Method and system for monitoring metadata related to software artifacts

• US 8,875,090 B2
• Filed: 04/11/2013
• Issued: 10/28/2014
• Est. Priority Date: 09/13/2011
• Status: Active Grant

• Current Assignee: Sonatype
• Original Assignee: Sonatype
• Inventors: Fox, Brian Edward, Orlina, Joel
• Primary Examiner(s): Dao, Thuy
• Assistant Examiner(s): BERMAN, STEPHEN DAVID
• Application Number:
  US13/861,065
• Publication Number:
  US 20130227517A1
• Time in Patent Office: 565 Days
• Field of Search: None
• US Class Current: 717/101
• CPC Class Codes: G06F 11/3003 Monitoring arrangements specially adapted to the computing system or computing system component being monitored
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 8/70 Software maintenance or management
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 9/44 Arrangements for executing specific programs

Abstract

Collecting and storing an artifact identifier for one or more artifacts, project identifiers for one or more software projects that use each artifact, and information about the temporal version for the artifacts. Collecting and storing project information related to the software projects, including a project identifier for each project, and contact information for a user of each software project. Collecting Metadata associated with the software artifacts, which includes information identifying the artifact, information about security risks associated with the artifact, information about a license associated with the artifact, or information indicative of a level of use or user rating of the artifact. The metadata is periodically or continually monitored to determine whether there has been any actionable change, and notifying the user about the actionable change.

Claims

1. A computer-implemented method for monitoring a software project that includes one or more software artifacts for a user, comprising:

collecting and storing artifact information related to one or more software artifacts, the artifact information including;

an artifact identifier for each of the one or more artifacts, project identifiers for any of one or more software projects that use each of the one or more artifacts, information about the temporal version for the one or more artifacts;

collecting and storing project information related to the one or more software projects that use the one or more software artifacts, the project information including;

a project identifier for each of the one or more projects, and contact information for a user of the software project;

collecting, from a software repository by communication over the transceiver, metadata associated with the one or more software artifacts, the metadata for each of the one or more software artifacts including;

information identifying the respective artifact, information about security risks associated with the respective artifact, information about a license associated with the respective artifact, or information indicative of a level of use or user rating of the respective artifact;

periodically or continually monitoring the metadata to determine whether there has been any actionable change in the metadata associated with the one or more software artifacts;

notifying the user of any software project that uses a software artifact for which there has been an actionable change about the actionable change, the notifying operation being performed via the transceiver using the contact information; and

wherein the project information includes evaluation criteria for each of the one or more software artifacts used by each of the one or more projects, the project evaluation criteria identifying what makes a change in the metadata actionable,

wherein the metadata is continually monitored for actionable changes, and wherein the continual monitoring includes

detecting a change in the metadata associated with the one or more software artifacts, and

determining whether the change in the metadata is actionable for a respective software project based on the evaluation criteria in a respective set of project information.

2. The method of claim 1, wherein the information identifying the respective artifact includes:

a group identifier uniquely identifying a publisher of the respective artifact, and

a version number uniquely indicating a temporal version of the respective artifact,

wherein the artifact identifier uniquely identifies the respective artifact within the publisher.

3. The method of claim 1,

wherein the information regarding a level of use or user rating of the respective artifact includes at least one of:

user-provided ranking information specific to the respective artifact obtained from a community of users to which the user belongs, or

an indication of a number of users with the community who are also using the respective artifact, and

wherein the community of users to which the user belongs is determined by a profile of the user or the user project to which the user belongs as indicated by the profile of the user.

4. The method of claim 1, further comprising

interacting with a user to collect human-provided artifact metadata including the information indicative of a level of use or user rating of the respective artifact community.

5. The method of claim 1, wherein the artifact is stored in the software repository according to the Open Source Definition, the software repository being an open source repository.

6. The method of claim 1,

wherein the metadata is monitored for an actionable change every time any piece of metadata is changed.

7. A computer system, comprising:

a transceiver operable to transmit and receive communications over at least a portion of a network; and

a processor cooperatively operable with the transceiver, and configured to facilitate;

collecting and storing artifact information related to one or more software artifacts, the artifact information including;

an artifact identifier for each of the one or more artifacts, project identifiers for any of one or more software projects that use each of the one or more artifacts, and information about the temporal version for the one or more artifacts;

collecting and storing project information related to the one or more software projects that use the one or more software artifacts, the project information including;

a project identifier for each of the one or more projects, and contact information for a user of the software project;

collecting, from a software repository by communication over the transceiver,

metadata associated with the one or more software artifacts, the metadata for each of the one or more software artifacts including;

information identifying the respective artifact, information about security risks associated with the respective artifact, information about a license associated with the respective artifact, or information indicative of a level of use or user rating of the respective artifact;

periodically or continually monitoring the metadata to determine whether there has been any actionable change in the metadata associated with the one or more software artifacts;

notifying the user of any software project that uses a software artifact for which there has been an actionable change about the actionable change, the notifying operation being performed via the transceiver using the contact information; and

wherein the project information includes evaluation criteria for each of the one or more software artifacts used by the project identifier for each of the one or more projects, the project evaluation criteria identifying what makes a change in the metadata actionable,

wherein the metadata is continually monitored for actionable changes, and

wherein the continual monitoring includes detecting a change in the metadata associated with the one or more software artifacts, and

determining whether the change in the metadata is actionable for a respective software project based on the evaluation criteria in a respective set of project information.

8. The computer system of claim 7,

wherein the information relating to the one or more respective artifacts further includes:

a group identifier uniquely identifying a publisher of the respective artifact, and

a version number uniquely indicating a temporal version of the respective artifact, and

wherein the artifact identifier uniquely identifies the respective artifact within the publisher.

9. The computer system of claim 7,

wherein the information relating to the one or more respective artifacts further includes:

a coordinate system identifier that identifies a coordinate system used, and

information identifying the respective artifact using the coordinate system.

10. The computer system of claim 9,

wherein the coordinate system is one of:

a Maven coordinate system, a P2 coordinate system, an Open Source Gateway initiative (OSGi) coordinate system, a RubyGems coordinate system, or a NuGet coordinate system.

11. The computer system of claim 7,

wherein the information indicative of a level of use or user rating of the respective artifact includes at least one of:

user-provided ranking information specific to the respective artifact obtained from a community of users to which the user belongs, or

an indication of a number of users with the community who are also using the respective artifact, and

wherein the community of users to which the user belongs is determined by a profile of the user or the user project to which the user belongs as indicated by the profile of the user.

12. The computer system of claim 9, wherein the processor is further configured to facilitate:

interacting with a user to collect human-provided metadata including the information indicative of a level of use or user rating of the respective artifact community.

13. The computer system of claim 7, wherein the artifact is stored in the software repository according to the Open Source Definition, the software repository being an open source repository.

14. The computer system of claim 7,

wherein the processor further comprises a calendar database configured to determine when to periodically monitor the metadata to determine whether there has been any actionable change in the metadata associated with the one or more software artifacts.

15. The computer system of claim 7,

wherein the metadata is monitored for an actionable change every time any piece of metadata is changed.

16. A non-transitory computer-readable medium comprising instructions for execution by a computer, the instructions including a computer-implemented method for providing a method for monitoring a software project, the instructions for implementing:

collecting and storing artifact information related to one or more software artifacts, the artifact information including;

an artifact identifier for each of the one or more artifacts, project identifiers for any of one or more software projects that use each of the one or more artifacts, information about the temporal version for the one or more artifacts;

collecting and storing project information related to the one or more software projects that use the one or more software artifacts, the project information including;

a project identifier for each of the one or more projects, and contact information for a user of the software project;

collecting, from a software repository by communication over the transceiver, metadata associated with the one or more software artifacts, the metadata for each of the one or more software artifacts including;

information identifying the respective artifact, information about security risks associated with the respective artifact, information about a license associated with the respective artifact, or information indicative of a level of use or user rating of the respective artifact;

periodically or continually monitoring the metadata to determine whether there has been any actionable change in the metadata associated with the one or more software artifacts;

notifying the user of any software project that uses a software artifact for which there has been an actionable change about the actionable change, the notifying operation being performed via the transceiver using the contact information; and

wherein the project information includes a evaluation criteria for each of the one or more software artifacts used by the project identifier for the each of the one or more projects, and contact information for a user of the software project, the project evaluation criteria identifying what makes a change in the metadata actionable,

wherein the metadata is continually monitored for actionable changes, and

wherein the instructions are for further implementing;

detecting a change in the metadata associated with the one or more software artifacts, and

determining whether the change in the metadata is actionable for a respective software project based on the evaluation criteria in a respective set of project information.

17. The non-transitory computer-readable medium of claim 16, wherein the information identifying the respective artifact includes:

a group identifier uniquely identifying a publisher of the respective artifact,

a version number uniquely indicating a temporal version of the respective artifact, and

an artifact identifier uniquely identifying the respective artifact within the publisher.

18. The non-transitory computer-readable medium of claim 16,

wherein the information regarding a level of use or user rating of the respective artifact includes at least one of:

user-provided ranking information specific to the respective artifact obtained from a community of users to which the user belongs, or

an indication of a number of users with the community who are also using the respective artifact, and

wherein the community of users to which the user belongs is determined by a profile of the user or the user project to which the user belongs as indicated by the profile of the user.

19. The non-transitory computer-readable medium of claim 16, wherein the instructions are for further implementing:

interacting with a user to collect human-provided artifact metadata including the information indicative of a level of use or user rating of the respective artifact community.

20. The non-transitory computer-readable medium of claim 16, wherein the artifact is stored in the software repository according to the Open Source Definition, the software repository being an open source repository.

21. The non-transitory computer-readable medium of claim 16, wherein the instructions implement monitoring metadata for an actionable change every time any piece of metadata is changed.