Uncovering and Mitigating the Impact of Frozen Package Versions for Fixed-Release Linux
Fuente:
arXiv
Gespeichert in:
| Hauptverfasser: | , , , , |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2024
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866916390362939392 |
|---|---|
| author | Tang, Wei Xu, Zhengzi Liu, Chengwei Luo, Ping Liu, Yang |
| author_facet | Tang, Wei Xu, Zhengzi Liu, Chengwei Luo, Ping Liu, Yang |
| contents | Towards understanding the ecosystem gap of fixed-release Linux that is caused by the evolution of mirrors, we conducted a comprehensive study of the Debian ecosystem. This study involved the collection of Debian packages and the construction of the dependency graph of the Debian ecosystem. Utilizing historic snapshots of Debian mirrors, we were able to recover the evolution of the dependency graph for all Debian releases, including obsolete ones. Through the analysis of the dependency graph and its evolution, we investigated from two key aspects: (1) compatibility issues and (2) security threats in the Debian ecosystem. Our findings provide valuable insights into the use and design of Linux package managers. To address the challenges revealed in the empirical study and bridge the ecosystem gap between releases, we propose a novel package management approach allowing for separate dependency environments based on native Debian mirrors. We present a working prototype, named ccenv, which can effectively remedy the inadequacy of current tools. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2408_11631 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Uncovering and Mitigating the Impact of Frozen Package Versions for Fixed-Release Linux Tang, Wei Xu, Zhengzi Liu, Chengwei Luo, Ping Liu, Yang Software Engineering Towards understanding the ecosystem gap of fixed-release Linux that is caused by the evolution of mirrors, we conducted a comprehensive study of the Debian ecosystem. This study involved the collection of Debian packages and the construction of the dependency graph of the Debian ecosystem. Utilizing historic snapshots of Debian mirrors, we were able to recover the evolution of the dependency graph for all Debian releases, including obsolete ones. Through the analysis of the dependency graph and its evolution, we investigated from two key aspects: (1) compatibility issues and (2) security threats in the Debian ecosystem. Our findings provide valuable insights into the use and design of Linux package managers. To address the challenges revealed in the empirical study and bridge the ecosystem gap between releases, we propose a novel package management approach allowing for separate dependency environments based on native Debian mirrors. We present a working prototype, named ccenv, which can effectively remedy the inadequacy of current tools. |
| title | Uncovering and Mitigating the Impact of Frozen Package Versions for Fixed-Release Linux |
| topic | Software Engineering |
| url | https://arxiv.org/abs/2408.11631 |