Large Software Ecosystems Research Articles

Bootstrapping MDE Development from ROS Manual Code

Ten years after its rst release, the Robot Operating System (ROS) is arguably the most popular software framework used to pro- gram robots. It achieved such status despite its shortcomings compared to alternatives similarly centered on manual programming and, perhaps surprisingly, to model-driven engineering (MDE) approaches. Based on our experience, we identied possible ways to leverage the accessibility of ROS and its large software ecosystem, while providing quality assurance measures through selected MDE techniques. After describing our vision on how to combine MDE and manually written code, we present the rst technical contribution in this pursuit: a family of three metamodels to respectively model ROS nodes, communication interfaces, and sys- tems. Such metamodels can be used, through the accompanying Eclipse- based tooling made publicly available, to model ROS systems of arbitrary complexity and generate with correctness guarantees the software arti- facts for their composition and deployment. Furthermore, they account for specications on these aspects by the Object Management Group (OMG), in order to be amenable to hybrid systems coupling ROS and other frameworks. We also report on our experience with a large and complex corpus of ROS software including the shortcomings of standard ROS tools and of previous eorts on ROS modeling.

Reference Coupling: An exploration of inter-project technical dependencies and their characteristics within large software ecosystems

Software projects often depend on other projects or are developed in tandem with other projects. Within such software ecosystems, knowledge of cross-project technical dependencies is important for (1) practitioners understanding of the impact of their code change and coordination needs within the ecosystem and (2) researchers in exploring properties of software ecosystems based on these technical dependencies. However, identifying technical dependencies at the ecosystem level can be challenging. In this paper, we describe Reference Coupling, a new method that uses solely the information in developers online interactions to detect technical dependencies between projects. The method establishes dependencies through user-specified cross-references between projects. We then use the output of this method to explore the properties of large software ecosystems. We validate our method on two datasets — one from open-source projects hosted on GitHub and one commercial dataset of IBM projects. We manually analyze the identified dependencies, categorize them, and compare them to dependencies specified by the development team. We examine the types of projects involved in the identified ecosystems, the structure of the identified ecosystems, and how the ecosystems structure compares with the social behavior of project contributors and owners. We find that our Reference Coupling method often identifies technical dependencies between projects that are untracked by developers. We describe empirical insights about the characteristics of large software ecosystems. We find that most ecosystems are centered around one project and are interconnected with other ecosystems. By exploring the socio-technical alignment within the GitHub ecosystems, we also found that the project owners social behavior aligns well with the technical dependencies within the ecosystem, but the project contributors social behavior does not align with these dependencies. We conclude with a discussion on future research that is enabled by our Reference Coupling method.

An empirical comparison of dependency network evolution in seven software packaging ecosystems

Nearly every popular programming language comes with one or more package managers. The software packages distributed by such package managers form large software ecosystems. These packaging ecosystems contain a large number of package releases that are updated regularly and that have many dependencies to other package releases. While packaging ecosystems are extremely useful for their respective communities of developers, they face challenges related to their scale, complexity, and rate of evolution. Typical problems are backward incompatible package updates, and the risk of (transitively) depending on packages that have become obsolete or inactive. This manuscript uses the libraries.io dataset to carry out a quantitative empirical analysis of the similarities and differences between the evolution of package dependency networks for seven packaging ecosystems of varying sizes and ages: Cargo for Rust, CPAN for Perl, CRAN for R, npm for JavaScript, NuGet for the .NET platform, Packagist for PHP, and RubyGems for Ruby. We propose novel metrics to capture the growth, changeability, reusability and fragility of these dependency networks, and use these metrics to analyze and compare their evolution. We observe that the dependency networks tend to grow over time, both in size and in number of package updates, while a minority of packages are responsible for most of the package updates. The majority of packages depend on other packages, but only a small proportion of packages accounts for most of the reverse dependencies. We observe a high proportion of “fragile” packages due to a high and increasing number of transitive dependencies. These findings are instrumental for assessing the quality of a package dependency network, and improving it through dependency management tools and imposed policies.

How do developers react to API evolution? A large-scale empirical study

Software engineering research now considers that no system is an island, but it is part of an ecosystem involving other systems, developers, and users. When a framework or a library evolves, its clients often must adapt. For example, client developers might need to adapt to functionalities, client systems might need to be adapted to a new API, and client users might need to adapt to a new user interface. The consequences of these changes are yet unclear: what proportion of the ecosystem might be expected to react, how long might it take for a change to diffuse in the ecosystem, do all clients react in the same way? This paper reports an exploratory study aimed at observing API evolution and its impact on a large software ecosystem, Pharo, which has about 3,600 distinct systems, and six years of evolution. We analyze 118 API changes in the context of method replacement and suggestion, and answer research questions regarding the magnitude, duration, extension, and consistency of such changes in the ecosystem. The results of this study help to characterize the impact of API evolution in large software ecosystems and provide the basis to better understand how such impact can be alleviated.

Security bugs in large software ecosystems

The XRDS blog highlights a range of topics from security and privacy to neuroscience. Selected blog posts, edited for print, will be featured in every issue. Please visit xrds.acm.org/blog to read each post in its entirety. Keeping with our theme of professional development, included is a guest post on how to craft a publishable research paper.