Search papers, labs, and topics across Lattice.
This study introduces the Dependency Confidence Index (DCI), a composite score that integrates nine trust factors to evaluate the reliability of open-source software dependencies. By employing a systematic literature review and an Analytic Hierarchy Process (AHP) survey, the research identifies key dimensions such as security and project health that significantly influence trustworthiness. The DCI was pilot-tested on 92 popular PyPI packages, demonstrating moderate alignment with existing trust assessments and highlighting the importance of process-based factors in high-quality packages.
Trustworthiness in open-source dependencies can now be quantified with a single score that reveals critical insights into software supply chain security.
Selecting trustworthy open source software dependencies remains a major challenge in software supply chain security. We present the Dependency Confidence Index (DCI), a composite formative index that combines nine empirically weighted trust factors into a single normalized composite score for dependency selection. DCI's trust factors combine insights from a systematic literature review and an exploratory Analytic Hierarchy Process (AHP) survey of ten software developers, highlighting security, source code quality, and project health as the most influential dimensions. Following Goal-Question-Metric methodology, we implemented 12 automated measurements using SonarQube, GitHub APIs, and OpenSSF Scorecard data, deployed in a containerized evaluation platform. We conducted a pilot evaluation of the normalized DCI on 92 popular PyPI packages, observing moderate agreement with OpenSSF Scorecard scores and perfect test--retest reliability. Analysis reveals process-based factors (dependency management, CI) dominate scores on high-quality packages, while security metrics saturate---suggesting DCI's complementary role to existing tools. Our publicly available implementation provides a foundation for open source software trustworthiness research and practical dependency auditing.
