Reducing Deployment Costs for Compile-Time Variants by Static Analysis

Tobias Landsberg (Leibniz Universität Hannover)

Deploying software updates is a costly endeavor for both vendors and customers.
Each update requires building, testing and possibly verifying the software on
the vendor's end. For the customer, an update may result in a disruption of
service with all its costs. In practice, this is one of the reasons for "patch
gaps." In an environment of statically configurable software, where each
customer has its specific configuration resulting in its own variant, the costs
scale with the number of customers.

To reduce these costs, we propose a two-step approach. First, instead of
updating all variants every time, we exclusively deploy updates to variants
affected by a patch. Second, we lower the costs for each required update by
identifying similarities between variants to reduce the number of unit-test
executions.

Our evaluation shows that in the first step, out of 200 patches for OpenSSL,
44% of deployments can be omitted for a set of 15 configurations. For the
seconds step, we can skip 66% of test executions (100 patches).