Studies on software ecosystems provide valuable insights for project safety and security. However, implementing studies that accumulate precise data and generalize well is a complex task. The more data sources are accessed by a study, the more time it takes to aggregate results. Thus, researchers typically reduce the sample size, lowering generalizability. In this tutorial, we illustrate how MARIN encourages study designers to make conscious decisions about their data sources, and investigate the resulting impact on study performance.

Maven Central is the largest open repository for JVM libraries, hosting just under 15 million artifacts as of November 2024. Its popularity has made it a prime target for malicious actors to upload malware or exploit vulnerabilities – one in eight open source downloads have been vulnerable in 2023. Consequently, analyzing the artifacts is essential to understanding and improving software security and safety, both for individual projects and on a large-scale.However, current implementations of concrete analyses do not separate the infrastructural task of iterating and accessing artifacts from their domain-specific analysis task. Consequently, features are implemented many times in different variations, increasing the potential for bugs as well as the overhead in development and maintenance.With this work we propose MARIN, a framework for conducting analyses targeting software hosted on Maven Central. MARIN handles common infrastructural tasks in such scenarios, including iterating artifacts, retrieving metadata, parsing binaries, and resolving dependencies. It is designed to have minimal performance overhead, using both internal caches and the local Maven repository to reduce the number of HTTP calls and computations. This way, researchers can solely focus on implementing their domain-specific analysis task – MARIN provides configurable facilities to execute it for all artifacts on Maven Central.

Dependency graphs for software repositories have been utilized in a variety of different research contexts. However, to this date there is no unified data model for such graphs, often prompting researchers to implement domain-specific methodologies from scratch. This greatly hinders comparability and makes it hard to incorporate existing tooling into new contexts. With this work we propose DGMF, a framework for mining dependency graphs via repository-specific, user-defined adapters. DGMF is designed to be fast, to require little repository-specific code, and to produce graphs that are comparable even across different repositories. We present our design and implementation, as well as three predefined adapters and an evaluation.