From SBOM to Call Graphs: Harnessing OSS Tools to Streamline Update Impact Analysis in Cloud Services

Explore a method for streamlining update impact analysis in cloud services using open-source software tools. Learn how to leverage Software Bill of Materials (SBOM), Infrastructure as Code (IaC), ctags, git, and NetworkX to address the challenges of maintaining modern cloud services that heavily rely on open-source packages. Discover techniques for simulating updates based on SBOM, extracting change history, and performing change impact analysis through call graphs. Gain insights into implementing this approach in commercial systems to expedite update decisions and define clearer verification scopes for web applications developed in Node.js and other environments with complex package dependencies.

From SBOM to Call Graphs: Harnessing OSS Tools to Streamline Update Impact Analys... Noboru Iwamatsu