Insights from open source software supply chains
Insights from open source software supply chains
复制标题
来自开源软件供应链的见解
DOI：
10.1145/3338906.3342813
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Mockus, Audris
中科院分区：
文献类型：
--
作者：
Mockus, Audris
开放源码软件（OSS）构成了众多（通常是关键的）软件应用程序所基于的基础设施。大量的研究已经完成，以调查中心项目，如Linux内核，但我们只有有限的了解如何通过技术依赖，代码共享和知识流的更大的OSS生态系统的外围互连。我们的目标是缩小这一差距，a）创建一个几乎完整的和快速更新的FLOSS项目的版本控制数据的集合; B）通过清理，纠正，并增加数据来衡量代码，开发人员和项目之间的依赖关系的几种类型; c）通过创建依赖于所产生的供应链模型，以调查整个OSS的结构和动态属性。目前的实现能够每月更新，占用超过300 Tb的磁盘空间，有15亿次提交和12亿个git对象。高度精确的算法，以纠正身份数据和提取依赖性的源代码被用来表征当前的结构和开放源码软件的发展方式。特别是，技术传播模型展示了开发人员在选择软件组件时使用的隐含因素。我们希望由此产生的研究平台将刺激对OSS中的巨大外围如何维持和由中心OSS项目维持的调查，因此，将提高OSS的弹性和有效性。
Open Source Software (OSS) forms an infrastructure on which numerous (often critical) software applications are based. Substantial research was done to investigate central projects such as Linux kernel but we have only a limited understanding of how the periphery of the larger OSS ecosystem is interconnected through technical dependencies, code sharing, and knowledge flows. We aim to close this gap by a) creating a nearly complete and rapidly updateable collection of version control data for FLOSS projects; b) by cleaning, correcting, and augmenting the data to measure several types of dependencies among code, developers, and projects; c) by creating models that rely on the resulting supply chains to investigate structural and dynamic properties of the entire OSS. The current implementation is capable of being updated each month, occupies over 300Tb of disk space with 1.5B commits and 12B git objects. Highly accurate algorithms to correct identity data and extract dependencies from the source code are used to characterize the current structure of OSS and the way it has evolved. In particular, models of technology spread demonstrate the implicit factors developers use when choosing software components. We expect the resulting research platform will both spur investigations on how the huge periphery in OSS both sustains and is sustained by the central OSS projects and, as a result, will increase resiliency and effectiveness of the OSS.