Large-scale analyses of software ecosystems allow researchers to identify widespread vulnerabilities, validate dependencies for safe usage, and gain an understanding of the conditions of software package landscapes. In the C/C++ ecosystem however, there are many challenges facing large-scale analyses, due to the lack of a standard package manager or build system. With this work, we aim to explore the Conan ecosystem by statically analyzing it as a whole and on a large scale. We provide a static analysis tool set named CoPhi that crawls Conan packages and analyzes them for specific features to capture C/C++ ecosystem metrics of interest, and also create corpora with user-defined properties. In a case study, we demonstrate the effectiveness of CoPhi by analyzing 620 Conan packages for four different metrics.
Erfan Raoofian University of British Columbia, Fatemeh Hendijani Fard Department of Computer Science, Mathematics, Physics and Statistics, University of British Columbia, Okanagan Campus, Ifeoma Adaji University of British Columbia, Gema Rodríguez-Pérez Department of Computer Science, Mathematics, Physics and Statistics, University of British Columbia, Okanagan Campus