SCC Analysis + Discussion

[jensdietrich]

Discuss a small (if possible size 3) SCC in GAV and GA graph (one each) in detail - i.e. look at the dependencies and try to understand what the developers try to achieve here.

Do the following (and more if required):

1. locate the projects on GitHub (pom.xml often have scm entries to help with this, and you can find the poms on maven central or mvn repository.com)
2. find the commit that defined the dependency observed in the pom.xml , look at comments in commit and associated pull requests and issues
3. note that poms can inherit dependencies from parent poms -- if you see a parent being referenced, check this
4. the Maven artifact might have been defined by a non-Maven project -- gradle or ant-ivy are likely contenders, they have similar ways to define dependencies, you must check those as well if you encounter them
5. you can check out the projects from github, and use IDE reference browsers or debuggers to see how dependencies are being used.
6. documents all details (like commit URLs, project URLs etc) -- perhaps create md file in repo for this purpose

Please ask if you don't understand any of those instructions, we have to get this finished soon as this is only a marginal part of the paper !

@ulizue - FYI

[nkiru-ede]

@jensdietrich just to be clear - by this - do you mean the dependency tree/analyzer? E.g: the screenshot I have attached.

you can check out the projects from github, and use IDE reference browsers or debuggers to see how dependencies are being used.

[nkiru-ede]

@jensdietrich https://vuw-my.sharepoint.com/:w:/g/personal/edenk_staff_vuw_ac_nz/EUytlG38LFOuNu5J4pRr00BXDAOoYlN9OsRAbHZDIKGvge=We8eGn

[jensdietrich]

@nkiru-ede this needs more analysis -- all three GAvs seem to be components (modules) of a common parent project. The parent probably also sets the version shared across those modules.

I suggest to load the parent into an IDE like IntelliJ (clone from GitHub, identify tag that corresponds to this version, and check out this tag with git checkout) and then use IDE dependency analysis. We try to find out whether there are actual dependencies between code in those modules (like subtyping, use of types in method signatures, etc).

[nkiru-ede]

@jensdietrich for this SCC ----SCC (size 3): {'org.apache.cxf:cxf-tools-wsdlto-databinding-jaxb:2.1.8', 'org.apache.cxf:cxf-tools-wsdlto-core:2.1.8', 'org.apache.cxf:cxf-tools-wsdlto-frontend-jaxws:2.1.8'}

I found that org.apache.cxf:cxf-tools-wsdlto-databinding-jaxb imports a class from org.apache.cxf:cxf-tools-wsdlto-core

[jensdietrich]

@nkiru-ede this is one edge confirmed -- what about the other ones ? We have three edges in the SCC.

[jensdietrich]

For each code dependency, please produce a link that points to the dependency in the source code incl revision and line number (GitHub can do this).

[nkiru-ede]

@jensdietrich for the above ---- line 122 https://github.com/apache/cxf/blob/main/tools/wsdlto/databinding/jaxb/src/main/java/org/apache/cxf/tools/wsdlto/databinding/jaxb/JAXBDataBinding.java

(size 3): {'org.springframework.batch:spring-batch-infrastructure', 'org.springframework.ldap:spring-ldap-ldif-core', 'org.springframework.batch:spring-batch-core'}

org.springframework.batch:spring-batch-infrastructure and org.springframework.ldap:spring-ldap-ldif-core seem to have a code dependency

many ones between spring-batch-core and spring-batch-infrastructure

line 31 https://github.com/spring-projects/spring-batch/blob/main/spring-batch-infrastructure/src/test/java/org/springframework/batch/item/file/transform/PassThroughFieldExtractorTests.java

https://github.com/spring-projects/spring-batch/tree/main/spring-batch-infrastructure/src/test/java/org/springframework/batch/item/database