Software of unknown pedigree (SOUP) for Rust and TypeScript

Generating SOUP records using Rust

1. SOUP for Rust and TypeScript
@jayvdb
franklin.ai

2. franklin.ai

3. franklin.ai
Kubernetes
Rust services wrapping
Python AI
Electron frontend

4. Software of unknown pedigree
(SOUP)
software that has NOT been
developed with a known
software development process
 or methodology, or which has
unknown or no safety-related
properties.
https://en.wikipedia.org/wiki/Software_of_unknown_pedigree
 IEC 62304:2006

5. Software of unknown pedigree
(SOUP)
●i.e. Programming language
compilers/runtimes, and
package managers.
i.e. Open source libraries.
i.e. Docker images. e.g. “redis”
Github actions “uses: …” ?
Helm charts … ?

6. SOUP records
●For each SOUP:
–Name
–Version
–Manufacturer
–Any custom requirements
–Website of bug reports and release
notes
–How is it used in the product
–

7. SOUP risk evaluation
●For each SOUP, what safety classification is it:
–Class A: No unacceptable risk to health
–Class B: Injury is possible but not serious
–Class C: Death or serious injury is possible
–

8. Non-product dependencies
●Build dependencies
–Is generated code
being formally
reviewed? Check it
in.
●Test dependencies
–Are the tests
mentioned in the
formal product
verification
protocols?
●Spell checker
●License checker
●Linters
●Optional developer
workflow helpers
X✓
Doc dependencies
Are the docs critical
to product use?
Are the doc outputs
reviewed?
?

9. Collate the SOUP
●company-product
–company-lib
●Open-source build tool
●Open-source test tool
●Open-source lib
–Open-source lib
✓
✓
✓
x
x
✓

10. Collate the SOUP
●company-product
–company-lib
●Open-source build tool
●Open-source test tool
●Open-source lib
–Open-source lib
✓
✓
✓
x
x
✓
cargo lock
✓
✓
✓
✓
✓
x

11. Collate the SOUP
●company-product
–company-lib
●Open-source build tool
●Open-source test tool
●Open-source lib
–Open-source lib
✓
✓
✓
x
x
✓
npm lock
x
✓
✓
✓
✓
x

12. Collate the SOUP
Two choices:
1)Build SOUP at each level of the dependency tree,
put the SOUP into the versioned library
packages, and merge the SOUP at the top level.
2)Include lock files in library packages, and build a
tool to create the SOUP at the top level, using
the lock files.
Both require a manual process or custom tool to
create the final unified SOUP list.

13. I chose option 2
●Distributing lock files in packages is a technical
step.
●No significant extra effort during development. No
SOUP step for each library version. Library
versions are cheap.
●Extra effort occurs at product release, combining all
the lock files.
●Only need to consider the versions of libraries
included in the release.

14. I chose Rust
I used “cargo_metadata” crate to understand cargo
dependency tree.

15. I chose Rust
I found a 8 star repo that understood package.json.

16. I chose Rust
I found a 8 star repo that understood package.json.

17. I chose Rust
I found a random 0 star repo that understood pnpm
lock files. And then needed to create a lib from it.

18. I chose Rust
●Oh, and we need
package
descriptions
from
npmjs.net ...

19. TODO
●Add Python using phylum_lockfile
https://github.com/phylum-dev/cli

20. TODO
●Publish ...
QUESTIONS?
@jayvdb
franklin.ai