Method and system for scoring a software artifact for a user

• US 8,572,550 B2
• Filed: 02/28/2013
• Issued: 10/29/2013
• Est. Priority Date: 04/19/2011
• Status: Active Grant

• Current Assignee: Sonatype
• Original Assignee: Sonatype
• Inventors: Fox, Brian Edward, Orlina, Joel
• Primary Examiner(s): Dao, Thuy
• Assistant Examiner(s): BERMAN, STEPHEN DAVID
• Application Number:
  US13/780,525
• Publication Number:
  US 20130191808A1
• Time in Patent Office: 243 Days
• Field of Search: None
• US Class Current: 717/101
• CPC Class Codes: G06F 8/36 Software reuse
• CPC Class Codes: G06F 8/70 Software maintenance or management
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 8/77 Software metrics

Abstract

A software artifact is scored for a user. Metadata associated with an artifact about project activity of how active an artifact project is to which the artifact belongs, a security risk indicated in the metadata of the artifact, or a license indicated in the metadata of the artifact, is collected from a software repository. A weighting of the artifact alone is determined from the metadata associated with the artifact that indicates desirability of the project activity, the security risk, or the license. The metadata associated with the artifact is compared to appropriateness with a metadata of a user project to which the user belongs as indicated by a profile of the user, so as to provide a score considering the determined weighting of the artifact and a appropriateness of the artifact for the user with respect to an intended use of the artifact by the user.

Claims

1. A computer-implemented method for scoring a software artifact for a user, comprising:

collecting, from a software repository by communication over the transceiver, metadata associated with a software artifact about project activity of how active an artifact project is to which the software artifact belongs, a security risk indicated in the metadata of the software artifact, or a license indicated in the metadata of the software artifact;

determining a weighting, without regard to an intended use of the software artifact by a user, of the software artifact alone from the metadata associated with the software artifact that indicates desirability of the project activity, the security risk, or the license;

comparing the metadata associated with the software artifact to appropriateness with a metadata of a user project to which the user belongs as indicated by a profile of the user, so as to provide a score considering the determined weighting of the software artifact and an appropriateness of the software artifact for the user with respect to the intended use of the software artifact by the user; and

interacting with user to collect human-provided metadata including community ranking specific to the software artifact, storing the human-provided metadata in relation to the software artifact, and using the human-provided metadata to further adjust the score of the software artifact.

2. The method of claim 1, wherein the metadata assigned to the software artifact and which is used in determining the weighting of the software artifact includes Group ID, Artifact ID, and version number from a project object model (POM) assigned to the software artifact in the repository,

the artifact project being determined from the Group ID, Artifact ID, and version number,

how active the artifact project is being determined from a log of the project at the software repository of the project of the software artifact.

3. The method of claim 1, wherein the metadata of the user project to which the user belongs used in determining the appropriateness of the software artifact includes:

an indication of functionality the software artifact is addressed to,

an indication of the sponsoring organization of the user project,

an indication of the license of the user project.

4. The method of claim 1, further comprising weighting the software artifact by a user-provided ranking, specific to the software artifact, of a community of users to which the user belongs as determined by the profile of the user or the user project to which the user belongs as indicated by the profile of the user.

5. The method of claim 1, wherein the software artifact is in stored in the software repository according to the Open Source Definition, the software repository being an open source repository.

8. The computer system of claim 1, wherein the metadata of the user project to which the user belongs used in determining the appropriateness of the software artifact includes:

an indication of functionality the software artifact is addressed to,

an indication of the sponsoring organization of the user project,

an indication of the license of the user project.

10. The computer system of claim 1, wherein the software artifact is in stored in the software repository according to the Open Source Definition, the software repository being an open source repository.

6. A computer system, comprising:

a transceiver operable to transmit and receive communications over at least a portion of a network; and

a processor cooperatively operable with the transceiver, and configured to facilitate;

collecting, from a software repository by communication over the transceiver, metadata associated with a software artifact about project activity of how active an artifact project is to which the software artifact belongs, a security risk indicated in the metadata of the software artifact, or a license indicated in the metadata of the software artifact;

determining a weighting, without regard to an intended use of the software artifact by a user, of the software artifact alone from the metadata associated with the software artifact that indicates desirability of the project activity, the security risk, or the license;

comparing the metadata associated with the software artifact to appropriateness with a metadata of a user project to which the user belongs as indicated by a profile of the user, so as to provide a score considering the determined weighting of the software artifact and an appropriateness of the software artifact for the user with respect to the intended use of the software artifact by the user; and

interacting with the user to collect human-provided metadata including a community ranking specific to the software artifact, storing the human-provided metadata in relation to the software artifact, and using the human-provided metadata to further adjust the score of the software artifact.

7. The computer system of claim 6, wherein the metadata assigned to the software artifact and which is used in determining the weighting of the software artifact includes Group ID, Artifact ID, and version number from a project object model (POM) assigned to the software artifact in the repository,

the artifact project being determined from the Group ID, Artifact ID, and version number,

how active the artifact project is being determined from a log of the project at the software repository of the project of the software artifact.

9. The computer system of claim 6, further comprising weighting the software artifact by a user-provided ranking, specific to the software artifact, of a community of users to which the user belongs as determined by the profile of the user or the user project to which the user belongs as indicated by the profile of the user.

11. A non-transitory computer-readable medium comprising instructions for execution by a computer, the instructions including a computer-implemented method for providing a method for scoring a software artifact for a user, the instructions for implementing:

collecting, from a software repository by communication over a transceiver, metadata associated with a software artifact about project activity of how active an artifact project is to which the software artifact belongs, a security risk indicated in the metadata of the software artifact, or a license indicated in the metadata of the software artifact;

determining a weighting, without regard to an intended use of the software artifact by a user, of the software artifact alone from the metadata associated with the software artifact that indicates desirability of the project activity, the security risk, or the license;

comparing the metadata associated with the software artifact to appropriateness with a metadata of a user project to which the user belongs as indicated by a profile of the user, so as to provide a score considering the determined weighting of the software artifact and an appropriateness of the software artifact for the user with respect to the intended use of the software artifact by the user; and

interacting with the user to collect human-provided metadata including community ranking specific to the software artifact, storing the human-provided metadata in relation to the software artifact, and using the human-provided metadata to further adjust the score of the software artifact.

12. The non-transitory computer-readable medium of claim 11, wherein the metadata assigned to the software artifact and which is used in determining the weighting of the software artifact includes a Group ID, Artifact ID, and version number from a project object model (POM) assigned to the software artifact in the repository,

the artifact project being determined from the Group ID, Artifact ID, and version number,

how active the artifact project is being determined from a log of the project at the software repository of the project of the software artifact.

13. The non-transitory computer-readable medium of claim 11, wherein the metadata of the user project to which the user belongs used in determining the appropriateness of the software artifact includes:

an indication of functionality the software artifact is addressed to,

an indication of the sponsoring organization of the user project,

an indication of the license of the user project.

14. The non-transitory computer-readable medium of claim 11, further comprising weighting the software artifact by a user-provided ranking, specific to the software artifact, of a community of users to which the user belongs as determined by the profile of the user or the user project to which the user belongs as indicated by the profile of the user.

15. The non-transitory computer-readable medium of claim 11, wherein the software artifact is in stored in the software repository according to the Open Source Definition, the software repository being an open source repository.