Method, system, electronic device and storage medium for secure release of software products

Abstract

The present invention relates to the technical field of product security management, and provides a method, system, electronic device and storage medium for the safe release of software products. The safe release method comprises: in response to a software product release request, obtaining a product package and a dependent package of the product to be released, wherein both the product package and the dependent package carry at least a product identifier of the product to be released; performing security detection on the product package and the dependent package to determine whether they both comply with the current security rules; if so, releasing the product to be released to a software product library; if not, obtaining a target software package from the software product library, whose product identifier and data content are respectively consistent with the product identifier and data content of a vulnerability software package that does not comply with the current security rules, and carrying a security status identifier, replacing the vulnerability software package with the target software package, and then releasing the product to be released to the software product library. The present invention can automatically perform security detection and vulnerability repair on the software product to be released, and realize efficient and safe release of software products.

Description

Technical Field

[0001] The present invention relates to the technical field of product security management, and in particular to a method, system, electronic device and storage medium for securely publishing software products. Background Art

[0002] In the DevOps (a combination of Development and Operations) platform, security testing is required before releasing software products. If the software product references an insecure version of a dependency package, it will fail the security test and cannot be released.

[0003] With the rapid development of vulnerability technology, more and more dependent packages that were originally judged to be safe have been detected with new vulnerabilities; and the publishers of dependent packages often quickly fix the vulnerabilities and release new secure versions.

[0004] Therefore, in reality, when a software product cannot be released because it references an insecure version of a dependency package, there may already be a safe and usable version of the dependency package in the software product library. If the release fails due to the detection of a vulnerability, it will seriously affect the efficiency of product release and iteration.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present invention, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0006] In view of this, the present invention provides a method, system, electronic device and storage medium for securely publishing software products, which can automatically perform security detection and vulnerability repair on software products to be published, thereby achieving efficient and secure publishing of software products.

[0007] One aspect of the present invention provides a method for securely publishing a software product, comprising: in response to a software product publishing request, obtaining a product package and a dependent package of a product to be published, wherein both the product package and the dependent package carry at least a product identifier of the product to be published; performing security checks on the product package and the dependent package to determine whether both the product package and the dependent package comply with current security rules; if so, publishing the product to be published to a software product library; if not, obtaining a target software package from the software product library, the target software package having a product identifier and data content that are respectively consistent with the product identifier and data content of a vulnerable software package that does not comply with the current security rules and carrying a security status identifier, replacing the vulnerable software package with the target software package, and then publishing the product to be published to the software product library.

[0008] In some embodiments, the software product library stores multiple software products, and each software package of each software product carries a rule identifier based on which security testing of the software product is performed and an obtained status identifier, and the status identifier includes the security status identifier; after security testing of the product package and the dependent package, the software package that complies with the current security rule is marked with the rule identifier corresponding to the current security rule and the security status identifier.

[0009] In some embodiments, the product package and the dependent package both also carry a version identifier of the product to be released; when the product package and the dependent package are security checked, the process of performing a security check on a current software package includes: determining whether there is an existing software package in the software product library whose product identifier, version identifier and data content are respectively consistent with the product identifier, version identifier and data content of the current software package; if so, and the existing software package carries the security status identifier, determining whether the rule identifier of the existing software package is consistent with the rule identifier corresponding to the current security rule; if they are consistent, determining that the current software package complies with the current security rule; if they are inconsistent, performing a security check on the current software package according to the current security rule; if so, and the existing software package carries an unsafe status identifier, determining that the current software package does not comply with the current security rule; and, if not, performing a security check on the current software package according to the current security rule.

[0010] In some embodiments, if there is inconsistency, after performing a security check on the current software package according to the current security rules, it also includes: if the current software package complies with the current security rules, updating the rule identifier of the existing software package to the rule identifier corresponding to the current security rules; if the current software package does not comply with the current security rules, updating the rule identifier and status identifier of the existing software package to the rule identifier corresponding to the current security rules and the unsafe status identifier, respectively.

[0011] In some embodiments, the product package and the dependent package both further carry a version identifier of the product to be released; the obtaining of the target software package whose product identifier and data content are respectively consistent with the product identifier and data content of the vulnerable software package that does not comply with the current security rules and carries a security status identifier includes: searching whether there is a replaceable software package in the software product library, the product identifier and data content of the replaceable software package being respectively consistent with the product identifier and data content of the vulnerable software package, the version identifier being higher than the version identifier of the vulnerable software package, and carrying the security status identifier; if so, determining whether the rule identifier of the latest version software package in the replaceable software package is consistent with the rule identifier corresponding to the current security rule; if they are consistent, determining that the latest version software package is the target software package; if they are inconsistent, performing a security check on the latest version software package according to the current security rules to determine whether the latest version software package complies with the current security rules; if they are consistent, determining that the latest version software package is the target software package.

[0012] In some embodiments, after determining whether the rule identifier of the latest version of the replaceable software package is consistent with the rule identifier corresponding to the current security rule, it includes: if it does not exist or does not match, returning a publishing failure message carrying vulnerability information to the publishing end that initiated the software product publishing request.

[0013] In some embodiments, replacing the vulnerable software package with the target software package includes: unpacking the product to be released; replacing the vulnerable software package with the target software package; and packaging the target software package and the security software package that complies with the current security rules to generate a new product to be released.

[0014] Another aspect of the present invention provides a software product security publishing system, including: a request response module, used to respond to a software product publishing request, obtain a product package and a dependent package of the product to be released, wherein the product package and the dependent package both carry at least a product identifier of the product to be released; a security detection module, used to perform security detection on the product package and the dependent package, and determine whether the product package and the dependent package both comply with current security rules; a product publishing module, used to publish the product to be released to a software product library when the security detection module determines that it is yes; and a vulnerability repair module, used to obtain a target software package from the software product library, whose product identifier and data content are respectively consistent with the product identifier and data content of a vulnerable software package that does not comply with the current security rules and carries a security status identifier, and after replacing the vulnerable software package with the target software package, publish the product to be released to the software product library.

[0015] Another aspect of the present invention provides an electronic device, comprising: a processor; a memory, wherein the memory stores executable instructions; wherein when the executable instructions are executed by the processor, the method for securely publishing a software product as described in any of the above embodiments is implemented.

[0016] Another aspect of the present invention provides a computer-readable storage medium for storing a program, wherein the program, when executed by a processor, implements the method for securely publishing a software product as described in any of the above embodiments.

[0017] The beneficial effects of the present invention compared with the prior art include at least:

[0018] The present invention performs security checks on product packages and dependent packages one by one, and comprehensively checks whether the software products to be released have vulnerabilities; when a software package with vulnerabilities is detected, a safe and replaceable software package is searched from the software product library to achieve automatic and rapid vulnerability repair; thereby, automatic security checks and vulnerability repairs are performed on the software products to be released, and efficient and safe release of software products is achieved, thereby improving the efficiency of product release and product iteration.

[0019] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present invention, and together with the specification are used to explain the principles of the present invention. Obviously, the accompanying drawings described below are only some embodiments of the present invention, and for those of ordinary skill in the art, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0021] Figure 1 A schematic diagram showing the steps of a method for securely publishing a software product in one embodiment of the present invention;

[0022] Figure 2 A schematic diagram showing the steps of performing security detection on a current software package in one embodiment of the present invention;

[0023] Figure 3 A schematic diagram showing steps of repairing a vulnerability software package in one embodiment of the present invention is shown;

[0024] Figure 4 A schematic diagram of a module of a secure publishing system for software products according to an embodiment of the present invention is shown;

[0025] Figure 5 A schematic diagram of a module of a secure publishing system for software products in another embodiment of the present invention is shown;

[0026] Figure 6 A schematic structural diagram of an electronic device in an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0027] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the embodiments set forth herein. Instead, these embodiments are provided to make the present invention comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art.

[0028] The same reference numerals in the figures denote the same or similar parts, and thus their repeated description will be omitted. Some of the block diagrams shown in the figures are functional entities, which do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0029] In addition, the processes shown in the accompanying drawings are only exemplary and do not necessarily include all the steps. For example, some steps can be decomposed, some steps can be combined or partially combined, and the actual execution order may change according to the actual situation. It should be noted that the embodiments of the present invention and the features in different embodiments can be combined with each other without conflict.

[0030] The product refers to a binary file generated by compiling and packaging source code. The software product referred to in the present invention mainly refers to the product in the field of computer cloud computing.

[0031] Figure 1 The main steps of a method for securely publishing a software product in one embodiment are shown. Figure 1 As shown, the method for securely publishing a software product includes: step S110, in response to a software product publishing request, obtaining a product package and a dependent package of the product to be published, wherein both the product package and the dependent package carry at least a product identifier of the product to be published; step S120, performing a security check on the product package and the dependent package to determine whether both the product package and the dependent package comply with current security rules; step S130, if yes, publishing the product to be published to a software product library; step S140, if no, obtaining from the software product library a target software package, whose product identifier and data content are respectively consistent with the product identifier and data content of a vulnerable software package that does not comply with current security rules and carries a security status identifier, replacing the vulnerable software package with the target software package, and publishing the product to be published to the software product library.

[0032] The product package of the product to be released refers to the basic software package of the software product to be released; the dependent package of the product to be released refers to the software package on which the basic software package depends for execution, and there are usually multiple dependent packages. The software product release request carries the product package and dependent packages of the product to be released. In addition to the product identifier of the product to be released, the product package and dependent package also carry the version identifier of the product to be released, and the product identifier and version identifier are combined as the unique identifier.

[0033] The software product library stores multiple software products, namely, various software products released in history. Each software package of each software product carries the rule identification based on which the security check of the software product is carried out and the obtained status identification. The status identification includes a safe status identification and may also include an unsafe status identification. The security rules will be continuously upgraded. When the security rules are updated, the security checks can be carried out on each software product in the software product library according to the new security rules, and the rule identification and status identification of the corresponding software package will be updated according to the test results.

[0034] After security checks are performed on product packages and dependent packages, the software packages that comply with the current security rules are also marked with the rule identifier and security status identifier corresponding to the current security rules, so that each software package published to the software product library carries the rule identifier and status identifier.

[0035] Therefore, when performing security management on software products, by creatively adding rule identifiers, it is possible to adapt to the constantly upgraded security rules; when performing security testing, it is possible to test the relevant software packages according to the latest security rules to ensure the security of newly released product packages and related dependent packages, and to avoid repeated testing of the same software packages; when vulnerabilities are discovered through security testing, it is possible to realize automated processing of security vulnerability repairs for software products by discovering alternative software packages.

[0036] Figure 2 The main steps of performing security detection on a current software package in one embodiment are shown. Figure 2 As shown, when security checks are performed one by one on the product packages and dependent packages of the product to be released, the detection processing process S200 for a current software package includes:

[0037] Step S210, determine whether there is an existing software package in the software product library whose product identification, version identification and data content are respectively consistent with those of the current software package. The same data content means that the two software packages can achieve the same functions.

[0038] Step S220: If it exists, continue to determine the security status of the existing software package.

[0039] Step S230: If the existing software package carries a security status identifier, it is determined whether the rule identifier of the existing software package is consistent with the rule identifier corresponding to the current security rule.

[0040] Step S240: If they are consistent, it is determined that the current software package complies with the current security rules.

[0041] Step S250: If not, perform a security check on the current software package according to the current security rules to determine whether the current software package complies with the current security rules.

[0042] Therefore, when performing security check on a current software package, if the same software package has not been checked before or the security rules have been updated, security check is performed according to the current security rules, otherwise there is no need to repeat the check, so as to improve the efficiency of software product release and save computing resources.

[0043] In step S250, after the current software package is security-checked according to the current security rules, the method further includes: step S250', if the current software package complies with the current security rules, that is, the test passes, the rule identifier of the existing software package is updated to the rule identifier corresponding to the current security rules; step S250", if the current software package does not comply with the current security rules, that is, the test fails, the rule identifier and the state identifier of the existing software package are respectively updated to the rule identifier and the unsafe state identifier corresponding to the current security rules, and the method proceeds to step S260 to determine that the current software package does not comply with the current security rules.

[0044] In addition, in step S220, if it is determined that there is and already is a software package carrying an unsafe status identifier, the process also proceeds to step S260, ie, it is determined that the current software package does not comply with the current security rules.

[0045] In step S210, if it is determined that it does not exist, the process proceeds to step S270 to perform a security check on the current software package according to the current security rules. If the check passes, the process proceeds to step S280 to determine that the current software package complies with the current security rules; if the check fails, the process proceeds to step S260 to determine that the current software package does not comply with the current security rules.

[0046] After determining that the current software package complies with the current security rule in step S240 and step S280, the method further includes step S290 of marking the current software package with a rule identifier and a status identifier, and performing a storage operation on the current software package.

[0047] After security checks on product packages and dependent packages, if all software packages comply with current security rules, the products to be released can be published to the software product library; if one or more software packages, usually dependent packages, are found to have security vulnerabilities, the automatic repair process is entered to search the software product library for safe and replaceable software packages.

[0048] Figure 3 The main steps of repairing a vulnerability software package in an embodiment are shown. Figure 3 As shown in the figure, the process of automatically repairing the vulnerability software package includes:

[0049] Step S310, searching whether there is a replaceable software package in the software product library, the product identification and data content of the replaceable software package are respectively consistent with the product identification and data content of the vulnerable software package, the version identification is higher than the version identification of the vulnerable software package (that is, the version of the replaceable software package is newer than the version of the vulnerable software package), and it carries a security status identification.

[0050] Step S320: If it exists, determine whether the rule identifier of the latest version of the software package in the replaceable software package is consistent with the rule identifier corresponding to the current security rule.

[0051] Step S330: If they are consistent, the latest version of the software package is determined to be a safe and replaceable target software package. Step S340 is then executed to replace the vulnerable software package with the target software package, which specifically includes: unpacking the product to be released; replacing the vulnerable software package with the target software package; and repackaging the target software package and the secure software package that complies with the current security rules to generate a new product to be released.

[0052] Step S350, if not, perform a security check on the latest version of the software package according to the current security rules to determine whether the latest version of the software package complies with the current security rules. If the check passes, that is, it is determined to be compliant, then proceed to step S330 to determine that the latest version of the software package is the target software package. If the check fails, that is, it is determined to be compliant, then proceed to step S360 to determine that there is no replacement software package for the vulnerable software package and the vulnerability repair fails.

[0053] In addition, if the search in step S310 does not exist, the process also proceeds to step S360 to determine that there is no replacement software package for the vulnerable software package and the vulnerability repair fails.

[0054] Furthermore, after step S360, a publishing failure message carrying vulnerability information may be returned to the publisher that initiated the software product publishing request, so that the publisher of the software product can promptly understand the publishing failure and vulnerability situation and make improvements.

[0055] In summary, the method for securely releasing software products of the present invention performs security checks on the product packages and dependent packages of the products to be released one by one, and comprehensively checks whether the software products to be released have vulnerabilities; when a software package with a vulnerability is detected, a safe and replaceable software package is searched from the software product library to achieve automatic and rapid vulnerability repair; thereby, automatic security checks and vulnerability repairs are performed on the software products to be released, efficient and secure release of software products is achieved, and the efficiency of product release and product iteration is improved.

[0056] The embodiment of the present invention also provides a software product security release system, which can be used to implement the software product security release method described in any of the above embodiments. The features and principles of the software product security release method described in any of the above embodiments can be applied to the following software product security release system embodiment. In the following system embodiment, the features and principles of the security release of software products that have been explained will not be repeated.

[0057] Figure 4 The main modules of the secure publishing system for software products in one embodiment are shown, referring to Figure 4 As shown, the software product security publishing system 400 in this embodiment includes: a request response module 410, which is used to respond to a software product publishing request and obtain a product package and a dependent package of the product to be released, wherein both the product package and the dependent package carry at least a product identifier of the product to be released; a security detection module 420, which is used to perform security detection on the product package and the dependent package to determine whether both the product package and the dependent package comply with current security rules; a product publishing module 430, which is used to publish the product to be released to the software product library when the security detection module determines that it is yes; and a vulnerability repair module 440, which is used to obtain a target software package from the software product library, whose product identifier and data content are respectively consistent with the product identifier and data content of the vulnerable software package that does not comply with the current security rules and carries a security status identifier, and after replacing the vulnerable software package with the target software package, publish the product to be released to the software product library.

[0058] Furthermore, the software product security publishing system 400 may also include modules for implementing other process steps of the above-mentioned software product security publishing method embodiments.

[0059] For example, Figure 5 The main modules of the security release system of software products in another embodiment are shown, referring to Figure 5 As shown, in this embodiment, the security detection module 420 may include a Figure 2 The various modules of the software package detection processing flow shown in the figure, such as the existing software package search module 4202, the rule identification matching module 4204, the current security rule detection module 4206, the identification marking / update module 4208, etc. The vulnerability repair module 440 may include a Figure 3 The various modules of the automatic vulnerability repair process shown, such as the replacement software package search module 4402, the rule identification matching module 4404, the current security rule detection module 4406, the software package replacement and update module 4408, etc.

[0060] Figure 4 and Figure 5The specific principles of each module of the software product security publishing system can refer to the description of the above-mentioned software product security publishing method embodiments, and will not be repeated here.

[0061] The software product security release system of the present invention performs security checks on product packages and dependent packages one by one to comprehensively check whether the software products to be released have vulnerabilities; when a software package with vulnerabilities is detected, a safe and replaceable software package is searched from the software product library to achieve automatic and rapid vulnerability repair; thereby, automatic security checks and vulnerability repairs are performed on the software products to be released, achieving efficient and secure release of software products, and improving the efficiency of product release and product iteration.

[0062] An embodiment of the present invention further provides an electronic device, including a processor and a memory, wherein executable instructions are stored in the memory, and when the executable instructions are executed by the processor, the method for securely publishing a software product described in any of the above embodiments is implemented.

[0063] The electronic device of the present invention can perform security checks on product packages and dependent packages one by one, and comprehensively check whether the software products to be released have vulnerabilities; when a software package with vulnerabilities is detected, a safe and replaceable software package is searched from the software product library to achieve automatic and rapid vulnerability repair; thereby, automatic security checks and vulnerability repairs are performed on the software products to be released, and efficient and safe release of software products is achieved, thereby improving the efficiency of product release and product iteration.

[0064] Figure 6 is a schematic diagram of the structure of an electronic device in an embodiment of the present invention. It should be understood that: Figure 6 The modules are only schematically shown, and these modules may be virtual software modules or actual hardware modules. The combination and splitting of these modules and the addition of other modules are all within the protection scope of the present invention.

[0065] like Figure 6 As shown, the electronic device 600 is in the form of a general computing device. The components of the electronic device 600 include but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different platform components (including the storage unit 620 and the processing unit 610), a display unit 640, etc.

[0066] The storage unit stores program codes, which can be executed by the processing unit 610, so that the processing unit 610 executes the steps of the software product security release method described in any of the above embodiments. For example, the processing unit 610 can execute the following steps: Figures 1 to 3 Steps shown.

[0067] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache memory unit 6202 , and may further include a read-only memory unit (ROM) 6203 .

[0068] The storage unit 620 may also include a program / utility 6204 having one or more program modules 6205, such program modules 6205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0069] Bus 630 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0070] The electronic device 600 can also communicate with one or more external devices 700, which can be one or more of a keyboard, a pointing device, a Bluetooth device, etc. These external devices 700 enable the user to communicate interactively with the electronic device 600. The electronic device 600 can also communicate with one or more other computing devices, and the computer device shown includes a router and a modem. This communication can be performed through an input / output (I / O) interface 650. In addition, the electronic device 600 can also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN) and / or a public network, such as the Internet) through a network adapter 660. The network adapter 660 can communicate with other modules of the electronic device 600 through a bus 630. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage platforms.

[0071] The embodiment of the present invention further provides a computer-readable storage medium for storing a program, which implements the method for securely publishing a software product described in any of the above embodiments when the program is executed. In some possible implementations, various aspects of the present invention may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the method for securely publishing a software product described in any of the above embodiments.

[0072] When the storage medium of the present invention is executed, it can perform security checks on product packages and dependent packages one by one, and comprehensively check whether the software products to be released have vulnerabilities; when a software package with vulnerabilities is detected, a safe and replaceable software package is searched from the software product library to achieve automatic and rapid vulnerability repair; thereby, automatic security checks and vulnerability repairs are performed on the software products to be released, efficient and safe release of software products is achieved, and the efficiency of product release and product iteration is improved.

[0073] The program product may be a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0074] The program product may adopt any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media include, but are not limited to: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0075] The readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein the readable program code is carried. The data signal of this propagation may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0076] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device, such as through the Internet using an Internet service provider.

[0077] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A method for securely publishing a software product, characterized in that: include: In response to a software product release request, obtaining a product package and a dependent package of the product to be released, wherein both the product package and the dependent package carry at least a product identifier of the product to be released; Perform security checks on the product package and the dependent package to determine whether the product package and the dependent package comply with current security rules; If yes, publish the to-be-published product to the software product library; If not, obtaining a target software package from the software product library, the product identification and data content of which are respectively consistent with the product identification and data content of the vulnerable software package that does not comply with the current security rule and carrying a security status identification, replacing the vulnerable software package with the target software package, and then publishing the to-be-published product to the software product library; The software product library stores a plurality of software products, and each software package of each software product carries a rule identifier based on which the security detection of the software product is performed and an obtained status identifier, wherein the status identifier includes the security status identifier; After the product package and the dependent package are security checked, the software package that complies with the current security rule is marked with a rule identifier corresponding to the current security rule and a security status identifier; The product package and the dependent package also carry the version identifier of the product to be released; When the product package and the dependent package are security checked, the process of security checking a current software package includes: Determine whether there is an existing software package in the software product library whose product identification, version identification and data content are respectively consistent with the product identification, version identification and data content of the current software package; If it exists and the existing software package carries the security status identifier, determining whether the rule identifier of the existing software package is consistent with the rule identifier corresponding to the current security rule; If they are consistent, it is determined that the current software package complies with the current security rules; if they are inconsistent, a security check is performed on the current software package according to the current security rules; If the existing software package exists and carries an unsafe status identifier, determining that the current software package does not comply with the current security rule; and If not, perform a security check on the current software package according to the current security rule.

2. The secure publishing method according to claim 1, wherein: If the software package is inconsistent, after performing a security check on the software package according to the current security rules, the method further includes: If the current software package complies with the current security rule, updating the rule identifier of the existing software package to the rule identifier corresponding to the current security rule; If the current software package does not comply with the current security rule, the rule identifier and the state identifier of the existing software package are updated to the rule identifier corresponding to the current security rule and the unsafe state identifier, respectively.

3. The secure publishing method according to claim 1, wherein: The product package and the dependent package also carry the version identifier of the product to be released; The step of obtaining a target software package, whose product identification and data content are respectively consistent with the product identification and data content of a vulnerable software package that does not comply with the current security rule and carries a security status identification, includes: Searching whether there is a replaceable software package in the software product library, wherein the product identifier and data content of the replaceable software package are respectively consistent with the product identifier and data content of the vulnerable software package, the version identifier is higher than the version identifier of the vulnerable software package, and the replaceable software package carries the security status identifier; If so, determining whether the rule identifier of the latest version of the replaceable software package is consistent with the rule identifier corresponding to the current security rule; If they are consistent, determining the latest version software package as the target software package; If they are inconsistent, performing a security check on the latest version of the software package according to the current security rules to determine whether the latest version of the software package complies with the current security rules; If yes, the latest version software package is determined to be the target software package.

4. The secure publishing method according to claim 3, characterized in that: After determining whether the rule identifier of the latest version of the replaceable software package is consistent with the rule identifier corresponding to the current security rule, the method includes: If it does not exist or does not match, a publishing failure message carrying vulnerability information is returned to the publishing end that initiated the software product publishing request.

5. The secure publishing method according to claim 1, wherein: The step of replacing the vulnerable software package with the target software package includes: Unpacking the product to be released; Replacing the vulnerable software package with the target software package; The target software package and the security software package that complies with the current security rule are packaged to generate a new product to be released.

6. A secure publishing system for software products, characterized in that: include: A request response module, used to respond to a software product release request and obtain a product package and a dependent package of the product to be released, wherein both the product package and the dependent package carry at least a product identifier of the product to be released; A security detection module is used to perform security detection on the product package and the dependent package to determine whether the product package and the dependent package comply with current security rules; A product publishing module, used for publishing the product to be published to the software product library when the security detection module determines that it is yes; a vulnerability repair module, for, when the security detection module determines that the target software package is not in compliance with the current security rule, obtaining a target software package from the software product library, the product identification and data content of which are respectively consistent with the product identification and data content of the vulnerable software package that does not comply with the current security rule, and carrying a security status identification, replacing the vulnerable software package with the target software package, and then publishing the to-be-published product to the software product library; The software product library stores a plurality of software products, and each software package of each software product carries a rule identifier based on which the security detection of the software product is performed and an obtained status identifier, wherein the status identifier includes the security status identifier; After the security detection module performs security detection on the product package and the dependent package, the software package that complies with the current security rule is marked with a rule identifier corresponding to the current security rule and a security status identifier; The product package and the dependent package also carry the version identifier of the product to be released; When the security detection module performs security detection on the product package and the dependent package, the process of performing security detection on a current software package includes: Determine whether there is an existing software package in the software product library whose product identification, version identification and data content are respectively consistent with the product identification, version identification and data content of the current software package; If it exists and the existing software package carries the security status identifier, determining whether the rule identifier of the existing software package is consistent with the rule identifier corresponding to the current security rule; If they are consistent, it is determined that the current software package complies with the current security rules; if they are inconsistent, a security check is performed on the current software package according to the current security rules; If the existing software package exists and carries an unsafe status identifier, determining that the current software package does not comply with the current security rule; and If not, perform a security check on the current software package according to the current security rule.

7. An electronic device, characterized in that: include: A processor; a memory storing executable instructions; Wherein, when the executable instruction is executed by the processor, the method for securely publishing a software product as described in any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium for storing a program, characterized in that: When the program is executed by a processor, the method for securely publishing a software product as described in any one of claims 1 to 5 is implemented.

Images