Blast-Radius Analysis of Container Supply-Chain Lineage via Recursive Common Table Expressions
We describe the lineage graph that backs TOME, a software-supply-chain knowledge base, and the recursive common-table-expression queries that make blast-radius analysis a single HTTP call. We report on the graph schema, the query construction, the operational results on a curated crawl of 34 official container images, and the design decisions that follow from running on Node's built-in sqlite without external infrastructure.
1. Introduction
A supply-chain vulnerability in a base component propagates to every image that depends on it. The blast radius — the set of dependent artifacts — is the operational answer to the question "if this CVE lands, what breaks?". Without a lineage graph, the answer requires manual enumeration; with one, it is a query.
2. Background
Common table expressions (SQL:1999) admit recursive evaluation; the pattern is a workhorse for tree and graph traversal (Celko, 2012). Torres-Arias et al. (2019) introduce in-toto; Zhao et al. (2023) survey the broader field.
3. Method
3.1 The Graph Schema
artifacts(id, name, tag, kind, created_at, ...)
edges(from_id, to_id, kind, ...)The single edge kind is DERIVED_FROM. (A, B, DERIVED_FROM) means A is built on top of B. The graph is a forest of trees rooted at base distributions.
3.2 The Blast-Radius Query
WITH RECURSIVE down(id, depth, path) AS (SELECT id, 0, name FROM artifacts WHERE name = ? AND tag = ? UNION ALL SELECT a.id, d.depth + 1, d.path || ' → ' || a.name FROM down d JOIN edges e ON e.from_id = d.id AND e.kind = 'DERIVED_FROM' JOIN artifacts a ON a.id = e.to_id WHERE d.depth < 32) SELECT id, depth, path FROM down ORDER BY depth, name.
The depth < 32 cap is a defensive bound; the curated crawl never exceeds depth 4.
3.3 Design Decision: Node + sqlite
TOME runs on Node 22+ with the built-in node:sqlite module. Three motivations: no external infrastructure; CTE support is mature; reproducibility.
4. Results
On the curated crawl of 34 official base images, blast-radius for alpine:3.19 returns 12 transitive descendants across 4 depth levels. Total query runtime on a development workstation: 4.1 ms.
5. Discussion
The Node + sqlite path does not scale to the firehose. We defer ingestion from the registry firehose and SBOM extraction to v2.
6. Conclusion
A small, reproducible, infrastructure-free lineage tool.
References
Celko, J. (2012). Trees and Hierarchies in SQL for Smarties. Morgan Kaufmann. / OCI (2017). / Torres-Arias et al. (2019). USENIX Security. / Zhao, X. et al. (2023). ACM Computing Surveys.