Expand thesis with new topics on dependency management

Added new sections on hermetic build tools and dependency fingerprinting to the thesis.

Author: algomaster99

master-thesis.md

@@ -127,6 +127,40 @@ trustworthy software systems.</p>
 <li > <a href="https://github.com/rschwietzke/jmh-C2-compile">https://github.com/rschwietzke/jmh-C2-compile</a> </li>
 </ol>
 
+### Beyond Declared Dependencies: The Limits of Hermetic Build Tools
+Contact: Aman Sharma
+
+Tools like [Hermeto][herm1] promise hermetic container builds by prefetching all declared dependencies before network isolation kicks in. In theory, the build runs against a closed, auditable set of inputs. In practice, the hermetic guarantee is layered and partial: Hermeto addresses the *declared dependency layer* — what appears in lockfiles like `package-lock.json`, `Cargo.lock`, or `requirements.txt` — but leaves the *toolchain and native dependency layer* to the user. Nix offers a theoretically stronger model: content-addressed derivations, sandboxed builds, and a store that captures the full dependency closure including compilers and system libraries. An ecosystem of automated translation tools — `dream2nix`, `poetry2nix`, `cargo2nix` [2] — attempts to generate these derivations from standard lockfiles, but the two models rest on different assumptions about what a hermetic boundary even means.
+
+This thesis investigates the *hermetic gap*: the delta between what a tool declares as its dependency set and what a build actually consumes. The central question is whether Nix's stronger closure model translates into a meaningfully tighter boundary in practice, and what classes of dependencies — undeclared system libraries, toolchain leakage, native extension bindings, implicit platform assumptions — fall outside the boundary regardless of which model is used.
+
+Related Work:
+
+[1] [Hermeto — prefetch CLI for hermetic container builds](https://github.com/hermetoproject/hermeto)
+
+[2] [dream2nix — automated Nix derivation generation from package manager metadata](https://github.com/nix-community/dream2nix)
+
+[3] [Zheng, Adams, Hassan — On Build Hermeticity in Bazel-Based Build Systems, IEEE Software 2025](https://mcislab.github.io/publications/2025/ieeesw-shenyu.pdf)
+
+[4] [Lamb & Zacchiroli — Reproducible Builds: Increasing the Integrity of Software Supply Chains, IEEE Software 2021](https://arxiv.org/pdf/2104.06020)
+
+[5] [SLSA — Supply-chain Levels for Software Artifacts framework](https://slsa.dev/)
+
+[6] [The Design Space of Lockfiles Across Package Managers, Empirical Software Engineering 2025](https://arxiv.org/abs/2505.04834)
+
+[herm1]: https://github.com/hermetoproject/hermeto
+
+
+### Dependency Fingerprinting: Reconstructing Full Dependency Trees from Partial Observations
+Contact: Aman Sharma, Eric Cornelissen
+
+Package registries expose rich dependency metadata, but in some settings (e.g., private registries, zero-knowledge SBOMs, or obfuscated build manifests) only a subset of a package's dependencies is known.
+This thesis investigates how much of a package's full dependency tree can be inferred from a partial observation of its dependencies.
+Given a set of seed dependencies — a few known direct or transitive packages — the goal is to reconstruct the remaining dependency graph using statistical co-occurrence patterns mined from public registries.
+The study will evaluate inference accuracy as a function of the number and "uniqueness" of seed packages, and compare reconstruction fidelity across ecosystems (Maven, NPM, Go, Rust).
+The results have direct implications for the privacy guarantees of partial SBOM disclosures and zero-knowledge proofs over dependency sets.
+
+
 ### Cross-Ecosystem Dependency Resolution: Applying Foreign Resolver Algorithms Across Build Toolchains
 Contact: Aman Sharma
 
@@ -243,41 +277,6 @@ The stages of package installation
 </ol>
 
 
-### Beyond Declared Dependencies: The Limits of Hermetic Build Tools
-Contact: Aman Sharma
-
-Tools like [Hermeto][herm1] promise hermetic container builds by prefetching all declared dependencies before network isolation kicks in. In theory, the build runs against a closed, auditable set of inputs. In practice, the hermetic guarantee is layered and partial: Hermeto addresses the *declared dependency layer* — what appears in lockfiles like `package-lock.json`, `Cargo.lock`, or `requirements.txt` — but leaves the *toolchain and native dependency layer* to the user. Nix offers a theoretically stronger model: content-addressed derivations, sandboxed builds, and a store that captures the full dependency closure including compilers and system libraries. An ecosystem of automated translation tools — `dream2nix`, `poetry2nix`, `cargo2nix` [2] — attempts to generate these derivations from standard lockfiles, but the two models rest on different assumptions about what a hermetic boundary even means.
-
-This thesis investigates the *hermetic gap*: the delta between what a tool declares as its dependency set and what a build actually consumes. The central question is whether Nix's stronger closure model translates into a meaningfully tighter boundary in practice, and what classes of dependencies — undeclared system libraries, toolchain leakage, native extension bindings, implicit platform assumptions — fall outside the boundary regardless of which model is used.
-
-Related Work:
-
-[1] [Hermeto — prefetch CLI for hermetic container builds](https://github.com/hermetoproject/hermeto)
-
-[2] [dream2nix — automated Nix derivation generation from package manager metadata](https://github.com/nix-community/dream2nix)
-
-[3] [Zheng, Adams, Hassan — On Build Hermeticity in Bazel-Based Build Systems, IEEE Software 2025](https://mcislab.github.io/publications/2025/ieeesw-shenyu.pdf)
-
-[4] [Lamb & Zacchiroli — Reproducible Builds: Increasing the Integrity of Software Supply Chains, IEEE Software 2021](https://arxiv.org/pdf/2104.06020)
-
-[5] [SLSA — Supply-chain Levels for Software Artifacts framework](https://slsa.dev/)
-
-[6] [The Design Space of Lockfiles Across Package Managers, Empirical Software Engineering 2025](https://arxiv.org/abs/2505.04834)
-
-[herm1]: https://github.com/hermetoproject/hermeto
-
-
-### Dependency Fingerprinting: Reconstructing Full Dependency Trees from Partial Observations
-Contact: Aman Sharma, Eric Cornelissen
-
-Package registries expose rich dependency metadata, but in some settings (e.g., private registries, zero-knowledge SBOMs, or obfuscated build manifests) only a subset of a package's dependencies is known.
-This thesis investigates how much of a package's full dependency tree can be inferred from a partial observation of its dependencies.
-Given a set of seed dependencies — a few known direct or transitive packages — the goal is to reconstruct the remaining dependency graph using statistical co-occurrence patterns mined from public registries.
-The study will evaluate inference accuracy as a function of the number and "uniqueness" of seed packages, and compare reconstruction fidelity across ecosystems (Maven, NPM, Go, Rust).
-The results have direct implications for the privacy guarantees of partial SBOM disclosures and zero-knowledge proofs over dependency sets.
-
-
-