Method and system for monitoring a software artifact

• US 9,678,743 B2
• Filed: 12/11/2013
• Issued: 06/13/2017
• Est. Priority Date: 09/13/2011
• Status: Active Grant

• Current Assignee: Sonatype
• Original Assignee: Sonatype
• Inventors: Fox, Brian Edward, Orlina, Joel
• Primary Examiner(s): Dao, Thuy
• Assistant Examiner(s): Berman, Stephen
• Application Number:
  US14/102,713
• Publication Number:
  US 20140101633A1
• Time in Patent Office: 1,280 Days
• Field of Search: None
• CPC Class Codes: G06F 11/302 where the computing system component is a software system
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 11/3089 Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents software debugging using additional hardware using a specific debug interface G06F11/3656; performance evaluation by tracing or monitoring G06F11/3466
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 8/70 Software maintenance or management
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management

Abstract

A computer system is provided, comprising: a transceiver; and a processor configured to facilitate: collecting and storing information related to a software project having one or more software artifacts, the information including: a project identifier, artifact identifiers for the artifacts used by the project, information about the temporal version for the artifacts, and contact information for a project user; collecting, from a repository, artifact metadata associated with the software artifacts, the artifact metadata including: information identifying the artifact, information about security risks associated with the artifact, information about a license associated with the artifact, or information indicative of a level of use or user rating of the artifact; periodically monitoring the metadata to determine whether there has been any actionable change in the artifact metadata; and notifying the project user using the contact information if it is determined that there has been an actionable change in the artifact metadata.

Claims

1. A computer system, comprising:

a transceiver operable to transmit and receive communications over at least a portion of a network; and

a processor cooperatively operable with the transceiver, and configured to facilitate;

collecting and storing information of a released version of a software project that uses a plurality of software artifacts, the information for the software project including;

a project identifier for the project, artifact identifiers for all of the plurality of artifacts used by the project, information about the temporal version for all of the plurality of software artifacts used by the project, and contact information for a user of the software project;

collecting, from a software repository by communication over the transceiver, metadata associated with the plurality of software artifacts, the metadata for each of the plurality of software artifacts including;

information identifying the respective artifact, and user information indicative of an expected effectiveness of the respective artifact for its intended use;

periodically monitoring the metadata to determine whether there has been any actionable change in the metadata associated with the plurality of software artifacts; and

notifying the user of the software project via the transceiver using the contact information if it is determined that there has been an actionable change in the metadata associated with the plurality of software artifacts,

wherein the user information includes user-provided ranking information specific to the respective artifact obtained from a community of users to which the user belongs, and

wherein the community of users to which the user belongs is determined by a profile of the user or the user project to which the user belongs as indicated by the profile of the user.

2. The computer system of claim 1, wherein the artifact is stored in the software repository according to the Open Source Definition, the software repository being an open source repository.

3. The computer system of claim 1, wherein

the software project is a released version of the software project.

4. The computer system of claim 1, wherein

the software repository is a repository of software artifacts.

5. A computer system, comprising:

a transceiver operable to transmit and receive communications over at least a portion of a network; and

a processor cooperatively operable with the transceiver, and configured to facilitate;

collecting and storing information of a released version of a software project that uses a plurality of software artifacts, the information for the software project including;

a project identifier for the project, artifact identifiers for all of the plurality of artifacts used by the project, information about the temporal version for all of the plurality of software artifacts used by the project, and contact information for a user of the software project;

collecting, from a software repository by communication over the transceiver, metadata associated with the plurality of software artifacts, the metadata for each of the plurality of software artifacts including;

information identifying the respective artifact, information about security risks associated with the respective artifact, information about a license associated with the respective artifact, and user information indicative of an expected effectiveness of the respective artifact for its intended use;

periodically monitoring the metadata to determine whether there has been any actionable change in the metadata associated with the plurality of software artifacts; and

notifying the user of the software project via the transceiver using the contact information if it is determined that there has been an actionable change in the metadata associated with the plurality of software artifacts, and

wherein the processor is further configured to facilitate;

interacting with a user to collect human-provided metadata including the user information.

6. A computer-implemented method for monitoring a software project that includes one or more software artifacts for a user, comprising:

collecting, from the software repository by communication over the transceiver, project metadata of a released version of a software project that use a plurality of software artifacts, the information for the software project including;

a project identifier for the project, artifact identifiers for all of the plurality of software artifacts used by the respective project, information about the temporal version for all of the plurality of software artifacts used by the respective project, and contact information for a user of the software project;

collecting, from a software repository by communication over a transceiver, artifact metadata associated with each of the plurality of software artifacts, the artifact metadata including;

information identifying the respective artifact, and user information indicative of an expected effectiveness of the respective artifact for its intended use;

periodically monitoring the artifact metadata to determine whether there has been any actionable change in the artifact metadata associated with the plurality of software artifacts; and

notifying the user of the software project via the transceiver using the contact information if it is determined that there has been an actionable change in the artifact metadata associated with the plurality of software artifacts,

wherein the user information includes user-provided ranking information specific to the respective artifact obtained from a community of users to which the user belongs, and

wherein the community of users to which the user belongs is determined by a profile of the user or the user project to which the user belongs as indicated by the profile of the user.

7. The method of claim 6, further comprising

interacting with a user to collect human-provided artifact metadata including the user information.

8. The method of claim 6, wherein the artifact is stored in the software repository according to the Open Source Definition, the software repository being an open source repository.

9. The method of claim 6, wherein

the software project is a released version of the software project.

10. The method of claim 6, wherein

the software repository is a repository of software artifacts.

11. A non-transitory computer-readable medium comprising instructions for execution by a computer, the instructions including a computer-implemented method for providing a method for monitoring a software project, the instructions for implementing:

collecting, from the software repository by communication over the transceiver, project metadata of a released version of a software project that use a plurality of software artifacts, the information for the software project including;

a project identifier for the project, artifact identifiers for all of the plurality of software artifacts used by the respective project, information about the temporal version for all of the plurality of software artifacts used by the respective project, and contact information for a user of the software project;

collecting, from a software repository by communication over a transceiver, artifact metadata associated with each of the plurality of software artifacts, the artifact metadata including;

information identifying the respective artifact, and user information regarding an expected effectiveness of the respective artifact for its intended use;

periodically monitoring the artifact metadata to determine whether there has been any actionable change in the artifact metadata associated with the plurality of software artifacts; and

notifying the user of the software project via the transceiver using the contact information if it is determined that there has been an actionable change in the artifact metadata associated with the plurality of software artifacts,

wherein the user information includes user-provided ranking information specific to the respective artifact obtained from a community of users to which the user belongs, and

wherein the community of users to which the user belongs is determined by a profile of the user or the user project to which the user belongs as indicated by the profile of the user.

12. The non-transitory computer-readable medium of claim 11, wherein the instructions are for further implementing:

interacting with a user to collect human-provided artifact metadata including the user information.

13. The non-transitory computer-readable medium of claim 11, wherein the artifact is stored in the software repository according to the Open Source Definition, the software repository being an open source repository.

14. The non-transitory computer-readable medium of claim 11, wherein

the software project is a released version of the software project.

15. The non-transitory computer-readable medium of claim 11, wherein

the software repository is a repository of software artifacts.