Classport: Designing Runtime Dependency Introspection for Java

TL;DR

This paper introduces Classport, a system that embeds dependency information into Java class files to enable runtime dependency introspection, addressing a key gap in Java for software supply chain security.

Contribution

We present Classport, the first approach to embed dependency info into Java class files for runtime introspection, enhancing security and dependency management.

Findings

Successfully identified dependencies at runtime in six real-world Java projects.

Demonstrated feasibility of runtime dependency introspection in Java.

Addressed a critical gap in Java's support for supply chain security.

Abstract

Runtime introspection of dependencies, i.e., the ability to observe which dependencies are currently used during program execution, is fundamental for Software Supply Chain security. Yet, Java has no support for it. We solve this problem with Classport, a blueprint and system that embeds dependency information into Java class files, enabling the retrieval of dependency information at runtime. We evaluate Classport on six real-world projects, demonstrating the feasibility in identifying dependencies at runtime.