DCI: Dependency Confidence Index for Assessing Open-Source Dependency Trustworthiness
2026-08-17 • Software Engineering
Software EngineeringCryptography and Security
AI summaryⓘ
The authors developed the Dependency Confidence Index (DCI) to help decide which open source software packages are trustworthy to use. They combined nine trust factors related to security, code quality, and project health into one score using automated tools like SonarQube and GitHub data. Testing the DCI on popular Python packages showed it agreed moderately with existing security scores but added new insights, especially around project processes. Their tool is available publicly to support better software dependency choices.
software supply chain securityopen source softwaredependency managementanalytic hierarchy process (AHP)Goal-Question-Metric (GQM) methodologySonarQubeOpenSSF Scorecardcontinuous integration (CI)software quality metricsPyPI packages
Authors
Clemens Albrecht, Stefan Reitmann
Abstract
Selecting trustworthy open source software dependencies remains a major challenge in software supply chain security. We present the Dependency Confidence Index (DCI), a composite formative index that combines nine empirically weighted trust factors into a single normalized composite score for dependency selection. DCI's trust factors combine insights from a systematic literature review and an exploratory Analytic Hierarchy Process (AHP) survey of ten software developers, highlighting security, source code quality, and project health as the most influential dimensions. Following Goal-Question-Metric methodology, we implemented 12 automated measurements using SonarQube, GitHub APIs, and OpenSSF Scorecard data, deployed in a containerized evaluation platform. We conducted a pilot evaluation of the normalized DCI on 92 popular PyPI packages, observing moderate agreement with OpenSSF Scorecard scores and perfect test--retest reliability. Analysis reveals process-based factors (dependency management, CI) dominate scores on high-quality packages, while security metrics saturate---suggesting DCI's complementary role to existing tools. Our publicly available implementation provides a foundation for open source software trustworthiness research and practical dependency auditing.