Investigating software artifact provenance

“出处”是一个来自艺术的术语，描述了一系列关于艺术作品历史或所有权的证据。 特定对象的来源可能包括可信的文档、材料和艺术风格的特殊目的分析以及一般历史知识。 该术语也越来越多地用于计算机安全等技术背景中，其中第三方组件的来源-通常通过加密和可信审计跟踪等机制确定-可以确定如何允许组件访问机密数据和系统的运行时环境。 然而，随着软件系统变得越来越普遍，故障、恶意软件、违反许可证和专利诉讼的风险要求我们谨慎对待各种软件实体的来源。 我们不仅要检查可执行组件，还要检查所有影响软件系统及其创建的开发工件。 我们必须问：这个类定义、库、特性、bug修复是从哪里来的？ 它是如何随着时间的推移而演变的？ 证据是什么？ 也就是说，我们必须确定艺术品的来源。 本研究计划的目的是结晶的想法，起源分析的软件开发工件。 该计划将研究用于建立各种软件开发工件的起源的技术，包括基于源代码的实体，如函数，文件和类;派生工件，如库和二进制文件;需求空间实体，如功能，讨论主题和质量属性;和开发工件，如测试套件，维护任务和错误报告。 它将建立在我自己和其他人在几个相关问题领域的先前工作的基础上，以综合一套更高级别的技术来分析软件工件的起源，作为一个统一的学科。

"Provenance" is a term from the arts that describes a set of evidence concerning the history or ownership of an artistic work. The provenance for a particular object may include trusted documentation, special purpose analyses of the materials and artistic styles, and general historical knowledge. Increasingly, the term is also being used in technical contexts such as in computer security, where the provenance of a third-party component -- often determined through mechanisms such as cryptography and trusted audit trails -- may determine how the component is allowed to access confidential data and the system's run-time environment. However, as software systems become more pervasive, the risk of failure, malware, license violations, and patent lawsuits requires us to be circumspect about where various kinds of software entities come from. We must examine not only executable components, but all development artifacts that impact upon the software system and its creation. We must ask: Where did this class definition, library, feature, bug fix originate? How has it evolved over time? And what is the evidence? That is, we must ascertain the artifact's provenance. This research program aims to crystalize the idea of provenance analysis of software development artifacts. This program will investigate techniques for establishing the provenance of various kinds of software development artifacts including source-code-based entities such as functions, files, and classes; derived artifacts such as libraries and binaries; requirements-space entities such as features, discussion topics, and quality attributes; and development artifacts such as test suites, maintenance tasks, and bug reports. It will build on previous work of myself and others in several related problem areas to synthesize a higher level set of techniques for analyzing software artifact provenance as a unified discipline.