Managing Software Supply Chains: Theory and Practice

Open-source software supply chains wield significant influence in the software industry, drawing substantial interest from enterprises, researchers, and policymakers. Leveraging third-party libraries to build software applications is a common practice aimed at cost savings and software quality enhancement. However, heavy reliance on external libraries often leads to a state of “dependency hell”, marked by issues like incompatibilities, conflicting versions, bloated dependencies, and the inclusion of vulnerable library versions. Despite extensive research on software dependency management and the evolution of software supply chains, questions linger regarding the variances in dependency challenges across programming language ecosystems and how best to address the dependency hell phenomenon from an ecosystem-wide perspective.

The aim of this book is to offer: (1) a comprehensive literature review on software supply chains, (2) discussions on modeling software supply chains and analyzing their evolutionary behaviors, (3) ecosystem-level strategies for diagnosing various dependency issues and automating problem resolution with cost-benefit analysis, and (4) provision of a toolkit and datasets to support future research and assist practitioners in addressing the challenges of dependency management. The methodologies outlined in this book have been previously presented in top-tier conferences and journals, with some techniques officially integrated into products by Microsoft Corporation and Huawei Technologies Co Ltd. This book is designed to provide readers with a solid understanding of software supply chain fundamentals and practical guidance on implementing theory and techniques in real-world industrial settings.

The book is chiefly intended for software engineering researchers and students with an academic background who are interested in learning about dependency management for third-party libraries, quality assurance for software supply chains, and the evolution of open-source software ecosystems. It will also be of interest to practitioners, including software engineers, quality assurance professionals, and software managers, as well as general readers. All will benefit from our systematic studies on the dependency hell phenomenon in various programming language communities and valuable associated artifacts.

Ying Wang received her doctoral degree in software engineering from Northeastern University, China, in 2019. She is currently an associate professor at the Software College, Northeastern University, China. Her research interests include software supply chain, program analysis, dependency management, and software ecosystems. Her research work has been regularly published in top-tier journals and conferences in the research communities of software engineering, and has received two ACM SIGSOFT Distinguished Paper Awards (ICSE 2021 and ESEC/FSE 2023). She serves as an editorial board member of the journal IEEE Transactions on Software Engineering. She received the Outstanding Doctoral Dissertation Award of Liaoning Province (2021) and the Nominees Award for Outstanding Doctoral Dissertation of China Computer Federation (CCF) in 2020. She joined the Microsoft Research Asia StarTrack Program (2020). Dr. Wang Ying is the first scholar to organize the "Women Scholars Forum in Software Engineering" at the China Software Conference (ChinaSoft).

Shing-Chi Cheung received his bachelor’s degree in electrical and electronic engineering from the University of Hong Kong and his PhD degree in computing from the Imperial College London. After doctoral graduation, he joined the Hong Kong University of Science and Technology (HKUST), where he is a professor of computer science and engineering. He founded the CASTLE research group at HKUST and co-founded in 2006 the International Workshop on Automation of Software Testing (AST). He is an extended member of the ACM SIGSOFT executive committee. His research interests lie in boosting the quality of software applications using program analysis, testing, debugging, synthesis, repository mining, and artificial intelligence. Target applications include Android apps, open-source software, deep learning systems, smart contracts, and AI software. He is an IEEE Fellow and a Distinguished Member of the ACM.

Hai Yu received a BE degree in Electronic Engineering from Jilin University, China, in 1993 and a PhD degree in Computer Software and Theory from Northeastern University, China, in 2006. He is currently an associate professor of Software Engineering at the Northeastern University, China. His research interests include complex networks, chaotic encryption, software testing, software refactoring, and software architecture. At present, he serves as an associate editor for the International Journal of Bifurcation and Chaos, guest editor for Entropy, and guest editor for the Journal of Applied Analysis and Computation. In addition, he was a lead guest editor for Mathematical Problems in Engineering during 2013.

Zhiliang Zhu received an MS degree in Computer Applications and a PhD degree in Computer Science from Northeastern University, China. He is currently a full professor at Software College, Northeastern University, China. His main research interests include software engineering, complexity software systems, and applications of complex network theory. He has authored and co-authored over 130 international journal papers and 100 conference papers. In addition, he has published five books, including Introduction to Communication and Program Designing of Visual Basic .NET, etc. Prof. Zhu has served in different capacities at many international journals and conferences. Currently, he serves as co-chair of the 1st-19th International Workshop on Chaos-Fractals Theories and Applications.