How 21 dependencies become 1,000: Understanding your software supply chain | GitHub Checkout

Key Concepts

Dependency Graph, Transitive Dependencies, Direct Dependencies, Software Supply Chain, SBOM (Software Bill of Materials), Dependabot Alerts, Dependency Auto-Submission, Package Ecosystems (npm, Java, Python, .NET), GitHub Actions, Advanced Security, Vulnerability Prioritization.

Dependency Graph: Understanding Software Dependencies

The dependency graph is a feature on GitHub that visualizes the dependencies of a software project. It represents each package as a node and the dependencies between them as edges. This allows developers to understand the complex web of dependencies that their project relies on.

• Key Point: Modern software projects rely heavily on open-source dependencies, making the dependency graph crucial for managing complexity.
• Example: A project might directly require six packages, but each of those packages has its own dependencies, leading to a large and complex dependency tree.
• Direct vs. Transitive Dependencies: The dependency graph distinguishes between direct dependencies (those explicitly listed in the project's manifest file) and transitive dependencies (those that are dependencies of dependencies).
  • Example: The video shows a project with 21 direct dependencies but over 1000 indirect (transitive) dependencies.
• Benefit: The dependency graph powers Dependabot alerts, notifying users of security vulnerabilities in their dependencies.

The Importance of Software Supply Chain Security

The software supply chain refers to the network of dependencies that a software project relies on. Securing this supply chain is critical because vulnerabilities in any dependency can compromise the entire project.

• Key Argument: Most of the code running in a project is not written by the project's developers but is instead code from external dependencies.
• Risk: The software supply chain is a significant risk, especially for projects handling sensitive data, because vulnerabilities in dependencies can be exploited.
• Benefit: Understanding the software supply chain allows developers to make informed decisions about the components they use and to prioritize security risks.

Dependency Auto-Submission and SBOMs

Dependency auto-submission is a feature that automatically builds the dependency graph for certain package ecosystems. For ecosystems without auto-submission, developers can use community-maintained GitHub Actions to generate an SBOM (Software Bill of Materials) and upload it to GitHub's dependency submission API.

• Auto-Submission: GitHub automatically runs an action to download dependencies and build the dependency tree for Java ecosystems (Gradle and Maven) and soon .NET.
• SBOM: An SBOM is a comprehensive list of all the components used in a software project.
• Tool: Syft is mentioned as a tool that can generate an SBOM for various programming languages.
• Process:
  1. If auto-submission is not available, use a GitHub Action to generate an SBOM.
  2. Upload the SBOM to GitHub's dependency submission API.
  3. The dependencies will then appear in the dependency graph, and Dependabot alerts will be generated if applicable.

Dependabot Alerts and Vulnerability Prioritization

Dependabot alerts notify developers of security vulnerabilities in their dependencies. The dependency graph helps prioritize these alerts by distinguishing between direct and transitive dependencies.

• Key Point: Prioritize vulnerabilities in direct dependencies over those in transitive dependencies.
• Reasoning: Fixing vulnerabilities in direct dependencies is typically faster and easier than waiting for maintainers of intermediate dependencies to update their code.
• Example: The video shows how to filter Dependabot alerts to focus on vulnerabilities in direct dependencies, reducing the number of alerts that require immediate action.
• Benefit: This prioritization helps developers focus on the most critical security risks and allocate their resources effectively.

Enabling Dependency Graph and Dependabot

The dependency graph and Dependabot can be enabled in the "Advanced Security" section of a repository's settings on GitHub.

• Process:
  1. Go to the repository's settings.
  2. Navigate to the "Advanced Security" section.
  3. Enable the dependency graph and Dependabot.
• Organization-Wide Enforcement: Organizations and GitHub Enterprise accounts can enforce the enablement of the dependency graph across all repositories.
• Relationship: Enabling Dependabot automatically enables the dependency graph, but the reverse is not true.
• Cost: The dependency graph and Dependabot are free for all public repositories.

Conclusion

The dependency graph and dependency auto-submission are powerful features that help developers understand and secure their software supply chains. By visualizing dependencies, prioritizing vulnerabilities, and automating the process of building the dependency graph, these features enable developers to build more secure and reliable software. The key takeaway is that understanding and managing dependencies is crucial for modern software development, and GitHub provides the tools to do so effectively.