What is DepTrim?

DepTrim is a Maven plugin that automatically specializes the dependencies of a project. The objective is hardening the software supply chain of third-party dependencies of a project by using dependencies that only contain the classes and interfaces that are actually necessary to build the project. Relying on specialized variants of dependencies is good for security, as it reduces the attack surface of the project, and good for performance, as it reduces the size of the final artifact.

After running DepTrim, a directory named libs-specialized is created in the root of the project. This directory contains the specialized variants of all the dependencies necessary to build the project (inc. direct and transitive dependencies). DepTrim can also create a specialized POM file, named pom-specialized.xml. This specialized POM uses the specialized variants of the dependencies instead of the original dependencies. DepTrim deploys the specialized variants of the dependencies in the local Maven repository.

NOTE: DepTrim does not modify the original source code of the project nor its original pom.xml.

Usage

Run DepTrim directly from the command line as follows:

cd {PATH_TO_MAVEN_PROJECT}
# First, compile source and test files of the project.
mvn compile
mvn compiler:testCompile
# Then, run the latest version of DepTrim.
mvn se.kth.castor:deptrim-maven-plugin:0.1.1:deptrim -DcreateSinglePomSpecialized=true

Alternatively, configure the original pom.xml file of the project to run DepTrim as part of the build as follows:

<plugin>
  <groupId>se.kth.castor</groupId>
  <artifactId>deptrim-maven-plugin</artifactId>
  <version>0.1.1</version>
  <executions>
    <execution>
      <goals>
        <goal>deptrim</goal>
      </goals>
      <configurations>
        <createSinglePomSpecialized>true</createSinglePomSpecialized>
      </configurations>
    </execution>
  </executions>
</plugin>

In both cases, a directory name libs-specialized will be created in the root of the project, together with a file named pom-specialized.xml, which uses the specialized variants of the dependencies.

Optional parameters

The deptrim-maven-plugin accepts the following additional parameters.

Name	Type	Description
`<specializeDependencies>`	`Set<String>`	Add a list of dependencies, identified by their coordinates, to be specialized by DepTrim. Dependency format is: `groupId:artifactId:version:scope`. An empty string indicates that all the dependencies in the dependency tree of the project will be specialized (`default`).
`<ignoreDependencies>`	`Set<String>`	Add a list of dependencies, identified by their coordinates, to be ignored by DepTrim during the analysis. This is useful to override incomplete result caused by bytecode-level static analysis. Dependency format is: `groupId:artifactId:version:scope`.
`<ignoreScopes>`	`Set<String>`	Add a list of scopes, to be ignored by DepTrim during the analysis. Useful to not analyze dependencies with scopes that are not needed at runtime. Valid scopes are: `compile`, `provided`, `test`, `runtime`, `system`, `import`. An empty string indicates no scopes (`default`).
`<createSinglePomSpecialized>`	`boolean`	If this is `true`, DepTrim creates a specialized version of the POM file in the root of the project, called `pom-specialized.xml`, which points to the variant of the specialized the dependencies. Default value is: `false`.
`<createDependencySpecializedPerPom>`	`boolean`	If this is `true`, DepTrim creates one specialized version of the POM file per specialized dependency, called `pom-specialized-x-y.xml`, where `x` is an integer identifying a specialized dependency, and `y` is the total number of specialized dependencies. Default value is: `false`.
`<createAllPomSpecialized>`	`boolean`	If this is `true`, DepTrim creates all the combinations of specialized version of the original POM in the root of the project (i.e.,