From SBOM to Call Graphs: Harnessing OSS Tools to Streamline Update Impact Analys... Noboru Iwamatsu
Channel: The Linux Foundation
Date: 2023-12-07

From SBOM to Call Graphs: Harnessing OSS Tools to Streamline Update Impact Analysis in Cloud Services - Noboru Iwamatsu, FUJITSU LIMITED

Modern cloud services rely heavily on open-source software, making continuous maintenance a challenge. For instance, web applications developed in Node.js can contain over 100 packages, which may account for up to 90% of the entire source code. Frequent vulnerability reports and package EOLs necessitate constant updates. But understanding these updates and their potential cascading effects on an application is complex. Based on academic knowledge and OSS tools like SBOM, IaC, ctags, git, NetworkX, this talk will present a method to pinpoint how updates impact an application. Integrating this into the PSIRT system, we aim to expedite update decisions and define a clearer verification scope. We'll share insights from implementing it in our commercial system. SBOM-based Update Simulation: Utilizing an application's SBOM, we replicate its package structure. By simulating the updates, we can pre-identify packages that will be changed. Change History Extraction: We retrieve the source code of the updated packages and derive the whole change history. Change Impact Analysis through Call Graphs: Generating call graphs for the application and its packages, we contrast them before and after updates. Associating changes in functions and paths reachable from the application with the change logs allows us to identify the critical modifications.