Classport: Designing Runtime Dependency Introspection for Java

TL;DR

Classport tackles the lack of runtime dependency visibility in Java by embedding dependency metadata into compiled artifacts during build-time and exposing it at runtime via a Java agent. The Embedder uses a Maven plugin and ASM bytecode transformation to annotate classes with a ClassportInfo annotation containing the Maven GAV coordinates, producing an augmented uber-JAR. The Introspector, as a Java agent using the Instrumentation API, instruments code to collect the set of actually executed dependencies and writes this as a CSV, enabling precise runtime dependency identification with low overhead. Evaluated on six real-world Maven projects, Classport achieves complete or near-complete embedding for most cases and demonstrates accurate runtime dependency discovery with negligible to moderate performance impact, unlocking use cases in runtime permissions and vulnerability detection that static SBOMs cannot provide.

Abstract

Runtime introspection of dependencies, i.e., the ability to observe which dependencies are currently used during program execution, is fundamental for Software Supply Chain security. Yet, Java has no support for it. We solve this problem with Classport, a system that embeds dependency information into Java class files, enabling the retrieval of dependency information at runtime. We evaluate Classport on six real-world projects, demonstrating the feasibility in identifying dependencies at runtime. Runtime dependency introspection with Classport opens important avenues for runtime integrity checking.

Figures (1)

• Figure 1: Overview of Classport, a novel system that enables runtime dependency introspection in Java.