File-Level Copying Is an Implicit Dependency in Open Source

• URL: http://arxiv.org/abs/2607.02059v1
• Date: Thu, 02 Jul 2026 11:37:59 GMT
• Title: File-Level Copying Is an Implicit Dependency in Open Source
• Abstract summary: Copying files across repositories removes four observable signals a package manager provides for a declared dependency.<n>From a 0.1% commit sample, we extract 690,500 copy events and retain 3,912 rationale-bearing copy commits for intent labeling.<n>We show that the 13 axial copy forms, spanning vendored dependencies, hardware/driver synchronization, scaffolding, UI assets, and direct source-code reuse, are unreliable proxies for developer intent.
• Score: 13.844153992502159
• License: http://creativecommons.org/licenses/by-sa/4.0/
• Abstract: File-level copying is a widespread but ungoverned form of software reuse. Copying files across repositories reduces supply-chain visibility: it removes the four observable signals a package manager provides for a declared dependency (provenance, maintenance, security, and compliance) with no mechanism to restore them. To characterize the scale and consequences of this unmanaged reuse, we present a mixed-method study of copying across the entire open-source ecosystem using World of Code (WoC). From a 0.1% commit sample, we extract 690,500 copy events and retain 3,912 rationale-bearing copy commits for intent labeling. We show that the 13 axial copy forms, spanning vendored dependencies, hardware/driver synchronization, scaffolding, UI assets, and direct source-code reuse, are unreliable proxies for developer intent: among rationale-bearing commits, hardware/driver copies are predominantly fork-maintenance work (78%), while dependency-vendoring copies more often signal upstream bypass (70%) than offline availability. These visibility gaps are form-specific: security and license risk concentrate in complementary copy forms. Copied sources are frequently stale (median 155 days; 38.5% over one year old) and seldom record a recoverable origin (4.3% documented), let alone a checkable version (2.0% versioned); even vendored copies record where they came from only 10% of the time. Security risk concentrates in vendored dependencies: 17,314 CVE-risk copy commits in the full-WoC graph, 88% in the dependency-vendoring form; 80% score CVSS >= 7.0 and upstream-fix adoption is only 47%-84%. License risk concentrates in direct source-code reuse: 41,777 pre-validation candidates, 66% in the source-code form, with 39 verified high-star violations (kappa = 0.752). Both risks reach packaged software and are invisible to dependency scanners operating on declared metadata alone.

Related papers

• AcquireBound: Runtime Authorization for Resources Acquired by AI Agents [0.0]
  Post-fulfillment activation gap spans tool-mediated creation, inter-agent delegation, and agentic commerce.<n>We present AcquireBound, a provenance-bounded runtime authorization architecture.<n>We prove eight safety properties covering quarantine, backing, non-amplification, split non-evasion, crash/retry, refunds, epochs, and effect confinement.
  arXiv  Detail & Related papers  (2026-09-13T19:16:44Z)
• Scanning the Harness: An Empirical Study of Supply-Chain Defects in AI Coding-Agent Configurations [0.0]
  AI coding agents such as Claude Code, Cursor, GitHub Copilot, and OpenAI Codex are configured through artifacts developers write and share.<n>This harness is a dependency layer installed from marketplaces and public repositories, running with the developer's privileges.<n>We study it over 3,171 public GitHub repositories: 2,660 setups that assemble two or more component types and 511 published skill collections.
  arXiv  Detail & Related papers  (2026-09-07T11:27:24Z)
• Ensuring Open Source Integrity: The Intersection of Copy-Based Reuse and License Compliance [11.111309839462814]
  We create a copy-based code reuse network mapping direct copying across projects.<n>We find that code in repositories with permissive licenses, such as MIT and Apache, shows higher likelihood of reuse.<n>Public domain licenses, despite their aim of allowing unrestricted use, are associated with lower likelihood of copy-based reuse.
  arXiv  Detail & Related papers  (2026-06-22T15:44:06Z)
• Correct Code, Vulnerable Dependencies: A Large Scale Measurement Study of LLM-Specified Library Versions [52.50730821321986]
  We present the first large-scale measurement study of version-level risk in large language models (LLMs)<n>We evaluate 10 LLMs on PinTrace, a curated benchmark of 1,000 Stack Overflow programming tasks.<n>Our findings reveal LLM version selection as a first-class, previously overlooked risk surface in LLM-based development.
  arXiv  Detail & Related papers  (2026-05-07T13:52:59Z)
• Constraint-Guided Multi-Agent Decompilation for Executable Binary Recovery [47.704311990064554]
  Decompilation is essential for security analysis, malware reverse engineering, and legacy software maintenance.<n>We present a multi-agent framework that transforms decompiled code into re-executable source through Multi-level Constraint-Guided Decompilation (MCGD)<n>Our framework achieves 84-97% re-executability, improving baseline decompiler output by 28-89 percentage points.
  arXiv  Detail & Related papers  (2026-04-27T01:28:11Z)
• What Papers Don't Tell You: Recovering Tacit Knowledge for Automated Paper Reproduction [57.86097956633207]
  method is a graph-based agent framework for generating executable code from academic papers.<n>On an extended ReproduceBench spanning 3 domains, 10 tasks, and 40 recent papers, method achieves an average performance gap of 10.04% against official implementations.
  arXiv  Detail & Related papers  (2026-03-02T12:33:31Z)
• Permissive-Washing in the Open AI Supply Chain: A Large-Scale Audit of License Integrity [12.206378714907075]
  Permissive licenses like MIT, Apache-2.0, and BSD-3-Clause dominate open-source AI.<n>Permissive washing: labeling AI artifacts as free to use, while omitting the legal documentation required to make that label actionable.<n>We audit 124,278 dataset $rightarrow$ model $rightarrow$ application supply chains, spanning 3,338 datasets, 6,664 models, and 28,516 applications across Hugging Face and GitHub.
  arXiv  Detail & Related papers  (2026-02-09T15:51:36Z)
• Anchored Decoding: Provably Reducing Copyright Risk for Any Language Model [99.16364381244445]
  Modern language models (LMs) tend to memorize portions of their training data and emit verbatim spans.<n>We propose Anchored Decoding, a plug-and-play inference-time method for suppressing verbatim copying.<n>We evaluate our methods across six model pairs on long-form evaluations of copyright risk and utility.
  arXiv  Detail & Related papers  (2026-02-06T19:00:14Z)
• Trace: Securing Smart Contract Repository Against Access Control Vulnerability [58.02691083789239]
  GitHub hosts numerous smart contract repositories containing source code, documentation, and configuration files.<n>Third-party developers often reference, reuse, or fork code from these repositories during custom development.<n>Existing tools for detecting smart contract vulnerabilities are limited in their ability to handle complex repositories.
  arXiv  Detail & Related papers  (2025-10-22T05:18:28Z)
• CopyBench: Measuring Literal and Non-Literal Reproduction of Copyright-Protected Text in Language Model Generation [132.00910067533982]
  We introduce CopyBench, a benchmark designed to measure both literal and non-literal copying in LM generations. We find that, although literal copying is relatively rare, two types of non-literal copying -- event copying and character copying -- occur even in models as small as 7B parameters.
  arXiv  Detail & Related papers  (2024-07-09T17:58:18Z)
• Dataset: Copy-based Reuse in Open Source Software [5.917654223291073]
  In Open Source Software, the source code and any other resources available in a project can be viewed or reused by anyone subject to often permissive licensing restrictions. This dataset seeks to encourage the studies of OSS-wide copy-based reuse by providing copying activity data that captures whole-file reuse in nearly all OSS.
  arXiv  Detail & Related papers  (2023-12-14T22:08:09Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.