Understanding software artifact provenance

Abstract

In a well designed software system, units of related functionality are organized into modules and classes, which are in turn arranged into inheritance trees, package hierarchies, components, libraries, frameworks, and services. The trade-offs between simplicity versus flexibility and power are carefully considered, and interfaces are designed that expose the key functional properties of a component while hiding much of the complexity of the implementation details. However, over time the design integrity of a well-engineered system tends to decay as new features are added, as new quality attributes are emphasized, and as old architectural knowledge is lost when experienced development personnel shift to new jobs. Consequently, as developers and as users we often find ourselves looking at a piece of functionality or other design artifact and wondering, "Why is this here?" That is, we would like to examine the provenance of an artifact to understand its history and why it is where it is within the current design of the system.In this brief paper, we sketch some of the dimensions of the broad problem of extracting and reasoning about the provenance of software development artifacts. As a motivating example, we also describe some recent related work that uses hashing to quickly and accurately identify version information of embedded Java libraries.Keywords: Software artifact provenance, software analytics, code cloning Paul, it is easy to be impressed by your body of work at a distance. There are so many important and well-cited papers over many years, and the tools and techniques you and your group have contributed have had concrete and demonstrable impact on the research community. But when I spent my sabbatical at CWI, I learned an awful lot from you about running a research group, and getting the best out of talented people. You make it seem so easy and effortless, although I know it is neither. Your management style is low key and encouraging, yet the yield is so high. Perhaps most importantly, I have seen how the young researchers you supervise -many of whom go on to careers in industry -come away with justifiable pride in their efforts, an understanding of exactly how their work fits into the grand scheme of things, and a strong belief in the value of research itself. Surely this is the right way to build an ongoing, vibrant, and collegial community of scientists, engineers, and practitioners.

Software Processes Analysis with Provenance

“…However, it should be considered that this event addressed the provenance challenges in the general scope and not specifically in the SP domain. The results dating from only 2005 also shows the lack of maturity of this research field and the need, as underscored by some authors [9][10] [16], for more scientific papers about using provenance in the context of SP.…”

“…It tracks the provenance of source code and generates provenance reports to facilitate the management of its intellectual property. Other works, such as [10] [16], motivate the need to model and extract software artifacts provenance. Davies et al [10] explore the recovery of the provenance of software artifacts by a broad set of techniques (signature matching, source code fact extraction, software clone detection, call flow graph matching, string matching, historical analyses etc.)…”

“…Davies et al [10] explore the recovery of the provenance of software artifacts by a broad set of techniques (signature matching, source code fact extraction, software clone detection, call flow graph matching, string matching, historical analyses etc.) and Godfrey [16] cites the PROV model specification and shows a motivating example that uses hashing to quickly and accurately identify version information of embedded Java libraries. Although these works deal with provenance in the context of software development, they do not address the provenance of SP as a whole.…”

Software provenance tracking at the scale of public source code

“…In the second part of this work we explore the implications of such a huge replication factor on the problem of software provenance tracking [19,20] at the massive scale of public source code, addressing our second research question:…”

Growth and Duplication of Public Source Code over Time: Provenance Tracking at Scale

“…In the last part of the paper, we explore the implications of such multiplication on the problem of software provenance tracking [14,15] for public source code. We ask ourselves: is it feasible to keep track of all the different contexts in which a given file or commit occur across the entire corpus?…”