Open Source Software Repositories Research Articles

OSSIntegrity: Collaborative open-source code integrity verification

Open-source software (OSS) libraries have become popular among developers due to their ability to reduce development time and costs. However, OSS can also be exploited and used as a means of conducting OSS supply chain attacks. In OSS attacks, malicious code is injected into libraries used by the target. Previous studies have proposed various methods for preventing and detecting such attacks, however most of them focused on untargeted attacks. In contrast, this paper focuses on targeted OSS supply chain attacks which are performed by skilled and persistent attackers with strong technical aptitude. Targeted OSS attacks are crafted towards a specific target (i.e., developer). Since these attacks do not target general OSS repositories, they tend to go under the radar for a long period of time, allowing an attacker to gain access to sensitive data or systems. In this paper, we propose (SC)2V — secure crowdsource-based code verification, a novel distributed and scalable framework for verifying OSS libraries. (SC)2V is aimed at preventing targeted supply chain attacks and is integrated in the build phase of software production, serving as an additional code verification step before packaging the application and deploying it. (SC)2V involves both users (developers seeking to verify an OSS library) and verifiers that contribute to the collaborative verification effort. (SC)2V considers a library as verified and safe when a consensus is reached among the verifiers. We evaluated the proposed method using eight different attack scenarios (including cold start and edge cases), on around 900 popular OSS libraries and their dependencies, each of which included an average of 10 files and was verified by at least five participants; a total of 127,000 files were evaluated, and the results indicate that it took our framework an average of just 26 s to issue an alert against the attacks.

Automated Mapping of Vulnerability Advisories onto their Fix Commits in Open Source Repositories

The lack of comprehensive sources of accurate vulnerability data represents a critical obstacle to studying and understanding software vulnerabilities (and their corrections). In this article, we present an approach that combines heuristics stemming from practical experience and machine-learning (ML)—specifically, natural language processing (NLP)—to address this problem. Our method consists of three phases. First, we construct an advisory record object containing key information about a vulnerability that is extracted from an advisory, such as those found in the National Vulnerability Database (NVD). These advisories are expressed in natural language. Second, using heuristics, a subset of candidate fix commits is obtained from the source code repository of the affected project, by filtering out commits that can be identified as unrelated to the vulnerability at hand. Finally, for each of the remaining candidate commits, our method builds a numerical feature vector reflecting the characteristics of the commit that are relevant to predicting its match with the advisory at hand. Based on the values of these feature vectors, our method produces a ranked list of candidate fixing commits. The score attributed by the ML model to each feature is kept visible to the users, allowing them to easily interpret the predictions. We implemented our approach and we evaluated it on an open data set, built by manual curation, that comprises 2,391 known fix commits corresponding to 1,248 public vulnerability advisories. When considering the top-10 commits in the ranked results, our implementation could successfully identify at least one fix commit for up to 84.03% of the vulnerabilities (with a fix commit on the first position for 65.06% of the vulnerabilities). Our evaluation shows that our method can reduce considerably the manual effort needed to search open-source software (OSS) repositories for the commits that fix known vulnerabilities.

Monotonic and Linear Relations between Growth of Quality vs Growth in Quantity in Open-Source Software Projects

Mathematical models have been developed to study the relation between the growth of quantity and the growth of quality of open-source collaborative software repositories of GitHub. GitHub events triggering the growth of quantity and quality have been identified. Linear regression analysis, Pearson’s, Spearman’s, and Kendall’s correlation coefficients have been used. Hypothesis testing has led to the conclusion that there may be a linear relation between quality and quantity within a certain range of values. Positive monotonic relations and dependency between quantity and quality have been strongly established. Scripts for automated testing have been developed.

A Survey of Open Source Software Repositories in the US Department of Energy’s National Laboratories

A Survey of Open Source Software Repositories in the US Department of Energy’s National Laboratories

The ESCAPE Open-source Software and Service Repository.

The purpose of the ESCAPE Open-source Software and Service Repository (OSSR) is to provide a central location for the dissemination and use of trusted open-source software in the fields of astronomy, astroparticle physics, and particle physics. The repository allows users to easily access and download tools and services developed within the community, and to contribute their own tools and services. The ESCAPE project has set up a curated repository of software that provides tools and an environment to make it easy for users to find and download the software and services that they need. The repository is regularly updated and is maintained by a curation board, ensuring that the software and services are reliable and up-to-date. The curation and onboarding process makes the OSSR a trustworthy source of software that can be used for scientific analysis. The software included in the repository must include documentation and instructions and follow a set of modern best practices in software development. Training is provided to students and researchers to help them provide high-quality scientific software following modern software development practices. The OSSR currently contains a wide range of software and services, including those for data management, data analysis, and machine learning. These tools and services are used by researchers and other users around the world. The OSSR has proven to be an effective means for disseminating and providing open-source software and services developed by the ESCAPE project partners and welcomes contributions from the entire community.

Privacy-Compliant Software Reuse in Early Development Phases: A Systematic Literature Review

ContextPrivacy-compliant software development has received substantial attention in recent years, especially with the growth of digital services and the emergence of privacy regulations and standards. The increasing popularity of open-source software repositories and reuse practices challenges privacy-compliant software development. ObjectiveThis paper aims to present the state-of-the-art in privacy-compliant software reuse, focusing on early development phases of requirements engineering, domain analysis and software design, as well as to discuss the current challenges that identify directions for future research. MethodWe conducted a Systematic Literature Reviews (SLR) and analyzed 61 papers published in the last two decades, in terms of their business and technological domains, followed reuse approaches, applied privacy strategies, and utilized evaluation approaches. ResultsThe reviewed studies vary in terms of business domains (e.g., healthcare, smart objects and finance) and technological domains (e.g., IoT, mobile, cloud and microservices). Most of the studies do not refer to a specific regulation and if so – to GDPR. Their common purpose is to support benign reuse, most notably through patterns, components & libraries and model-driven engineering, but malicious reuse is also researched to a lesser extent. A strong emphasis is put on integrating privacy strategies whose goal is building trust and transparency (in particular, inform and demonstrate), while other strategies are studied to a limited extent in software reuse context. Evaluation is commonly performed through analytical, observational and experimental approaches. ConclusionsThe operationalization of privacy compliance practices for existing software artifacts is still challenging. The challenges encompass improving trustworthiness of reused artifacts, ensuring privacy compliance in distributed architectures, bridging the gap between legal regulations and software requirements, enhancing privacy analysis and vulnerability detection, supporting late application of privacy strategies, and developing objective assessments for privacy-compliant software reuse.

Progress with Repository-based Annotation Infrastructure for Biodiversity Applications

Progress with Repository-based Annotation Infrastructure for Biodiversity Applications

Security Misconfigurations in Open Source Kubernetes Manifests: An Empirical Study

Context: Kubernetes has emerged as the de-facto tool for automated container orchestration. Business and government organizations are increasingly adopting Kubernetes for automated software deployments. Kubernetes is being used to provision applications in a wide range of domains, such as time series forecasting, edge computing, and high-performance computing. Due to such a pervasive presence, Kubernetes-related security misconfigurations can cause large-scale security breaches. Thus, a systematic analysis of security misconfigurations in Kubernetes manifests, i.e., configuration files used for Kubernetes, can help practitioners secure their Kubernetes clusters. Objective: The goal of this paper is to help practitioners secure their Kubernetes clusters by identifying security misconfigurations that occur in Kubernetes manifests . Methodology: We conduct an empirical study with 2,039 Kubernetes manifests mined from 92 open-source software repositories to systematically characterize security misconfigurations in Kubernetes manifests. We also construct a static analysis tool called Security Linter for Kubernetes Manifests ( SLI-KUBE ) to quantify the frequency of the identified security misconfigurations. Results: In all, we identify 11 categories of security misconfigurations, such as absent resource limit, absent securityContext , and activation of hostIPC . Specifically, we identify 1,051 security misconfigurations in 2,039 manifests. We also observe the identified security misconfigurations affect entities that perform mesh-related load balancing, as well as provision pods and stateful applications. Furthermore, practitioners agreed to fix 60% of 10 misconfigurations reported by us. Conclusion: Our empirical study shows Kubernetes manifests to include security misconfigurations, which necessitates security-focused code reviews and application of static analysis when Kubernetes manifests are developed.

Simple stupid insecure practices and GitHub’s code search: A looming threat?

Insecure coding practices are a known, long-standing problem in open-source development, which takes on a new dimension with the current capabilities for mining open-source software repositories through version control systems. Although most insecure practices require a sequence of interlinked behaviour, prior work also determined that simpler, one-liner coding practices can introduce vulnerabilities in the code. Such simple stupid insecure practices (SSIPs) can have severe security implications for package-based software systems, as they are easily spread over version-control systems. Moreover, GitHub is piloting regular-expression-based code searches across public repositories through its “Code Search Technology”, potentially simplifying unearthing SSIPs. As an exploratory case study, we focused on popular PyPi packages and analysed their source code using regular expressions (as done by GitHub’s incoming search engine). The goal was to explore how detectable these simple vulnerabilities are and how exploitable “Code Search” technology is. Results show that packages on lower versions are more vulnerable, that “code injection” is the most scattered issue, and that about 20% of the scouted packages have at least one vulnerability. Most concerningly, malicious use of this engine was straightforward, raising severe concerns about the implications of a publicly available “Code Search”.

Software Development Effort Estimation Using Relational Database and Optimized Learning Mechanism

Accurately estimating the cost of software development is crucial for effective project planning and resource allocation. However, traditional cost estimation methods rely heavily on expert judgment and historical data, which can be time consuming and prone to errors. This study suggests a learning-based cost estimation model that leverages relational databases to improve accuracy. The proposed approach estimates project cost based on the effort required to complete software development, which is a key driver of the project cost. The proposed model is designed to address the challenges posed by the variability in open-source development, including variable team sizes, working hours, and expertise. The study collects and pre-processes data from open-source platforms and selects cost drivers and metrics based on logical rules and SQL queries. Moreover, we propose an optimized Artificial Neural Network (ANN) with augmented topology to automate the selection of neuron units, layers, and adjustment of learnable parameters according to the input variables. The proposed model is evaluated on a 100 open-source software repositories dataset and demonstrates its effectiveness in accurately estimating development cost. The system is implemented using Python and evaluated using performance parameters such as MSE, RMSE, MAE, and MMRE. Results indicate that our proposed model offers a more accurate and efficient approach to software cost estimation, especially for freelancers and outsourcing firms. The proposed model has the potential to save time and resources and improve the reliability and accuracy of software cost estimation.

The ESCAPE Open-source Software and Service Repository

Purpose: The purpose of the ESCAPE Open-source Software and Service Repository (OSSR) is to provide a central location for the dissemination and use of trusted open-source software in the fields of astronomy, astroparticle physics, and particle physics. The repository allows users to easily access and download tools and services developed within the community, and to contribute their own tools and services. Methods: The ESCAPE project has set up a curated repository of software that provides tools and an environment to make it easy for users to find and download the software and services that they need. The repository is regularly updated and is maintained by a curation board, ensuring that the software and services are reliable and up-to-date. The curation and onboarding process makes the OSSR a trustworthy source of software that can be used for scientific analysis. The software included in the repository must include documentation and instructions and follow a set of modern best practices in software development. Training is provided to students and researchers to help them provide high-quality scientific software following modern software development practices. Outcome: The OSSR currently contains a wide range of software and services, including those for data management, data analysis, and machine learning. These tools and services are used by researchers and other users around the world. The OSSR has proven to be an effective means for disseminating and providing open-source software and services developed by the ESCAPE project partners and welcomes contributions from the entire community.

Large-Scale Identification and Analysis of Factors Impacting Simple Bug Resolution Times in Open Source Software Repositories

One of the most prominent issues the ever-growing open-source software community faces is the abundance of buggy code. Well-established version control systems and repository hosting services such as GitHub and Maven provide a checks-and-balances structure to minimize the amount of buggy code introduced. Although these platforms are effective in mitigating the problem, it still remains. To further the efforts toward a more effective and quicker response to bugs, we must understand the factors that affect the time it takes to fix one. We apply a custom traversal algorithm to commits made for open source repositories to determine when “simple stupid bugs” were first introduced to projects and explore the factors that drive the time it takes to fix them. Using the commit history from the main development branch, we are able to identify the commit that first introduced 13 different types of simple stupid bugs in 617 of the top Java projects on GitHub. Leveraging a statistical survival model and other non-parametric statistical tests, we found that there were two main categories of categorical variables that affect a bug’s life; Time Factors and Author Factors. We find that bugs are fixed quicker if they are introduced and resolved by the same developer. Further, we discuss how the day of the week and time of day a buggy code was written and fixed affects its resolution time. These findings will provide vital insight to help the open-source community mitigate the abundance of code and can be used in future research to aid in bug-finding programs.

Supporting the Task-driven Skill Identification in Open Source Project Issue Tracking Systems

[Background] Selecting an appropriate task is challenging for contributors to Open Source Software (OSS), mainly for those who are contributing for the first time. Therefore, researchers and OSS projects have proposed various strategies to aid newcomers, including labeling tasks. [Aims] In this research, we investigate the automatic labeling of open issues strategy to help the contributors to pick a task to contribute. We label the issues with APIdomains- categories of APIs parsed from the source code used to solve the issues. We plan to add social network analysis metrics gathered from the issues conversations as new predictors. By identifying the skills, we claim the contributor candidates should pick a task more suitable to their skill. [Method] We are employing mixed methods. We qualitatively analyzed interview transcripts and the survey's open-ended questions to comprehend the strategies communities use to assist in onboarding contributors and contributors used to pick up an issue. We applied quantitative studies to analyze the relevance of the API-domain labels in a user experiment and compare the strategies' relative importance for diverse contributor roles. We also mined project and issue data from OSS repositories to build the ground truth and predictors able to infer the API-domain labels with comparable precision, recall, and F-measure with the state-of-art. We also plan to use a skill ontology to assist the matching process between contributors and tasks. By quantitatively analyzing the confidence level of the matching instances in ontologies describing contributors' skills and tasks, we might recommend issues for contribution. In addition, we will measure the effectiveness of the API-domain labels by evaluating the issues solving time and the rate among the labeled and unlabelled ones. [Results] So far, the results showed that organizing the issues?which includes assigning labels is seen as an essential strategy for diverse roles in OSS communities. The API-domain labels are relevant, mainly for experienced practitioners. The predicted labels have an average precision of 75.5%. [Conclusions] Labeling the issues with the API-domain labels indicates the skills involved in an issue. The labels represent possible libraries (aggregated into domains) used in the source code related to an issue. By investigating this research topic, we expect to assist the new contributors in finding a task, helping OSS communities to attract and retain more contributors.

Locating Faulty Source Code Files to Fix Bug Reports

Open source software is usually released while it still contains bugs. In order to fix a reported bug during maintenance phase, the developer has to search the source code files to identify the faulty ones; this process is called bug localization (BL). Automating BL is a necessity to boost the developer's productivity and enhance the software quality. The paper proposes an information retrieval based approach for retrieving and ranking a list of suspicious faulty source files relevant to a submitted bug report (BR). The proposed approach leverages textual features of the BRs and source files, which are parts-of-speech tagging, lexical and semantic similarity between the source files and BRs, in addition to the source file change history. The effectiveness of the proposed approach was evaluated over three open-source software repositories. Experimental results showed the superiority of the proposed approach over eight previous approaches in terms of top@N and MAP metrics.

From Specialized Mechanics to Project Butlers: The Usage of Bots in Open Source Software Development

We seek to identify how open source software (OSS) projects adopt bot services from a diverse set of selections. Our empirical research examines bot usage in the most popular OSS repositories in GitHub.

Diversity-driven unit test generation

The goal of automated unit test generation tools is to create a set of test cases for the software under test that achieve the highest possible coverage for the selected test quality criteria. The most effective approaches for achieving this goal at the present time use meta-heuristic optimization algorithms to search for new test cases using fitness functions defined on existing sets of test cases and the system under test. Regardless of how their search algorithms are controlled, however, all existing approaches focus on the analysis of exactly one implementation, the software under test, to drive their search processes, which is a limitation on the information they have available. In this paper we investigate whether the practical effectiveness of white box unit test generation tools can be increased by giving them access to multiple, diverse implementations of the functionality under test harvested from widely available Open Source software repositories. After presenting a basic implementation of such an approach, DivGen (Diversity-driven Generation), on top of the leading test generation tool for Java (EvoSuite), we assess the performance of DivGen compared to EvoSuite when applied in its traditional, mono-implementation oriented mode (MonoGen). The results show that while DivGen outperforms MonoGen in 33% of the sampled classes for mutation coverage (+16% higher on average), MonoGen outperforms DivGen in 12.4% of the classes for branch coverage (+10% higher average).

Impacts of software community patterns on process and product: An empirical study

Software engineering projects are now more than ever a community effort. In the recent past, researchers have shown that their success not only depends on source code quality, but also on other aspects like the balance of power distance, culture, and global engineering practices, and more. In such a scenario, understanding the characteristics of the community around a project and foresee possible problems may be the key to develop successful systems. In this paper, we focus on this research problem and propose an exploratory study on the relation between community patterns, i.e., recurrent mixes of organizational or social structure types, and aspects related to the quality of software products and processes by mining open-source software repositories hosted on GitHub . We first exploit association rule mining to discover frequent relations between community pattern and community smells, i.e., sub-optimal patterns across the organizational structure of a software development community that may be precursors of some form of social debt. Further on, we use statistical analyses to understand their impact on software maintainability and on the community engagement, in terms of contributions and issues. Our findings show that different organizational patterns are connected to different forms of socio-technical problems; further on, specific combinations are set in equally specific contextual conditions. Findings support two possible conclusions: (1) practitioners should put in place specific preventive actions aimed at avoiding the emergence of community smells and (2) such actions should be drawn according to the contextual conditions of the organization and the project. • A list of association rules between community patterns and community smells to see how they relate each other. • An empirical analysis on how community patterns affect the product quality. • An empirical analysis on how community patterns affect the development process. • A replication package containing all the materials to reproduce and extend our study.

Development of recommendation systems for software engineering: the CROSSMINER experience

To perform their daily tasks, developers intensively make use of existing resources by consulting open source software (OSS) repositories. Such platforms contain rich data sources, e.g., code snippets, documentations, and user discussions, that can be useful for supporting development activities. Over the last decades, several techniques and tools have been promoted to provide developers with innovative features, aiming to bring in improvements in terms of development effort, cost savings, and productivity. In the context of the EU H2020 CROSSMINER project, a set of recommendation systems has been conceived to assist software programmers in different phases of the development process. The systems provide developers with various artifacts, such as third-party libraries, documentation about how to use the APIs being adopted, or relevant API function calls. To develop such recommendations, various technical choices have been made to overcome issues related to several aspects including the lack of baselines, limited data availability, decisions about the performance measures, and evaluation approaches. This paper is an experience report to present the knowledge pertinent to the set of recommendation systems developed through the CROSSMINER project. We explain in detail the challenges we had to deal with, together with the related lessons learned when developing and evaluating these systems. Our aim is to provide the research community with concrete takeaway messages that are expected to be useful for those who want to develop or customize their own recommendation systems. The reported experiences can facilitate interesting discussions and research work, which in the end contribute to the advancement of recommendation systems applied to solve different issues in Software Engineering.

Commit2Vec: Learning Distributed Representations of Code Changes

Deep learning methods have found successful applications in fields like image classification and natural language processing. They have recently been applied to source code analysis too, due to the enormous amount of freely available source code (e.g., from open-source software repositories). In this work, we elaborate upon a state-of-the-art approach for source code representation, which uses information about its syntactic structure, and we extend it to represent source code changes (i.e., commits). We use this representation to tackle an industrial-relevant task: the classification of security-relevant commits. We leverage on transfer learning, a machine learning technique which reuses, or transfers, information learned from previous tasks (commonly called pretext tasks) to tackle a new target task. We assess the impact of using two different pretext tasks, for which abundant labeled data is available, to tackle the classification of security-relevant commits. Our results indicate that representations that exploit the structural information in code syntax outperform token-based representations. Furthermore, we show that pre-training on a small dataset ( $$>10^4$$ samples), but for a pretext task that is closely related to the target task, results in better performance metrics than pre-training on a loosely related pretext task with a very large dataset ( $$>10^6$$ samples).

A sensitivity analysis of factors influential to the popularity of shared data in data repositories

• This paper used a neural network based method to analyze factors influencing dataset popularity in UCI data repositories. • Sensitivity degree as a weight was used to re-rank the datasets in order to predict high-popularity datasets. • We examined whether the relationship between factors and popularity differs depending on the subject domain in the UCI. • GitHub data repository was used for evaluating the applicability of the proposed framework to other types of factor analysis. With their rapid development, data repositories usually provide abundant metadata—including data types, keywords, downloads, stars, forks, and citations—along with the data content. These rich metadata can be used as valuable resources to study the factors that facilitate data sharing. However, few previous studies have attempted to study which metadata are correlated with the popularity of data. This study overcomes these issues by extracting the major factors for each dataset from a well-known data repository, the UCI Machine Learning Repository, and a popular open-source software repository, GitHub. We trained a neural network model and measured the influence of these features on quantified popularity metrics using the weight product of connecting neurons. We grouped the UCI factors into two categories (intrinsic and extrinsic) and the GitHub factors into three categories (intrinsic, extrinsic, and web-related) to analyze their influence on popularity at each level. The quantified influence was used to predict the popularity of the data or software. We conducted a statistical analysis to explore the relationship between these factors and popularity with five different domains (life sciences, physical sciences, computer science/engineering, social sciences, and others) for the UCI repository. This study’s findings contribute to understanding the factors that affect the popularity of open datasets or software for providing guidance on data sharing, reuse, and organization.