# Compiled Dependencies Are Invisible to Manifest-Based Analysis ## Claim A dependency tree built from a project's manifest misses compiled, non-source dependencies of its dependencies, leaving companies exposed to vulnerabilities their own tooling cannot detect. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Applies wherever a package manager's manifest declares source-level dependencies but a dependency internally links or shells out to a compiled artifact (C libraries, native extensions, vendored binaries) that isn't itself declared. - The worked example is Python-specific (NumPy depending on OpenBLAS, written in C and consumed compiled) but the mechanism generalizes to any ecosystem with native extensions — PHP extensions and bundled image libraries are a direct analogue. - Does not claim manifest-based SBOMs are useless, only that they are incomplete by construction wherever this pattern exists — a manifest-derived SBOM should be labeled as a partial inventory, not a complete one. - Standards work is in progress to close part of this gap (Python PEPs drafted to allow declaring external/binary dependencies in `pyproject.toml`), so the invisibility is a current-tooling problem, not a permanent architectural one. ## Evidence A dependency chain example: Python code depends on NumPy's declared source; NumPy in turn depends on OpenBLAS, which is written in C and consumed in compiled form. Because OpenBLAS never appears as a source dependency in any manifest, standard dependency-tree analysis — the basis for most automated SBOM tooling — cannot see it. If OpenBLAS carries a security vulnerability, every downstream consumer is exposed with no automated way to detect the exposure from their own manifest. ## Links - [[3. Resources/Permanent Notes/Supply-Chain Defense Tracks Bad Actors Not Bad Code]] — applies-in: this is a concrete instance of a supply-chain visibility gap that exists independent of any actor's intent — the risk comes from tooling blindness, not malice. - [[3. Resources/MOCs/Open Source Governance MOC]] — applies-in: names a specific, testable audit action (check for compiled dependencies your manifest doesn't declare) rather than a general funding-ethics argument. - [[3. Resources/Permanent Notes/WordPress Stores AI API Keys in a Layer Its Own Security Team Says It Cannot Encrypt]] — contrasts: both are cases where a security gap is known and named internally but remains outside what standard tooling checks for; one is a manifest-visibility gap, the other is an encryption-layer gap. ## Tests / falsifiers - Audit a sample of popular packages: build the actual compiled artifact tree and compare it against the declared manifest. If declared manifests already capture the compiled dependencies in a meaningful fraction of cases, the claim's practical severity is smaller than presented. - Track mean time-to-remediation for vulnerabilities in binary/compiled dependencies versus source dependencies. If remediation times are comparable, the visibility gap may not translate into a real-world delay. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Articles/Episode 292 Vlad-Stefan Harbuz Launching the Software Stewardship Lab]] — the NumPy/OpenBLAS worked example. - [[3. Resources/Literature Notes/Sustain Episode 292 — Vlad-Stefan Harbuz - Launching the Software Stewardship Lab]] — Literature Note with full claim atoms.