Python 패키지 관리 도구 이질성이 TPL 설치 결과 일관성에 미치는 영향

초록

Python ecosystem supports a variety of package management tools, including hatch, pdm, pip, Pipenv, Poetry, and uv, and their differingoperational behaviors can lead to different sets of libraries being installed even during the same library installation process. This may affect thereproducibility and consistency of SBOM (Software Bill of Materials) generation results. However, prior studies have mainly focused on the accuracyand reproducibility of SBOM generation tools, and there has been limited research systematically comparing differences in installation results acrossPython package management tools. In this study, we constructed templates and isolated virtual environments for different package managers, addedthe same library under each condition, and compared the resulting installation outcomes. Experimental results showed that, due to differences ininitial project states, dependency resolution mechanisms, and related operational behaviors, the exact-match rate of TPL sets over the full set ofscenarios dropped as low as 80.21% for some tool pairs. In contrast, in comparable scenarios where both tools executed successfully, the averageJaccard similarity at the package-name level was at least 0.9972 for every tool pair, and the average version agreement rate for common packageswas also at least 0.9936. Nevertheless, the restricted exact-match rate based on package==version sets still fell to as low as 0.8989 for some tool pairs,indicating that a small number of missing or additional dependencies and differences in version concretization had an accumulative effect. Inaddition, comparisons of directional missing-package counts showed that some tools tend to concretize broader sets of transitive dependenciesthan others. Accordingly, for reproducible SBOM generation and consistent vulnerability analysis, it is necessary to record the package manager,the Python execution environment, and the actual installed TPL results, and to reconstruct the environment under the same conditions.

키워드