Large-scale analyses of software ecosystems allow researchers to identify widespread vulnerabilities, validate dependencies for safe usage, and gain an understanding of the conditions of software package landscapes. In the C/C++ ecosystem however, there are many challenges facing large-scale analyses, due to the lack of a standard package manager or build system. With this work, we aim to explore the Conan ecosystem by statically analyzing it as a whole and on a large scale. We provide a static analysis tool set named CoPhi that crawls Conan packages and analyzes them for specific features to capture C/C++ ecosystem metrics of interest, and also create corpora with user-defined properties. In a case study, we demonstrate the effectiveness of CoPhi by analyzing 620 Conan packages for four different metrics.

Static call graphs are a fundamental building block of program analysis. However, differences in call-graph construction and the use of specific language features can yield unsoundness and imprecision. Call-graph analyses are evaluated using measures of precision and recall, but this is hard when a ground truth for real-world programs is generally unobtainable. In this work, we propose to use carefully constructed dynamic baselines based on fixed entry points and input corpora. The creation of this dynamic baseline is posed as an approximation of the ground truth---an optimization problem. We use manual extension and coverage-guided fuzzing for creating suitable input corpora. With these dynamic baselines, we study call-graph quality of multiple algorithms and implementations using four real-world Java programs. We find that our methodology provides valuable insights into call-graph quality and how to measure it. With this work, we provide a novel methodology to advance the field of static program analysis as we assess the computation of one of its core data structures---the call graph.