New software dependency validation process increases speeds by 54x

As if the pace of software creation hadn't accelerated enough thanks to generative AI coding agents, computer scientists in Japan have devised a way to turbocharge the process of build dependency verification. Speeds can increase by as much as 54x. Software build systems like Make, CMake, and the Zig build system automate the process of turning source code into executable programs. They ensure source files are compiled in the correct order and objects are linked correctly. They provide reproducible rebuilds and handle platform-specific compilation requirements, dependencies, tests, and documentation. But according to Yuta Saito, Kazunori Sakamoto, and Hironori Washizaki from Waseda University, dependency specification management remains a challenge, accounting for more than half of all build errors in large projects. Because existing tools like ptrace impose significant overhead, the researchers have devised a way to improve error detection by analyzing dependencies using extended Berkeley Packet Filter (eBPF)-based system call tracing. They've developed a tool called mkcheck2 that reduces the time and compute cost required to catch software build errors. And they explain their approach in a paper titled "Efficient Build Dependency Verification Using eBPF and Incremental Analysis," published in the Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering. "Our evaluation on a diverse set of open-source projects demonstrates that mkcheck2 reduces the overhead of dependency error detection by up to 99.7 percent compared to existing ptrace-based approaches while maintaining detection accuracy," the authors explain. "Across the entire 300-project Make corpus, the incremental analysis technique lowers the mean analysis time per commit from 1267.49 seconds to just 23.56 seconds, making continuous dependency verification practical in real-world development environments." That's about 54x faster per commit. The researchers say their eBPF-based system call tracer largely avoids the performance overhead imposed by ptrace. eBPF allows sandboxed programs to run within kernel space, where they can perform tasks involving networking, observability, security, and other low-level operations. It's been used for efficiency gains in services like Meta's Strobelight. "By executing tracing code directly in kernel space, we can monitor build processes with minimal impact on build performance," the authors explain in their paper. "Unlike ptrace, which requires process suspension and context switches for each system call, our eBPF-based approach provides non-invasive tracing by operating entirely within the kernel." The authors note that their approach has some limitations. The eBPF-tracing system is Linux-specific, so build systems for other operating systems can't expect the same gains. And there are various build-system scenarios that still present challenges, such as some kinds of redundant dependencies, tracking access to memory-mapped regions, visibility into dependencies for dynamically loaded libraries, network dependencies, and distributed build systems. Nonetheless, the potential for mkcheck2 to cut the overhead of dependency error detection by up to 99.7 percent compared to ptrace-based approaches promises to save a lot of time. (R)