OSSARA: Abandonment Risk Assessment for Embedded Open Source Components

Analyzing Maintenance Activities of Software Libraries

“…A similar problem with transitive OSS dependencies is known from license violations which can be automatically detected [14] and addressed by implementing best-practices for open-source governance and compliance in companies [16]. Interestingly, there is an explicit call for future work to build a precise model for the automatic identification of unmaintained libraries [27,28] which motivates my work, but neglects to distinguish between the different maintenance activity states identified [9,10,12,18,22,36]. I plan to address this gap by moving from a binary to an multi-class approach.…”

“…Due to space limitations, concrete features for maintenance activities are not mentioned here, as a first literature review found over 30 sources. As maintenance activity labels, the states active, feature complete, dormant and inactive have been identified [9,10,12,18,22,36]. To better understand the underlying data, Choi et al proposed an unsupervised clustering approach ( -means) [7].…”

“…To address this gap, the aggregated abandonment risk for every OSS library in a system was computed by calculating the risk for each direct dependency including their direct dependencies. That means, transitive dependencies for the first level were included, however all transitive links are still missing [22]. One way to integrate the effect of transitive dependencies is by using different impact measurements, such as degree centrality, in-degree centrality, out-degree centrality and eigenvector centrality [1].…”

“…Different studies predicted specific features for different topics, such as health related features [22,37] or popularity measures [4,35]. Predictions for multivariate maintenance activity features are missing so far.…”

“…However, most research is limited due to lack of features, labels, and transitive links and is thus not applicable in the industry [28]. Either, the maintenance activities of transitive dependencies are not considered at all [9], or only the first level is included in the analysis [22]. To the best of my knowledge there is no research that fully captures the impact of direct and transitive dependencies in terms of their maintenance activities.…”