gaining versatility by falling back to source code analysis, resolving the contradiction between reliability and adaptability.
Solution Approach 2:
The patent introduces an intermediary dependency resolution mechanism that analyzes source code files directly when build instructions are unavailable. This intermediary approach bridges the gap between the ideal scenario (complete build instructions) and the realistic scenario (missing or incomplete instructions), enabling analysis availability across all scenarios while maintaining build process reliability when instructions are present.
2Device complexity
If build instructions are required for dependency determination, then build process control is improved, but productivity deteriorates due to incomplete or unavailable instructions
Solution Approach 1:
The patent applies partial action by performing only the necessary dependency resolution steps appropriate to the available information. When build instructions are missing, the system performs source code analysis instead of attempting full build process control, avoiding wasted effort on unavailable instructions while maintaining productivity through alternative means.
Solution Approach 2:
The system performs self-service dependency resolution by automatically analyzing source code files to extract dependency information when build instructions are unavailable. This self-service capability eliminates the need for external build instructions, allowing the system to maintain productivity through autonomous source code analysis rather than waiting for or requiring complete build process control.
3Measurement precision
If build process is executed to obtain program representations, then analysis accuracy is improved, but loss of time increases due to complete building requirement
Solution Approach 1:
The patent extracts the essential dependency information and program representations needed for analysis directly from source code files, separating this extraction process from the complete build process. This allows the system to obtain accurate analysis data without requiring the full build to complete, thereby reducing time loss while maintaining measurement precision.
Solution Approach 2:
The system performs preliminary dependency extraction and program representation generation from source code before the complete build process is executed. This preliminary action provides sufficient information for security and licensing analyses to proceed in parallel or independently, eliminating the sequential time loss that would occur if waiting for the complete build to finish.
Data Source
AI summary
Some embodiments construct a set of build dependencies for a program without a full set of build instructions. The build dependency set is constructed without piggy-backing on a build process that would produce an executable version of the program. Representations of the program's structure, such as expression types, call targets, symbol tables, abstract syntax trees, and other internal compiler data structures, are emitted to persistent non-volatile storage instead of being used only as intermediate steps for executable code generation. Security analysis can then utilize the program representations. Licensing analysis can also utilize the dependency set to identify program components and their storage locations.