DROPS

Document

Emerging Results, Vision & Reflection Track Paper

DOI: 10.4230/LIPIcs.ESEM.2026.64

Software Supply Chains Are Dead: Use-Case-Oriented Regeneration

Authors: Tanmay Singla and James C. Davis

Published in: LIPIcs, Volume 394, 20th International Symposium on Empirical Software Engineering and Measurement (ESEM 2026)

Abstract

Modern software development relies on an increasingly doubtful premise: that the up-front implementation savings from adopting a dependency outweighs the maintenance costs. Two changes are reshaping the build-vs.-reuse calculus: software supply chain attacks have raised the cost of external reliance, while generative AI has lowered the cost of local implementation. In this vision paper, we discuss use-case-oriented regeneration as a new software sourcing paradigm that shifts the supply chain from external trust to local verification. We evaluate an agentic workflow that synthesizes only the specific slice of dependency functionality that a repository exercises. Our measurements across 180 repository-dependency pairs suggest that this approach is feasible: the replacements preserve 99.8% of repository-observed behavior across baseline validation checks and reduce the exported API surface by 93%. Software sourcing may evolve toward verifiable repository-specific code synthesis, especially when the required functionality is narrow, stable, and well tested.

Cite as

Tanmay Singla and James C. Davis. Software Supply Chains Are Dead: Use-Case-Oriented Regeneration. In 20th International Symposium on Empirical Software Engineering and Measurement (ESEM 2026). Leibniz International Proceedings in Informatics (LIPIcs), Volume 394, pp. 64:1-64:14, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026)

Copy BibTex To Clipboard

@InProceedings{singla_et_al:LIPIcs.ESEM.2026.64,
  author =	{Singla, Tanmay and Davis, James C.},
  title =	{{Software Supply Chains Are Dead: Use-Case-Oriented Regeneration}},
  booktitle =	{20th International Symposium on Empirical Software Engineering and Measurement (ESEM 2026)},
  pages =	{64:1--64:14},
  series =	{Leibniz International Proceedings in Informatics (LIPIcs)},
  ISBN =	{978-3-95977-450-5},
  ISSN =	{1868-8969},
  year =	{2026},
  volume =	{394},
  editor =	{Feldt, Robert and Paasivaara, Maria and Mendez, Daniel and Wagner, Stefan and Bar\'{o}n, Marvin Mu\~{n}oz},
  publisher =	{Schloss Dagstuhl -- Leibniz-Zentrum f{\"u}r Informatik},
  address =	{Dagstuhl, Germany},
  URL =		{https://drops.dagstuhl.de/entities/document/10.4230/LIPIcs.ESEM.2026.64},
  URN =		{urn:nbn:de:0030-drops-280327},
  doi =		{10.4230/LIPIcs.ESEM.2026.64},
  annote =	{Keywords: Software supply chain, dependency reuse, code generation, AI coding agents}
}

Search Results

Documents authored by Singla, Tanmay

Software Supply Chains Are Dead: Use-Case-Oriented Regeneration

Abstract

Cite as

Thanks for your feedback!

Could not send message