sootup-wrapper

sootup-wrapper contains the Java implementation, tests, and build pipeline for the SootUp-based call graph generator used by Debricked reachability analysis.

This repository is intentionally separate from the CLI repository so the wrapper can be developed, tested, and versioned independently.

What this repo provides

• A runnable Java wrapper: com.debricked.sootup.SootUpWrapper
• A shaded (fat) JAR artifact: SootUpWrapper.jar
• Maven-based build and test setup
• CI workflow for validation

Repository structure

java/common/
├─ pom.xml
└─ src/
   ├─ main/java/com/debricked/sootup/SootUpWrapper.java
   └─ test/java/com/debricked/sootup/SootUpWrapperTest.java

Prerequisites

• Java 11+ (project is compiled to Java 11 bytecode)
• Maven 3.8+

Build

From repository root:

mvn -f java/common/pom.xml clean package

Generated artifact:

java/common/target/sootup-wrapper-1.0.0.jar

This JAR includes all required dependencies (shade plugin) and can be executed directly.

Test

mvn -f java/common/pom.xml test

Local usage

Example:

java -jar java/common/target/sootup-wrapper-1.0.0.jar \
  -u /path/to/compiled/classes \
  -l /path/to/dependency/jars \
  -f debricked-call-graph.java

Supported flags:

• -u <dir>: user class directory (repeatable)
• -l <dir>: dependency JAR directory (optional)
• -f <file>: output file path (default: debricked-call-graph.java)
• -a <algo>: algorithm (rta or cha, default rta)

Output

The wrapper writes a Debricked call graph JSON payload (version 5) to the output file.

How CLI consumes this

The CLI does not own this Java source. It consumes the built wrapper artifact and uses it when the Java callgraph engine is set to sootup.

In CLI release/build flow:

1. Build this project (java/common)
2. Take the produced JAR
3. Embed/copy it into CLI packaging input (SootUpWrapper.jar)

Notes

• Do not commit extracted dependency trees like sootup/core, cache, frontend, etc. Those are dependency artifacts, not maintained source code.
• Keep API/CLI compatibility stable for wrapper flags so CLI integration remains seamless.