Open Source Software Ecosystems Research Articles

The Need to Develop Open Source Software Ecosystem: Library Professional’s Perspective

To stay ahead in the competition and to hold users to themselves, proprietary software and hardware vendors develop their closed ecosystems. Seamless interconnection of devices and easy inter-operability are thus implemented for a closed circle of users and provide a niggle free experience in using applications across devices and offer seamless data transfer across devices and applications. Microsoft, Apple, and Google are integrating this strategy on all their devices and products. It is the need of the hour, for open-source software proponents and developers to rise to the occasion to combat the monopolistic tendencies that hinder openness. Library professionals who have either adopted Open-Source Software (OSS) or information professionals who are on the verge of moving in the direction of OSS need to consider investing time, effort, and resources in developing and sustaining a counter movement with an alternate OSS ecosystem.

Open and reusable deep learning for pathology with WSInfer and QuPath

Digital pathology has seen a proliferation of deep learning models in recent years, but many models are not readily reusable. To address this challenge, we developed WSInfer: an open-source software ecosystem designed to streamline the sharing and reuse of deep learning models for digital pathology. The increased access to trained models can augment research on the diagnostic, prognostic, and predictive capabilities of digital pathology.

Modeling interconnected social and technical risks in open source software ecosystems

Open source software ecosystems consist of thousands of interdependent libraries, which users can combine to great effect. Recent work has pointed out two kinds of risks in these systems: that technical problems like bugs and vulnerabilities can spread through dependency links, and that relatively few developers are responsible for maintaining even the most widely used libraries. However, a more holistic diagnosis of systemic risk in software ecosystem should consider how these social and technical sources of risk interact and amplify one another. Motivated by the observation that the same individuals maintain several libraries within dependency networks, we present a methodological framework to measure risk in software ecosystems as a function of both dependencies and developers. In our models, a library’s chance of failure increases as its developers leave and as its upstream dependencies fail. We apply our method to data from the Rust ecosystem, highlighting several systemically important libraries that are overlooked when only considering technical dependencies. We compare potential interventions, seeking better ways to deploy limited developer resources with a view to improving overall ecosystem health and software supply chain resilience.

What Constitutes the Deployment and Runtime Configuration System? An Empirical Study on OpenStack Projects

Modern software systems are designed to be deployed in different configured environments (e.g., permissions, virtual resources, network connections) and adapted at runtime to different situations (e.g., memory limits, enabling/disabling features, database credentials). Such a configuration during the deployment and runtime of a software system is implemented via a set of configuration files, which together constitute what we refer to as a “configuration system.” Recent research efforts investigated the evolution and maintenance of configuration files. However, they merely focused on a limited part of the configuration system (e.g., specific infrastructure configuration files or Dockerfiles), and their results do not generalize to the whole configuration system. To cope with such a limitation, we aim to better capture and understand what files constitute a configuration system. To do so, we leverage an open card sort technique to qualitatively study 1,756 configuration files from OpenStack, a large and widely studied open source software ecosystem. Our investigation reveals the existence of nine types of configuration files, which cover the creation of the infrastructure on top of which OpenStack will be deployed, along with other types of configuration files used to customize OpenStack after its deployment. These configuration files are interconnected while being used at different deployment stages. For instance, we observe specific configuration files used during the deployment stage to create other configuration files that are used in the runtime stage. We also observe that identifying and classifying these types of files is not straightforward, as five out of the nine types can be written in similar programming languages (e.g., Python and Bash) as regular source code files. We also found that the same file extensions (e.g., Yaml ) can be used for different configuration types, making it difficult to identify and classify configuration files. Thus, we first leverage a machine learning model to identify configuration from non-configuration files, which achieved a median area under the curve (AUC) of 0.91, a median Brier score of 0.12, a median precision of 0.86, and a median recall of 0.83. Thereafter, we leverage a multi-class classification model to classify configuration files based on the nine configuration types. Our multi-class classification model achieved a median weighted AUC of 0.92, a median Brier score of 0.04, a median weighted precision of 0.84, and a median weighted recall of 0.82. Our analysis also shows that with only 100 labeled configuration and non-configuration files, our model reached a median AUC higher than 0.69. Furthermore, our configuration model requires a minimum of 100 configuration files to reach a median weighted AUC higher than 0.75.

METHODS: A meta-path-based method for heterogeneous community detection in the open source software ecosystem

Detecting communities in the open source software (OSS) ecosystem can help understand the collaborations in the open source software ecosystem and promote an understanding of the dynamics of the ecosystem. However, most existing community detection methods are designed for homogeneous networks, whereas the OSS ecosystem is a heterogeneous network. Therefore, we propose a meta-path-based method for heterogeneous community detection in the OSS ecosystem (METHODS). METHODS comprises four steps. Firstly, a heterogeneous information network is constructed based on meta-paths. Secondly, the Canopy algorithm is used to obtain the number of initial communities. Thirdly, the skip-gram model is used to identify seed nodes for community detection. Finally, METHODS detects heterogeneous communities around the seed nodes. By defining a series of evaluation metrics and verifying these on GitHub datasets, METHODS achieves the best performance of all the other methods. Moreover, the case studies on GitHub also shows METHODS can discover latent communities whose members are potentially relevant.

Comprehensive assessment of open source software ecosystem health

Recent surveys expose that the use of Open Source Software (OSS) is increasingly becoming a need for organizations in their development projects. However, deciding a proper OSS to be adopted or to contribute to its development is a complex and error-prone task. Analyzing the OSS ecosystem (OSSECO) health may help providing information about: (1) the OSS itself (number of commits, days after the last release, etc.); and (2) their main actors (number of contributors, partners, etc.). There exist proposals that go further and provide aggregated high-level indicators (e.g. visibility as an aggregation of number of community events, number of partners, and other metrics). Nevertheless, there is a lack of useful OSSECO analysis tools to ease the decision making on which OSSECO has the health required by a potential OSS adopter or contributor. In this work, we provide OSS-CARE (OSSeCo heAlthy monitoR and analysEr), an OSS-independent, fully automatic, and real-time framework to assess OSSECO’s health. OSS-CARE supports defining the ecosystem health objectives of potential OSS adopters, OSS contributors, and even OSS managers to inspect their provided health. These objectives are defined based on a well-established model characterizing health metrics that can be potentially aggregated by using a Bayesian network technique. Moreover, the integrated monitoring and analysis components perform an automated assessment of OSSECO’s health by checking the fulfillment of the required health objectives. Furthermore, the result is shown in an appealing dashboard that may ease the complex decision making of which OSS to choose.

Open-source electronics ecosystem for optical atomic clocks

We present an open-source hardware and software ecosystem for optical atomic clocks. We provide PCB schematics and fabrication files for manufacturing the most important electronic systems together with the required software. The boards are designed for an active bad-cavity superradiant strontium clock and a passive optical lattice strontium clock, but they can be easily adapted to other atomic species’ optical atomic clocks or ultra-cold atoms’ systems like magneto-optical traps or Bose–Einstein condensate setups.

Organizational Influencers in Open-Source Software Projects

Traditional software development is shifting toward the open-source development model, particularly in the current environment of competitive challenges to develop software openly. The author employs a case study approach to investigate how organizations and their affiliated developers collaborate in the open-source software (OSS) ecosystem TensorFlow (TF). The analysis of the artificial intelligence OSS library TF combines social network analysis (SNA) and an examination of archival data by mining software repositories. The study looks at the structure and evolution of code-collaboration among developers and with the ecosystem's organizational networks over the TF lifespan. These involved organizations play a particularly critical role in development. The research also looks at productivity, homophily, development, and diversity among developers. The results deepen the understanding of OSS communities' collaborative developer and organization patterns. Furthermore, the study emphasizes the importance and evolution of social networks, diversity, and productivity in ecosystems.

OSS in Software Engineering Education

Software Engineering is a crucial topic in undergraduate computing-related courses and provides the basic knowledge and skills necessary for professional practice in the software industry. Teaching Software Engineering principles, concepts, and practices and relating them to real-world scenarios are challenging tasks, and the adoption of Open Source Software (OSS) projects can help to face these challenges. On the other hand, adopting OSS projects as a didactic resource may introduce additional challenges to instructors who are not familiar with the OSS ecosystem. Objective: In this paper, we identified and mapped the profiles of instructors of Software Engineering courses concerning their classroom practices and use of OSS projects in Software Engineering Education. Method: We surveyed 90 higher education instructors in Brazil to collect data regarding their familiarity with the Software Engineering knowledge areas, pedagogical methods and resources used, and familiarity with and use of OSS projects in the classroom. Then, we resorted to data mining techniques, for instance, K-modes and Decision Tree algorithms, to identify instructors’ characteristics according to their classroom practices and use of OSS projects in the course activities. Results: Our findings include the characterization of instructors who use and instructors that do not use OSS projects in Software Engineering Education and the grouping of instructors after the application of the K-modes algorithm, and after the application of the Decision Tree algorithm, with similar characteristics of the pedagogical practices. The main result of this work is that the familiarity with OSS projects and the use of active learning methods were characteristics present in the application of the K-modes and Decision Tree algorithms, that distinguished instructors who used OSS projects from those that did not use them in Software Engineering Education. Finally, we confirmed that familiarity with OSS projects could have a positive influence on the instructors’ interest and potential for adopting this approach in Software Engineering Education.

Evolving collaboration, dependencies, and use in the Rust Open Source Software ecosystem

Open Source Software (OSS) is widely spread in industry, research, and government. OSS represents an effective development model because it harnesses the decentralized efforts of many developers in a way that scales. As OSS developers work independently on interdependent modules, they create a larger cohesive whole in the form of an ecosystem, leaving traces of their contributions and collaborations. Data harvested from these traces enable the study of large-scale decentralized collaborative work. We present curated data on the activity of tens of thousands of developers in the Rust ecosystem and the evolving dependencies between their libraries. The data covers eight years of developer contributions to Rust libraries and can be used to reconstruct the ecosystem’s development history, such as growing developer collaboration networks or dependency networks. These are complemented by data on downloads and popularity, tracking dynamics of use, visibility, and success over time. Altogether the data give a comprehensive view of several dimensions of the ecosystem.

Turnover of Companies in OpenStack: Prevalence and Rationale

To achieve commercial goals, companies have made substantial contributions to large open-source software (OSS) ecosystems such as OpenStack and have become the main contributors. However, they often withdraw their employees for a variety of reasons, which may affect the sustainability of OSS projects. While the turnover of individual contributors has been extensively investigated, there is a lack of knowledge about the nature of companies’ withdrawal. To this end, we conduct a mixed-methods empirical study on OpenStack to reveal how common company withdrawals were, to what degree withdrawn companies made contributions, and what the rationale behind withdrawals was. By analyzing the commit data of 18 versions of OpenStack, we find that the number of companies that have left is increasing and even surpasses the number of companies that have joined in later versions. Approximately 12% of the companies in each version have exited by the next version. Compared to the sustaining companies that joined in the same version, the withdrawn companies tend to have a weaker contribution intensity but contribute to a similar scope of repositories in OpenStack. Through conducting a developer survey, we find four aspects of reasons for companies’ withdrawal from OpenStack: company, community, developer, and project. The most common reasons lie in the company aspect, i.e., the company either achieved its goals or failed to do so. By fitting the survival analysis model, we find that commercial goals are associated with the probability of the company’s withdrawal, and that a company’s contribution intensity and scale are positively correlated with its retention. Maintaining good retention is important but challenging for OSS ecosystems, and our results may shed light on potential approaches to improve company retention and reduce the negative impact of company withdrawal.

A Theoretical Framework for Enhancing Open-Source Software Security

Cyber security is a rapidly developing field and open-source software (OSS) is being led by a collaborative community and a transparent nature. This research intends to make a theoretical framework highlighting the symbiosis of community engagement models, governance models, and the security of open-source ecosystems. The significant purposes aim to investigate how community engagement affects open source software development, analyze the deployment of the governance systems in widely used open source projects, and create the theoretical model that brings the cybersecurity processes in those practices. The literature survey covers existing research on open-source software development, community engagement, governance models, and cybersecurity practices within the OSS ecosystem. Through literature review the basic concepts are investigated using conceptual analysis to determine which principles and mechanisms the Community Model Engagement and Governance models operate, influencing the security of Open Source Software. Open-source project policy recommendations are the foundation for the security of communities where members fully contribute to better governance. This includes developing a fundamental conceptual analysis to lay out the framework's principles and operation (mechanisms). This contributes to the overall development of the theoretical framework. This research expects to develop a standardized theoretical framework that tackles the community engagement-governance models-security software link from new and insightful perspectives. Practical policy recommendations to protect OSS projects will be presented to solve the cybersecurity problem easily and immediately. This study aims to add to the academic and practical discussions that focus on human and organizational components' critical roles in securing open-source software. The discussion of theoretical aspects gives this platform a unique angle that fits well into the technical approach while improving the understanding of a legally open cybersecurity community

Code comment generation based on graph neural network enhanced transformer model for code understanding in open-source software ecosystems

Code comment generation based on graph neural network enhanced transformer model for code understanding in open-source software ecosystems

Collaboration in software ecosystems: A study of work groups in open environment

As a particular type of software ecosystem, an open source software ecosystem (OSSECO) is a collection of interdependent open source software (OSS) projects which are developed and evolve together. Events happening within an OSSECO inherently involve the collaboration of participants from multiple OSS projects, forming a temporary work group. However, it is still unclear how different members of a work group collaborate to fix cross-project bugs, a typical event in the maintenance of OSSECOs. This study aims to investigate the characteristics of collaboration within a work group when fixing cross-project bugs in an OSSECO. It involves the participants from the upstream (which caused the bugs) and the downstream (which were affected by the bugs) OSS projects. We conducted our study on 236 cross-project bugs from the scientific Python ecosystem, involving 571 participants and 91 OSS projects, to understand open collaboration within a work group. We established a quantitative analysis to investigate the members of a work group, along with a qualitative analysis to understand the roles of the members from different OSS communities. The results show that: (1) A typical work group is constituted of four to eight members from the core development teams of the two OSS communities. More members concern with the upstream OSS projects and few can make active contributions to both sides; (2) Distinct responsibilities are taken by the two OSS communities, with the downstream members as the problem-finders and the upstream members as the decision-makers or gatekeepers. Our findings reveal the collaborative mechanism and the responsibility allocation between the upstream and downstream OSS communities in the ecosystems. • A study on 236 cross-project bug fixing activities to understand open collaboration in open source software ecosystems. • Six findings that reveal the members of a cross-project bug fixing work group. • Five findings that summarize the roles of cross-project bug fixing group members. • Recommendations to the researchers, developers, and practitioners.

An interoperable software ecosystem to store, visualize, and publish water resources systems modelling data

Water systems modelers have developed multiple, independent, model- and study-area specific tools to store, query, visualize, and share their data. This fragmentation makes difficult comparisons, and synthesis within or across study areas. This paper identifies the common components of four existing tools for data storage, web visualization, and repository, and relates them correctly in syntax and semantics. Connecting the tools in a state-of-the-art, open-source software ecosystem allowed comparing the effects of population growth and water conservation in simulation and optimization models for the Bear River Watershed, U.S. and Monterrey, Mexico that have different spatial coverage and urban and agricultural representations. The software ecosystem also publishes the models and their data for discovery. The software ecosystem can help modelers tap the best features of individual software tools to answer a next generation of water management questions that seek to discover, use, reproduce, extend, compare, or synthesize within or across study areas.

Commercial Participation in OpenStack: Two Sides of a Coin

This article provides a landscape of commercial participation in OpenStack, a large-scale open source software (OSS) ecosystem. We discuss how to achieve a balance between maximizing business profit and ensuring the long-term sustainability of OSS ecosystems.

Analyzing the Robustness of Open Source Software Ecosystems to the Loss of Contributors: A Case Study

Analyzing the Robustness of Open Source Software Ecosystems to the Loss of Contributors: A Case Study

The immuneML ecosystem for machine learning analysis of adaptive immune receptor repertoires.

Adaptive immune receptor repertoires (AIRR) are key targets for biomedical research as they record past and ongoing adaptive immune responses. The capacity of machine learning (ML) to identify complex discriminative sequence patterns renders it an ideal approach for AIRR-based diagnostic and therapeutic discovery. To date, widespread adoption of AIRR ML has been inhibited by a lack of reproducibility, transparency, and interoperability. immuneML (immuneml.uio.no) addresses these concerns by implementing each step of the AIRR ML process in an extensible, open-source software ecosystem that is based on fully specified and shareable workflows. To facilitate widespread user adoption, immuneML is available as a command-line tool and through an intuitive Galaxy web interface, and extensive documentation of workflows is provided. We demonstrate the broad applicability of immuneML by (i) reproducing a large-scale study on immune state prediction, (ii) developing, integrating, and applying a novel deep learning method for antigen specificity prediction, and (iii) showcasing streamlined interpretability-focused benchmarking of AIRR ML.

Companies’ Participation in OSS Development–An Empirical Study of OpenStack

Commercial participation continues to grow in open source software (OSS) projects and novel arrangements appear to emerge in company-dominated projects and ecosystems. What is the nature of these novel arrangements? Does volunteers’ participation remain critical for these ecosystems? Despite extensive research on commercial participation in OSS, the exact nature and extent of company contributions to OSS development, and the impact of this engagement may have on the volunteer community have not been clarified. To bridge the gap, we perform an exploratory study of OpenStack: a large OSS ecosystem with intense commercial participation. We quantify companies’ contributions via the developers that they provide and the commits made by those developers. We find that companies made far more contributions than volunteers and the distribution of the contributions made by different companies is also highly unbalanced. We observe eight unique contribution models based on companies’ commercial objectives and characterize each model according to three dimensions: contribution intensity, extent, and focus. Companies providing full cloud solutions tend to make both intensive (more than other companies) and extensive (involving a wider variety of projects) contributions. Usage-oriented companies make extensive but less intense contributions. Companies driven by particular business needs focus their contributions on the specific projects addressing these needs. Minor contributors include community players (e.g., the Linux Foundation) and research groups. A model relating the number of volunteers to the diversity of contribution shows a strong positive association between them.

World of code: enabling a research workflow for mining and analyzing the universe of open source VCS data

Open source software (OSS) is essential for modern society and, while substantial research has been done on individual (typically central) projects, only a limited understanding of the periphery of the entire OSS ecosystem exists. For example, how are the tens of millions of projects in the periphery interconnected through technical dependencies, code sharing, or knowledge flow? To answer such questions we: a) create a very large and frequently updated collection of version control data in the entire FLOSS ecosystems named World of Code (WoC), that can completely cross-reference authors, projects, commits, blobs, dependencies, and history of the FLOSS ecosystems and b) provide capabilities to efficiently correct, augment, query, and analyze that data. Our current WoC implementation is capable of being updated on a monthly basis and contains over 18B Git objects. To evaluate its research potential and to create vignettes for its usage, we employ WoC in conducting several research tasks. In particular, we find that it is capable of supporting trend evaluation, ecosystem measurement, and the determination of package usage. We expect WoC to spur investigation into global properties of OSS development leading to increased resiliency of the entire OSS ecosystem. Our infrastructure facilitates the discovery of key technical dependencies, code flow, and social networks that provide the basis to determine the structure and evolution of the relationships that drive FLOSS activities and innovation.