论文标题
数据集：通过Cocoapods，Carthage和Swift PM获得的开源库的依赖关系网络
Dataset: Dependency Networks of Open Source Libraries Available Through CocoaPods, Carthage and Swift PM
论文作者
论文摘要
第三方图书馆用于整合现有的解决方案，以解决常见问题并有助于加快发展的发展。但是，第三方库的使用可以承担风险，例如通过这些库中的漏洞。研究包装管理人员的依赖网络使我们可以更好地理解和减轻这些风险。到目前为止，尚未研究Apple生态系统的三个最重要的包装经理的依赖性网络，可可录，迦太基和Swift PM。我们分析了截至2021年12月的所有公开开源库的依赖关系，并编译了一个包含所有三个软件包管理者依赖关系网络的数据集。依赖性网络可用于分析如何通过及传播依赖性传播脆弱性。为了简化弱势库的追踪，我们还查询了NVD数据库，并在数据集中包括了这些库的公开报告的漏洞。
Third party libraries are used to integrate existing solutions for common problems and help speed up development. The use of third party libraries, however, can carry risks, for example through vulnerabilities in these libraries. Studying the dependency networks of package managers lets us better understand and mitigate these risks. So far, the dependency networks of the three most important package managers of the Apple ecosystem, CocoaPods, Carthage and Swift PM, have not been studied. We analysed the dependencies for all publicly available open source libraries up to December 2021 and compiled a dataset containing the dependency networks of all three package managers. The dependency networks can be used to analyse how vulnerabilities are propagated through transitive dependencies. In order to ease the tracing of vulnerable libraries we also queried the NVD database and included publicly reported vulnerabilities for these libraries in the dataset.
