Package org.ossreviewtoolkit.model.utils

Class DependencyGraphBuilder

  • All Implemented Interfaces:
    
public final class DependencyGraphBuilder<D extends Object>

    A class that can construct a DependencyGraph from a set of dependencies that provides an efficient storage format for large dependency sets in many scopes.

    For larger projects the network of transitive dependencies tends to become complex. Single packages can occur many times in this structure if they are referenced by multiple scopes or are fundamental libraries, on which many other packages depend. A naive implementation, which simply duplicates the dependency trees for each scope and package therefore leads to a high consumption of memory. This class addresses this problem by generating an optimized structure that shares the components of the dependency graph between the scopes as far as possible.

    This builder class provides the addDependency() function, which has to be called for all the direct dependencies of the different scopes. From these dependencies it constructs a single, optimized graph that is referenced by all scopes. To reduce the amount of memory required even further, package identifiers are replaced by numeric indices, so that references in the graph are just numbers.

    Ideally, the resulting dependency graph contains each dependency exactly once. There are, however, cases, in which packages occur multiple times in the project's dependency graph with different dependencies, for instance if exclusions for transitive dependencies are used or a version resolution mechanism comes into play. In such cases, the corresponding packages need to form different nodes in the graph, so that they can be distinguished, and for packages depending on them, it must be ensured that the correct node is referenced. In the terminology of this class this is referred to as "fragmentation": A fragment is a consistent sub graph, in which each package occurs only once. Packages appearing multiple times with different dependencies need to be placed in separate fragments. It is then possible to uniquely identify a specific package by a combination of its numeric identifier and the index of the fragment it belongs to.

    This class implements the full logic to construct a DependencyGraph, independent on the concrete representation of dependencies D used by specific package managers. To make this class compatible with such a dependency representation, the package manager implementation has to provide a DependencyHandler. Via this handler, all the relevant information about dependencies can be extracted.

    • Constructor Detail

    • Method Detail

      • addPackages

         final DependencyGraphBuilder<D> addPackages(Collection<Package> packages)

        Add the given packages to this builder. They are stored internally and also returned when querying the set of known packages. This function can be used by package managers that have to deal with packages not part of normal scope dependencies. One example would be Yarn; here packages can be defined in the workspace and are not necessarily referenced by manifest files.

      • build

         final DependencyGraph build(Boolean checkReferences)

        Construct the DependencyGraph from the dependencies passed to this builder so far. If checkReferences is true, check whether all dependency references used in the graph point to packages managed by this builder. This check is enabled by default and should be done for all package manager implementations. Only for special cases, e.g. the conversion from the dependency tree to the dependency graph format, it needs to be disabled as the conditions do not hold then.

      • packages

         final Set<Package> packages()

        Return a set with all the packages that have been encountered for the current project.

      • scopesFor

         final Set<String> scopesFor(String prefix, Boolean unqualify)

        Return a set of all the scope names known to this builder that start with the given prefix. If unqualify is true, remove this prefix from the returned scope names.

      • scopesFor

         final Set<String> scopesFor(Identifier projectId, Boolean unqualify)

        Return a set of all the scope names known to this builder that are qualified with the given projectId. If unqualify is true, remove the project qualifier from the returned scope names. As dependency graphs are shared between multiple projects, scope names are given a project-specific prefix to make them unique. Using this function, the scope names of a specific project can be retrieved.