METHOD AND SYSTEM FOR SCORING A SOFTWARE ARTIFACT FOR A USER

• US 20120272205A1
• Filed: 04/19/2011
• Published: 10/25/2012
• Est. Priority Date: 04/19/2011
• Status: Active Grant

• Current Assignee: Sonatype
• Original Assignee: Sonatype
• Inventors: Fox, Brian Edward, Orlina, Joel
• Granted Patent: US 8,438,532 B2
• Time in Patent Office: Days
• US Class Current: 717/101
• CPC Class Codes: G06F 8/36 Software reuse
• CPC Class Codes: G06F 8/70 Software maintenance or management
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 8/77 Software metrics

Abstract

A software artifact is scored for a user. Metadata associated with an artifact about project activity of how active an artifact project is to which the artifact belongs, a security risk indicated in the metadata of the artifact, or a license indicated in the metadata of the artifact, is collected from a software repository. A weighting of the artifact alone is determined from the metadata associated with the artifact that indicates desirability of the project activity, the security risk, or the license. The metadata associated with the artifact is compared to appropriateness with a metadata of a user project to which the user belongs as indicated by a profile of the user, so as to provide a score considering the determined weighting of the artifact and a appropriateness of the artifact for the user with respect to an intended use of the artifact by the user.

Claims

1. A computer system, comprising:

a transceiver operable to transmit and receive communications over at least a portion of a network; and

a processor cooperatively operable with the transceiver, and configured to facilitate;

collecting, from a software repository by communication over the transceiver, metadata associated with a software artifact about project activity of how active an artifact project is to which the software artifact belongs, a security risk indicated in the metadata of the artifact, or a license indicated in the metadata of the artifact;

determining a weighting of the software artifact alone from the metadata associated with the software artifact that indicates desirability of the project activity, the security risk, or the license; and

comparing the metadata associated with the software artifact to appropriateness with a metadata of a user project to which the user belongs as indicated by a profile of the user, so as to provide a score considering the determined weighting of the software artifact and a appropriateness of the artifact for the user with respect to an intended use of the artifact by the user.

2. The computer system of claim 1, wherein the metadata assigned to the artifact and which is used in determining the weighting of the artifact includes:

group identifier uniquely identifying a publisher of the artifact,

artifact identifier uniquely identifying the artifact within the publisher, and

version number uniquely indicating a temporal version of the artifact,

the software project to which the software artifact belongs being determined from the group identifier, artifact identifier, and version number,

how active the software project is being determined from a log of the project at the software repository of the project of the artifact.

3. The computer system of claim 1, wherein the metadata assigned to the artifact and which is used in determining the weighting of the artifact includes Group Id, Artifact ID, and version number from a POM assigned to the artifact in the repository,

the project being determined from the group identifier, artifact identifier, and version number,

how active the project is being determined from a log of the project at the software repository of the project of the artifact.

4. The computer system of claim 1, wherein the metadata of the user project to which the user belongs used in determining the appropriateness of the artifact includes:

an indication of functionality the artifact is addressed to,

an indication of the sponsoring organization of the user project,

an indication of the license of the user project.

5. The computer system of claim 1, further comprising weighting the software artifact by user-provided ranking specific to the artifact of a community of users to which the user belongs as determined by the profile of the user or the user project to which the user belongs as indicated by the profile of the user.

6. The computer system of claim 1, wherein the artifact is in stored in the software repository according to the Open Source Definition, the software repository being an open source repository.

7. The computer system of claim 1, further comprising interacting with user to collect human-provided meta data including community ranking specific to the artifact, storing the human-provided meta data in relation to the software artifact, and using the human-provided meta data to further adjust the score of the software artifact.

8. A computer-implemented method for scoring a software artifact for a user, comprising:

collecting, from a software repository by communication over the transceiver, metadata associated with a software artifact about project activity of how active an artifact project is to which the software artifact belongs, a security risk indicated in the metadata of the artifact, or a license indicated in the metadata of the artifact;

determining a weighting of the software artifact alone from the metadata associated with the software artifact that indicates desirability of the project activity, the security risk, or the license; and

comparing the metadata associated with the software artifact to appropriateness with a metadata of a user project to which the user belongs as indicated by a profile of the user, so as to provide a score considering the determined weighting of the software artifact and a appropriateness of the artifact for the user with respect to an intended use of the artifact by the user.

9. The method of claim 8, wherein the metadata assigned to the artifact and which is used in determining the weighting of the artifact includes:

wherein the metadata assigned to the artifact and which is used in determining the weighting of the artifact includes;

group identifier uniquely identifying a publisher of the artifact,

artifact identifier uniquely identifying the artifact within the publisher, and

version number uniquely indicating a temporal version of the artifact,

the software project to which the software artifact belongs being determined from the group identifier, artifact identifier, and version number,

how active the software project is being determined from a log of the project at the software repository of the project of the artifact.

10. The method of claim 8, wherein the metadata assigned to the artifact and which is used in determining the weighting of the artifact includes Group Id, Artifact ID, and version number from a POM assigned to the artifact in the repository,

the project being determined from the group identifier, artifact identifier, and version number,

how active the project is being determined from a log of the project at the software repository of the project of the artifact.

11. The method of claim 8, wherein the metadata of the user project to which the user belongs used in determining the appropriateness of the artifact includes:

an indication of functionality the artifact is addressed to,

an indication of the sponsoring organization of the user project,

an indication of the license of the user project.

12. The method of claim 8, further comprising weighting the software artifact by user-provided ranking specific to the artifact of a community of users to which the user belongs as determined by the profile of the user or the user project to which the user belongs as indicated by the profile of the user.

13. The method of claim 8, wherein the artifact is in stored in the software repository according to the Open Source Definition, the software repository being an open source repository.

15. A non-transitory computer-readable medium comprising instructions for execution by a computer, the instructions including a computer-implemented method for providing a method for scoring a software artifact for a user, the instructions for implementing:

collecting, from a software repository by communication over the transceiver, metadata associated with a software artifact about project activity of how active an artifact project is to which the software artifact belongs, a security risk indicated in the metadata of the artifact, or a license indicated in the metadata of the artifact;

determining a weighting of the software artifact alone from the metadata associated with the software artifact that indicates desirability of the project activity, the security risk, or the license; and

comparing the metadata associated with the software artifact to appropriateness with a metadata of a user project to which the user belongs as indicated by a profile of the user, so as to provide a score considering the determined weighting of the software artifact and a appropriateness of the artifact for the user with respect to an intended use of the artifact by the user.

14. The method of claim 16, further comprising interacting with user to collect human-provided meta data including community ranking specific to the artifact, storing the human-provided meta data in relation to the software artifact, and using the human-provided meta data to further adjust the score of the software artifact.

16. The non-transitory computer-readable medium of claim 15, wherein the metadata assigned to the artifact and which is used in determining the weighting of the artifact includes:

wherein the metadata assigned to the artifact and which is used in determining the weighting of the artifact includes;

group identifier uniquely identifying a publisher of the artifact,

artifact identifier uniquely identifying the artifact within the publisher, and

version number uniquely indicating a temporal version of the artifact,

the software project to which the software artifact belongs being determined from the group identifier, artifact identifier, and version number,

how active the software project is being determined from a log of the project at the software repository of the project of the artifact.

17. The non-transitory computer-readable medium of claim 15, wherein the metadata assigned to the artifact and which is used in determining the weighting of the artifact includes Group Id, Artifact ID, and version number from a POM assigned to the artifact in the repository,

the project being determined from the group identifier, artifact identifier, and version number,

how active the project is being determined from a log of the project at the software repository of the project of the artifact.

18. The non-transitory computer-readable medium of claim 15, wherein the metadata of the user project to which the user belongs used in determining the appropriateness of the artifact includes:

an indication of functionality the artifact is addressed to,

an indication of the sponsoring organization of the user project,

an indication of the license of the user project.

19. The non-transitory computer-readable medium of claim 15, further comprising weighting the software artifact by user-provided ranking specific to the artifact of a community of users to which the user belongs as determined by the profile of the user or the user project to which the user belongs as indicated by the profile of the user.

20. The non-transitory computer-readable medium of claim 15, wherein the artifact is in stored in the software repository according to the Open Source Definition, the software repository being an open source repository.

21. The non-transitory computer-readable medium of claim 15, further comprising interacting with user to collect human-provided meta data including community ranking specific to the artifact, storing the human-provided meta data in relation to the software artifact, and using the human-provided meta data to further adjust the score of the software artifact.