Build dependency checks get 54x faster with eBPF tracing

Computer scientists in Japan have built a tool that verifies software build dependencies far faster than earlier methods, by tracing system calls with eBPF instead of ptrace and by re-analyzing only the parts of a dependency graph that changed. According to The Register, mkcheck2 raises verification speed by as much as 54x.

Build dependencies describe which files a build system has to rebuild when another file changes. If that description is wrong, the build fails or produces an incorrect result.

Why dependency checks are expensive

In a paper presented at ICSE 2026, Yuta Saito and Hironori Washizaki of Waseda University, with Kazunori Sakamoto of Tokyo Online University, report that dependency-related errors, missing and redundant alike, account for more than 50% of build errors in large-scale projects.

The established detection method, ptrace, runs in user space, so it suspends the traced process and switches context for every system call it observes. The authors measured an average build-time overhead of 101.7% for the earlier mkcheck tool and 148.0% for BuildFS.

eBPF plus incremental analysis

mkcheck2 uses two techniques instead. Its Build Tracer runs eBPF programs inside the kernel, filtering system calls in real time without ptrace's context switches. A dependency graph builder turns traced file operations into a representation of the dependencies a build actually used, and keeps their history. An incremental analyzer then compares graphs from different builds, checking only the parts that changed instead of every edge.

Washizaki says ptrace-based detection is accurate but creates high overhead because it requires frequent process suspensions and context switches. "Our approach utilizes eBPF, a lightweight system call monitoring technology, combined with incremental analysis to significantly reduce verification time."

Results and limits

The evaluation covered 300 open-source projects, including the Make corpus used by BuildFS. Project-averaged build overhead fell to 0.3% of the baseline, against 101.7% and 148.0% for the ptrace-based tools, a reduction the authors put at up to 99.7%. Mean analysis time per commit dropped from 1267.49 seconds to 23.56 seconds, and over ten successive commits mkcheck2 was 75-80% faster.

Accuracy held: the authors report 100% recall for the corpus's 15,740 missing dependencies and 92% for its 11,720 redundancies, with no false positives. One limitation stands out. The tool needs a modern Linux kernel with eBPF support and privileges such as CAP_SYS_ADMIN to load tracing programs. Washizaki said the technology could matter in "cloud and AI infrastructure, where rapid verification during continuous integration is essential."