Package: it-depends
It-DependsIt-Depends is a tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories. You can use it to enumerate all third party dependencies for a software package, map those dependencies to known security vulnerabilities, as well as compare the similarity between two packages based on their dependencies.To the best of our knowledge, It-Depends is the only such tool with the following features:Support for C/C++ projects (both autootools and cmake)Automated resolution of native library dependencies partially based on dynamic analysis (e.g., the Python packagepytzdepends on the native librarylibtinfo.so.6)Enumeration ofall possibledependency resolutions, not just asingle feasibleresolutionA comparison metric for the similarity between two packages based on their dependency graphFeatures ⭐Supports Go, JavaScript, Rust, Python, and C/C++ projects.Accepts source code repositories or package specifications likepip:it-dependsExtracts dependencies of cmake/autotool repostories without building itFinds native dependencies for high level languages like Python or JavaScriptProvides visualization based on vis.js or dotMatches dependencies and CVEsExport Software Bills of Materials (SBOMs)Machine-intelligible JSON outputSupport for the SPDX standard isin active developmentCan It-Depends Do It? It Depends. 🍋It-Depends does not detect vendored or copy/pasted dependenciesResults from build systems like autotools and cmake that entail arbitrary computation at install time are
best-effortResolution of native dependencies is best-effortSome native dependencies are resolved through dynamic analysisNative dependencies are inferred by cross-referencing file requirements against paths provided by the Ubuntu
package repository; dependencies may be different across other Linux distributions or Ubuntu versionsIt-Depends attempts to resolveallpossible package versions that satisfy a dependencyIt-Dependsdoes notfind a single satisfying package resolutionThe list of resolved packages is intended to be a superset of the packages required by the installation of
a package on any systemThe--auditfeature may discover vulnerabilities in upstream dependencies that are either not exploitable in the
target package or are in a package version that cannot exist in any valid dependency resolution of the target
packageIt-Depends caches data that it expects to be immutable in a local databaseIf a package is ever deleted or yanked from a package repository after it was already cached, It-Depends will
continue to use the cached data unless the cache is cleared with--clear-cacheQuickstart 🚀$ pip3 install it-dependsRunning it 🏃Runit-dependsin the root of the source repository you would like to analyze:$cd/path/to/project$it-dependsor alternatively point it to the path directly:$it-depends/path/to/projector alternatively specify a package from a public package repository:$it-dependspip:numpy$it-dependsapt:libc6@2.31$it-dependsnpm:lodash@>=4.17.0It-Depends will output the full dependency hierarchy in JSON format. Additional output formats such
as Graphviz/Dot are available via the--output-formatoption.It-Depends can automatically try to match packages against theOSV vulnerability databasewith the--auditoption. This is a best-effort matching as it is based on package names, which might not always consistent.
Any discovered vulnerabilities are added to the JSON output.It-Depends attempts to parallelize as much of its effort as possible. To limit the maximum number of parallel tasks, use
the--max-workersoption.By default, It-Depends recursively resolves all packages' dependencies to construct a complete dependency graph. The
depth of the recursion can be limited using the--depth-limitoption. For example,$it-dependspip:graphtage--depth-limit1will only enumerate the direct dependencies of Graphtage.Examples 🧑‍🏫Here is an example of running It-Depends on its own source repository:This is the resultingjsonwith all the discovered dependencies.
This is the resultingGraphviz dot fileproducing thisThis is the resulting dependency graph:It-Depends’ Dependencies 🎭JavaScript requiresnpmRust requirescargoPython requirespipC/C++ requiresautotoolsand/orcmakeSeveral native dependencies are resolved using Ubuntu’s file to path databaseapt-file, but this is seamlessly
handled through an Ubuntudockercontainer on other distributions and operating systemsCurrentlydockeris used to resolve native dependenciesDevelopment 👷$ git clone https://github.com/trailofbits/it-depends
$ cd it-depends
$ python3 -m venv venv  # Optional virtualenv
$ ./venv/bin/activate   # Optional virtualenv
$ pip3 install -e '.[dev]'
$ git config core.hooksPath ./hooks  # Optionally enable git commit hooks for lintingLicense and Acknowledgements 📃️This research was developed byTrail of Bitsbased upon work supported by DARPA under Contract No. HR001120C0084 (Distribution StatementA, Approved for Public Release: Distribution Unlimited).  Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the United States Government or DARPA.Felipe ManzanoandEvan Sultanikare
the active maintainers, butAlessandro Gario,Eric Kilmer,Alexander Remie, andHenrik Brodinall made significant
contributions to the tool’s inception and development.It-Depends is licensed under theGNU Lesser General Public License v3.0.Contact usif you’re looking for an exception to the terms.© 2021, Trail of Bits.