Trusting a Library: A Study of the Latency to

Adopt the Latest Maven Release

Welcome, here we present our tool and datasets for experiments for Library Diffusion. Please feel free to use our tools/dataset and techniques.

Background

With the popularity of open source library (re)use in both industrial and open source settings, ‘trust' plays vital role in third-party library adoption. Trust involves the assumption of both functional and non-functional correctness. Even with the aid of dependency management build tools such as Maven and Gradle, research have still found a latency to trust the latest release of a library. In this study we investigate the trust of OSS libraries. Our study of 6,374 systems in Maven Super Repository suggests that 82% of systems have become more trusting of the latest release when introducing new libraries to existing systems. We uncover the impact of tools such as Maven and future directions of system dependency management.

For experiments, we mined data from the Maven2 (JVN Libraries) Super Repository

Data Extraction tool: https://github.com/raux/PomWalker which extracts using Maven dependencies.

Extracted Datasets

Maven Dependency Facts (Right click to download)

Note that for all data, we first downloaded an offline copy of the original data before extraction.

How to (scripts):

Please run these configuration scripts to load the Maven Dataset:

For the dependency algorithm R scripts do email me if you are unsure but basically they implement the algorithms in the paper.

Basically, it will mine the dataset for initial and introduced libraries. The result is the two files below.

We then did simple analysis over these files to gain our results.

This project is part of work for the Kaken SARF Project

Homepage:	http://sel.ist.osaka-u.ac.jp/SARF/index.html.en
Mail:	sarf@sel-mail.ics.es.osaka-u.ac.jp

Please email me if you have questions: raula-k(@)ist.osaka-u.ac.jp