SEAL-BASED REGULATION FOR SOFTWARE DEPLOYMENT MANAGEMENT

• US 20150199188A1
• Filed: 01/13/2014
• Published: 07/16/2015
• Est. Priority Date: 01/13/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Mantripragada, Nagesh K., Mungi, Ashish, Viswanathan, Ram, Sodhi, Manjit S.
• Granted Patent: US 9,383,984 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3616 using software metrics
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management

Abstract

An approach is provided for managing a deployment of a software package. A retrieved quality assurance (QA) seal corresponding to a software package is verified. A target deployment environment (TDE) is obtained. The QA seal is read to obtain first and second profiles, and metadata, which specify a deployment environment, hardware and software dependencies required in the deployment, and an approval for a release of the software package to the specified deployment environment, respectively. Based on a determination that the TDE matches the specified deployment environment, the QA seal indicates the software package is compatible with the TDE. The dependencies are determined to be satisfied. Based on the software package being compatible with the TDE, the dependencies being satisfied, and the specified approval for the release of the software package, a notification of an authorization of the deployment of the software package to the TDE is generated.

Claims

1. A method of managing a deployment of a software package, the method comprising the steps of:

a computer retrieving from a first data repository a software package and retrieving a quality assurance (QA) seal associated with the software package in the first data repository, the QA seal being a data structure;

the computer verifying the QA seal by finding the QA seal in a second data repository that stores a plurality of QA seals;

the computer obtaining a target deployment environment for the deployment of the software package;

the computer reading a first profile in the QA seal, the first profile specifying an environment for the deployment of the software package;

the computer determining the target deployment environment matches the environment specified by the first profile in the QA seal;

based on the target deployment environment matching the environment specified by the first profile in the QA seal, the computer determining the QA seal indicates the software package is compatible with the target deployment environment;

the computer reading a second profile in the QA seal, the second profile specifying dependencies of hardware and software required in the deployment of the software package;

the computer determining the dependencies are satisfied based on the environment specified by the first profile in the QA seal;

the computer reading metadata in the QA seal, the metadata specifying the software package is approved for a release to the environment specified by the first profile in the QA seal; and

based on the software package being compatible with the target deployment environment, the dependencies being satisfied, and the software package being approved for the release to the environment, the computer generating a notification of an authorization of the deployment of the software package to the target deployment environment.

2. The method of claim 1, further comprising the steps of:

subsequent to (1) a completion of development, build and test phases of a software development lifecycle for developing the software package, (2) a determination that testing of the software package is successful, (3) a performance of a quality assurance verification and validation of the software package, (4) a verification of prior approvals for quality gates and decision checkpoints, and (5) a receipt of final approval for releasing the software package to the first data repository, and prior to the step of retrieving the software package, the computer generating the QA seal;

prior to the step of retrieving the software package and subsequent to the step of generating the QA seal, the computer associating the QA seal to the software package; and

prior to the step of retrieving the software package and subsequent to the step of associating the QA seal, the computer storing the software package and the associated QA seal in the first data repository.

3. The method of claim 2, wherein the step of generating the QA seal includes the steps of:

the computer retrieving a specification of components of the software package, the specification of the components including respective names of the components, versions of the components, build dates of the components, build identifiers of the components, and authors of the components;

the computer retrieving a specification of a user who requests a generation of the QA seal, the specification of the user including an identifier of the user, a name of the user, and a timestamp of request for the step of generating the QA seal;

the computer retrieving a specification of hardware and software included in an environment for the step of generating the QA seal, a build environment for building the software package, a test environment for testing the software package, and the target deployment environment;

the computer retrieving the dependencies of the hardware and software required in the deployment of the software package;

the computer retrieving an identification of one or more phases of a software development lifecycle for developing the software package, the one or more phases including a build phase, a test phase, and/or a release phase;

the computer retrieving details about a workflow that specifies an identifier of a reviewer of the software package;

a name of the reviewer, a status of an approval of the software package, and a status of the software package at key decision checkpoints;

the computer aligning the retrieved specification of the components of the software to data required in a third profile in the QA seal;

the computer aligning the retrieved specification of the user to data required in a fourth profile in the QA seal;

the computer aligning the retrieved specification of the hardware and software to data required in the first profile in the QA seal;

the computer aligning the retrieved dependencies to data required in the second profile in the QA seal;

the computer aligning the retrieved identification of the one or more phases to data required in a fifth profile in the QA seal;

the computer aligning the retrieved details about the workflow to data required in a sixth profile in the QA seal;

the computer generating a security token that specifies a signature or an encryption of the software package;

the computer aligning the generated security token with data required in a security token in the QA seal; and

the computer storing the aligned specification of the components of the software package, specification of the user, specification of the hardware and software, dependencies, identification of the one or more phases, details of the workflow, and generated security token in the QA seal and store the QA seal in the second data repository.

4. The method of claim 2, wherein the step of associating the QA seal to the software package includes the steps of:

the computer retrieving the software package from the first data repository;

the computer retrieving the QA seal from the second data repository;

the computer generating an entry of the QA seal in association with the software package;

the computer optionally encrypting the entry;

the computer storing the entry in the first data repository; and

the computer updating QA seal metadata in the QA seal, the QA seal metadata including a timestamp of a completion of the step of generating the QA seal, a history of modification of the QA seal, a status of approval of the QA seal, and a phase included in a plurality of phases of a software development lifecycle for developing the software package, the phase being specified in a profile in the QA seal.

5. The method of claim 1, further comprising the steps of:

subsequent to a completion of a development phase of a software development lifecycle for developing the software package and prior to the step of retrieving the software package, the computer performing a build phase of the software development lifecycle and determining the build phase is successful;

prior to the step of retrieving the software package and based on the build phase being successful, the computer generating the QA seal to verify the software package resulting from the build phase;

prior to the step of retrieving the software package and in response to the step of generating the QA seal to verify the software package resulting from the build phase, the computer associating the QA seal to the software package resulting from the build phase;

prior to the step of retrieving the software package and in response to the step of associating the QA seal to the software package resulting from the build phase, the computer verifying the QA seal associated to the software package resulting from the build phase;

prior to the step of retrieving the software package and subsequent to the step of verifying the QA seal associated to the software package resulting from the build phase, the computer performing a build verification testing of the software package;

prior to the step of retrieving the software package and subsequent to the step of performing the build verification testing, the computer updating the QA seal to test the software package resulting from the build verification testing;

prior to the step of retrieving the software package and subsequent to the step of updating the QA seal to test the software package resulting from the build verification testing, the computer associating the updated QA seal to the software package resulting the build verification testing;

prior to the step of retrieving the software package, the computer verifying the updated QA seal associated to the software package resulting from the build verification testing;

prior to the step of retrieving the software package and subsequent to (1) a completion of formal testing of the software package resulting from the build verification testing, (2) a determination that the formal testing of the software package is successful, (3) a performance of a quality assurance verification and validation of the software package, (4) a verification of prior approvals for quality gates and decision checkpoints, and (5) a receipt of final approval for releasing the software package to the first data repository, the computer updating the QA seal again to specify the software package as a final software package;

prior to the step of retrieving the software package and subsequent to the step of updating the QA seal to specify the software package as the final software package, the computer associating the again updated QA seal to the final software package; and

prior to the step of retrieving the software package and subsequent to the step of associating the again updated QA seal, the computer storing the final software package and the associated QA seal in the first data repository.

6. The method of claim 5, wherein the step of verifying the QA seal associated to the software package resulting from the build phase includes the steps of:

the computer determining whether the software package is encrypted and decrypting the software package in response to a determination that the software package is encrypted;

the computer determining that the software package has the QA seal;

the computer reading the QA seal of the software package;

the computer determining whether the QA seal of the software package matches a QA seal in the second data repository;

in response to a determination the QA seal of the software package matches a QA seal in the second data repository, the computer determining whether the QA seal of the software package matches exactly one QA seal in the second data repository; and

in response to a determination the QA seal of the software package matches exactly one QA seal in the second data repository, the computer determining the QA seal of the software package is successfully verified.

7. The method of claim 1, further comprising the steps of:

subsequent to a completion of a development phase of a software development lifecycle for developing the software package and prior to the step of retrieving the software package, the computer performing a build phase of the software development lifecycle and determining the build phase is successful;

prior to the step of retrieving the software package and based on the build phase being successful, the computer generating a first QA seal to verify the software package resulting from the build phase;

prior to the step of retrieving the software package and in response to the step of generating the first QA seal to verify the software package resulting from the build phase, the computer associating the first QA seal to the software package resulting from the build phase;

prior to the step of retrieving the software package and in response to the step of associating the first QA seal to the software package resulting from the build phase, the computer verifying the first QA seal associated to the software package resulting from the build phase;

prior to the step of retrieving the software package and subsequent to the step of verifying the first QA seal associated to the software package resulting from the build phase, the computer performing a build verification testing of the software package;

prior to the step of retrieving the software package and subsequent to the step of performing the build verification testing, the computer generating a second QA seal to test the software package resulting from the build verification testing;

prior to the step of retrieving the software package and subsequent to the step of generating the second QA seal to test the software package resulting from the build verification testing, the computer associating the second QA seal to the software package resulting the build verification testing;

prior to the step of retrieving the software package, the computer verifying the second QA seal associated to the software package resulting from the build verification testing;

prior to the step of retrieving the software package and subsequent to (1) a completion of formal testing of the software package resulting from the build verification testing, (2) a determination that the formal testing of the software package is successful, (3) a performance of a quality assurance verification and validation of the software package, (4) a verification of prior approvals for quality gates and decision checkpoints, and (5) a receipt of final approval for releasing the software package to the first data repository, the computer generating a third QA seal to specify the software package as a final software package;

prior to the step of retrieving the software package and subsequent to the step of generating the third QA seal to specify the software package as the final software package, the computer associating the third QA seal to the final software package; and

prior to the step of retrieving the software package and subsequent to the step of associating the third QA seal, the computer storing the final software package and the associated third QA seal in the first data repository.

8. The method of claim 1, further comprising the step of:

providing at least one support service for at least one of creating, integrating, hosting, maintaining, and deploying computer-readable program code in the computer, the program code being executed by a processor to implement the steps of retrieving the software package, retrieving the QA seal, verifying the QA seal, obtaining the target deployment environment, reading the first profile, determining the target deployment environment matches the environment specified by the first profile, determining the QA seal indicates the software package is compatible with the target deployment environment, reading the second profile, determining the dependencies are satisfied, reading metadata, and generating the notification.

9. A computer system comprising:

a central processing unit (CPU);

a memory coupled to the CPU; and

a computer-readable, tangible storage device coupled to the CPU, the storage device containing instructions that are executed by the CPU via the memory to implement a method of managing a deployment of a software package, the method comprising the steps of;

the computer system retrieving from a first data repository a software package and retrieving a quality assurance (QA) seal associated with the software package in the first data repository, the QA seal being a data structure;

the computer system verifying the QA seal by finding the QA seal in a second data repository that stores a plurality of QA seals;

the computer system obtaining a target deployment environment for the deployment of the software package;

the computer system reading a first profile in the QA seal, the first profile specifying an environment for the deployment of the software package;

the computer system determining the target deployment environment matches the environment specified by the first profile in the QA seal;

based on the target deployment environment matching the environment specified by the first profile in the QA seal, the computer system determining the QA seal indicates the software package is compatible with the target deployment environment;

the computer system reading a second profile in the QA seal, the second profile specifying dependencies of hardware and software required in the deployment of the software package;

the computer system determining the dependencies are satisfied based on the environment specified by the first profile in the QA seal;

the computer system reading metadata in the QA seal, the metadata specifying the software package is approved for a release to the environment specified by the first profile in the QA seal; and

based on the software package being compatible with the target deployment environment, the dependencies being satisfied, and the software package being approved for the release to the environment, the computer system generating a notification of an authorization of the deployment of the software package to the target deployment environment.

10. The computer system of claim 9, wherein the method further comprises the steps of:

subsequent to (1) a completion of development, build and test phases of a software development lifecycle for developing the software package, (2) a determination that testing of the software package is successful, (3) a performance of a quality assurance verification and validation of the software package, (4) a verification of prior approvals for quality gates and decision checkpoints, and (5) a receipt of final approval for releasing the software package to the first data repository, and prior to the step of retrieving the software package, the computer system generating the QA seal;

prior to the step of retrieving the software package and subsequent to the step of generating the QA seal, the computer system associating the QA seal to the software package; and

prior to the step of retrieving the software package and subsequent to the step of associating the QA seal, the computer system storing the software package and the associated QA seal in the first data repository.

11. The computer system of claim 10, wherein the step of generating the QA seal includes the steps of:

the computer system retrieving a specification of components of the software package, the specification of the components including respective names of the components, versions of the components, build dates of the components, build identifiers of the components, and authors of the components;

the computer system retrieving a specification of a user who requests a generation of the QA seal, the specification of the user including an identifier of the user, a name of the user, and a timestamp of request for the step of generating the QA seal;

the computer system retrieving a specification of hardware and software included in an environment for the step of generating the QA seal, a build environment for building the software package, a test environment for testing the software package, and the target deployment environment;

the computer system retrieving the dependencies of the hardware and software required in the deployment of the software package;

the computer system retrieving an identification of one or more phases of a software development lifecycle for developing the software package, the one or more phases including a build phase, a test phase, and/or a release phase;

the computer system retrieving details about a workflow that specifies an identifier of a reviewer of the software package;

a name of the reviewer, a status of an approval of the software package, and a status of the software package at key decision checkpoints;

the computer system aligning the retrieved specification of the components of the software to data required in a third profile in the QA seal;

the computer system aligning the retrieved specification of the user to data required in a fourth profile in the QA seal;

the computer system aligning the retrieved specification of the hardware and software to data required in the first profile in the QA seal;

the computer system aligning the retrieved dependencies to data required in the second profile in the QA seal;

the computer system aligning the retrieved identification of the one or more phases to data required in a fifth profile in the QA seal;

the computer system aligning the retrieved details about the workflow to data required in a sixth profile in the QA seal;

the computer system generating a security token that specifies a signature or an encryption of the software package;

the computer system aligning the generated security token with data required in a security token in the QA seal; and

the computer system storing the aligned specification of the components of the software package, specification of the user, specification of the hardware and software, dependencies, identification of the one or more phases, details of the workflow, and generated security token in the QA seal and store the QA seal in the second data repository.

12. The computer system of claim 10, wherein the step of associating the QA seal to the software package includes the steps of:

the computer system retrieving the software package from the first data repository;

the computer system retrieving the QA seal from the second data repository;

the computer system generating an entry of the QA seal in association with the software package;

the computer system optionally encrypting the entry;

the computer system storing the entry in the first data repository; and

the computer system updating QA seal metadata in the QA seal, the QA seal metadata including a timestamp of a completion of the step of generating the QA seal, a history of modification of the QA seal, a status of approval of the QA seal, and a phase included in a plurality of phases of a software development lifecycle for developing the software package, the phase being specified in a profile in the QA seal.

13. The computer system of claim 9, wherein the method further comprises the steps of:

subsequent to a completion of a development phase of a software development lifecycle for developing the software package and prior to the step of retrieving the software package, the computer system performing a build phase of the software development lifecycle and determining the build phase is successful;

prior to the step of retrieving the software package and based on the build phase being successful, the computer system generating the QA seal to verify the software package resulting from the build phase;

prior to the step of retrieving the software package and in response to the step of generating the QA seal to verify the software package resulting from the build phase, the computer system associating the QA seal to the software package resulting from the build phase;

prior to the step of retrieving the software package and in response to the step of associating the QA seal to the software package resulting from the build phase, the computer system verifying the QA seal associated to the software package resulting from the build phase;

prior to the step of retrieving the software package and subsequent to the step of verifying the QA seal associated to the software package resulting from the build phase, the computer system performing a build verification testing of the software package;

prior to the step of retrieving the software package and subsequent to the step of performing the build verification testing, the computer system updating the QA seal to test the software package resulting from the build verification testing;

prior to the step of retrieving the software package and subsequent to the step of updating the QA seal to test the software package resulting from the build verification testing, the computer system associating the updated QA seal to the software package resulting the build verification testing;

prior to the step of retrieving the software package, the computer system verifying the updated QA seal associated to the software package resulting from the build verification testing;

prior to the step of retrieving the software package and subsequent to (1) a completion of formal testing of the software package resulting from the build verification testing, (2) a determination that the formal testing of the software package is successful, (3) a performance of a quality assurance verification and validation of the software package, (4) a verification of prior approvals for quality gates and decision checkpoints, and (5) a receipt of final approval for releasing the software package to the first data repository, the computer system updating the QA seal again to specify the software package as a final software package;

prior to the step of retrieving the software package and subsequent to the step of updating the QA seal to specify the software package as the final software package, the computer system associating the again updated QA seal to the final software package; and

prior to the step of retrieving the software package and subsequent to the step of associating the again updated QA seal, the computer system storing the final software package and the associated QA seal in the first data repository.

14. The computer system of claim 13, wherein the step of verifying the QA seal associated to the software package resulting from the build phase includes the steps of:

the computer system determining whether the software package is encrypted and decrypting the software package in response to a determination that the software package is encrypted;

the computer system determining that the software package has the QA seal;

the computer system reading the QA seal of the software package;

the computer system determining whether the QA seal of the software package matches a QA seal in the second data repository;

in response to a determination the QA seal of the software package matches a QA seal in the second data repository, the computer system determining whether the QA seal of the software package matches exactly one QA seal in the second data repository; and

in response to a determination the QA seal of the software package matches exactly one QA seal in the second data repository, the computer system determining the QA seal of the software package is successfully verified.

15. A computer program product, comprising:

a computer-readable, tangible storage device; and

a computer-readable program code stored in the computer-readable, tangible storage device, the computer-readable program code containing instructions that are executed by a central processing unit (CPU) of a computer system to implement a method of managing a deployment of a software package, the method comprising the steps of;

the computer system retrieving from a first data repository a software package and retrieving a quality assurance (QA) seal associated with the software package in the first data repository, the QA seal being a data structure;

the computer system verifying the QA seal by finding the QA seal in a second data repository that stores a plurality of QA seals;

the computer system obtaining a target deployment environment for the deployment of the software package;

the computer system reading a first profile in the QA seal, the first profile specifying an environment for the deployment of the software package;

the computer system determining the target deployment environment matches the environment specified by the first profile in the QA seal;

based on the target deployment environment matching the environment specified by the first profile in the QA seal, the computer system determining the QA seal indicates the software package is compatible with the target deployment environment;

the computer system reading a second profile in the QA seal, the second profile specifying dependencies of hardware and software required in the deployment of the software package;

the computer system determining the dependencies are satisfied based on the environment specified by the first profile in the QA seal;

the computer system reading metadata in the QA seal, the metadata specifying the software package is approved for a release to the environment specified by the first profile in the QA seal; and

based on the software package being compatible with the target deployment environment, the dependencies being satisfied, and the software package being approved for the release to the environment, the computer system generating a notification of an authorization of the deployment of the software package to the target deployment environment.

16. The computer program product of claim 15, wherein the method further comprises the steps of:

subsequent to (1) a completion of development, build and test phases of a software development lifecycle for developing the software package, (2) a determination that testing of the software package is successful, (3) a performance of a quality assurance verification and validation of the software package, (4) a verification of prior approvals for quality gates and decision checkpoints, and (5) a receipt of final approval for releasing the software package to the first data repository, and prior to the step of retrieving the software package, the computer system generating the QA seal;

prior to the step of retrieving the software package and subsequent to the step of generating the QA seal, the computer system associating the QA seal to the software package; and

prior to the step of retrieving the software package and subsequent to the step of associating the QA seal, the computer system storing the software package and the associated QA seal in the first data repository.

17. The computer program product of claim 16, wherein the step of generating the QA seal includes the steps of:

the computer system retrieving a specification of components of the software package, the specification of the components including respective names of the components, versions of the components, build dates of the components, build identifiers of the components, and authors of the components;

the computer system retrieving a specification of a user who requests a generation of the QA seal, the specification of the user including an identifier of the user, a name of the user, and a timestamp of request for the step of generating the QA seal;

the computer system retrieving a specification of hardware and software included in an environment for the step of generating the QA seal, a build environment for building the software package, a test environment for testing the software package, and the target deployment environment;

the computer system retrieving the dependencies of the hardware and software required in the deployment of the software package;

the computer system retrieving an identification of one or more phases of a software development lifecycle for developing the software package, the one or more phases including a build phase, a test phase, and/or a release phase;

the computer system retrieving details about a workflow that specifies an identifier of a reviewer of the software package;

a name of the reviewer, a status of an approval of the software package, and a status of the software package at key decision checkpoints;

the computer system aligning the retrieved specification of the components of the software to data required in a third profile in the QA seal;

the computer system aligning the retrieved specification of the user to data required in a fourth profile in the QA seal;

the computer system aligning the retrieved specification of the hardware and software to data required in the first profile in the QA seal;

the computer system aligning the retrieved dependencies to data required in the second profile in the QA seal;

the computer system aligning the retrieved identification of the one or more phases to data required in a fifth profile in the QA seal;

the computer system aligning the retrieved details about the workflow to data required in a sixth profile in the QA seal;

the computer system generating a security token that specifies a signature or an encryption of the software package;

the computer system aligning the generated security token with data required in a security token in the QA seal; and

the computer system storing the aligned specification of the components of the software package, specification of the user, specification of the hardware and software, dependencies, identification of the one or more phases, details of the workflow, and generated security token in the QA seal and store the QA seal in the second data repository.

18. The computer program product of claim 16, wherein the step of associating the QA seal to the software package includes the steps of:

the computer system retrieving the software package from the first data repository;

the computer system retrieving the QA seal from the second data repository;

the computer system generating an entry of the QA seal in association with the software package;

the computer system optionally encrypting the entry;

the computer system storing the entry in the first data repository; and

the computer system updating QA seal metadata in the QA seal, the QA seal metadata including a timestamp of a completion of the step of generating the QA seal, a history of modification of the QA seal, a status of approval of the QA seal, and a phase included in a plurality of phases of a software development lifecycle for developing the software package, the phase being specified in a profile in the QA seal.

19. The computer program product of claim 15, wherein the method further comprises the steps of:

subsequent to a completion of a development phase of a software development lifecycle for developing the software package and prior to the step of retrieving the software package, the computer system performing a build phase of the software development lifecycle and determining the build phase is successful;

prior to the step of retrieving the software package and based on the build phase being successful, the computer system generating the QA seal to verify the software package resulting from the build phase;

prior to the step of retrieving the software package and in response to the step of generating the QA seal to verify the software package resulting from the build phase, the computer system associating the QA seal to the software package resulting from the build phase;

prior to the step of retrieving the software package and in response to the step of associating the QA seal to the software package resulting from the build phase, the computer system verifying the QA seal associated to the software package resulting from the build phase;

prior to the step of retrieving the software package and subsequent to the step of verifying the QA seal associated to the software package resulting from the build phase, the computer system performing a build verification testing of the software package;

prior to the step of retrieving the software package and subsequent to the step of performing the build verification testing, the computer system updating the QA seal to test the software package resulting from the build verification testing;

prior to the step of retrieving the software package and subsequent to the step of updating the QA seal to test the software package resulting from the build verification testing, the computer system associating the updated QA seal to the software package resulting the build verification testing;

prior to the step of retrieving the software package, the computer system verifying the updated QA seal associated to the software package resulting from the build verification testing;

prior to the step of retrieving the software package and subsequent to (1) a completion of formal testing of the software package resulting from the build verification testing, (2) a determination that the formal testing of the software package is successful, (3) a performance of a quality assurance verification and validation of the software package, (4) a verification of prior approvals for quality gates and decision checkpoints, and (5) a receipt of final approval for releasing the software package to the first data repository, the computer system updating the QA seal again to specify the software package as a final software package;

prior to the step of retrieving the software package and subsequent to the step of updating the QA seal to specify the software package as the final software package, the computer system associating the again updated QA seal to the final software package; and

prior to the step of retrieving the software package and subsequent to the step of associating the again updated QA seal, the computer system storing the final software package and the associated QA seal in the first data repository.

20. The computer program product of claim 19, wherein the step of verifying the QA seal associated to the software package resulting from the build phase includes the steps of:

the computer system determining whether the software package is encrypted and decrypting the software package in response to a determination that the software package is encrypted;

the computer system determining that the software package has the QA seal;

the computer system reading the QA seal of the software package;

the computer system determining whether the QA seal of the software package matches a QA seal in the second data repository;

in response to a determination the QA seal of the software package matches a QA seal in the second data repository, the computer system determining whether the QA seal of the software package matches exactly one QA seal in the second data repository; and

in response to a determination the QA seal of the software package matches exactly one QA seal in the second data repository, the computer system determining the QA seal of the software package is successfully verified.