Software evaluation method and device, and computer readable storage medium

Abstract

The present invention discloses a software evaluation method and device, and a computer-readable storage medium, wherein the software evaluation method comprises: obtaining a first software set, wherein the first software set comprises at least one first component, wherein the first component has identification and license information, and each first component comprises multiple first files, wherein the first files have identification and license information; obtaining a second software set; comparing the identification of each second component with the identification and license information of each first component to obtain a first comparison result; comparing the identification of each second file with the identification and license information of the first file of the first component to obtain a second comparison result; and generating an evaluation report of the second software set based on at least the first comparison result and the second comparison result. The above technical solution can be used to evaluate the second software set and generate an evaluation report of the second software set, and the evaluation report can accurately reflect the problems existing in the software set.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and more specifically, to a software evaluation method and device, and a computer-readable storage medium. Background Art

[0002] At present, most Internet companies adopt a "mixed source" development model when developing software, that is, they introduce open source code into the code themselves or from third-party code. However, if there are problems with the open source code, there will also be problems with the software collection when it is released, which will bring unknown risks to the company. Therefore, it is particularly important to evaluate the code.

[0003] When evaluating a code, the prior art only compares the code with a feature library, and provides a scan report generated by the comparison to an inspector for manual analysis.

[0004] However, when analyzing the scanning reports generated by the existing technology, the analysis work is highly dependent on the experience and ability of the inspectors, which can easily lead to misjudgment of the results. In addition, the inspection content is complicated, resulting in low inspection efficiency. Summary of the invention

[0005] The technical problem solved by the present invention is how to evaluate codes efficiently and accurately.

[0006] To solve the above technical problems, an embodiment of the present invention provides a software evaluation method, which includes: obtaining a first software set, the first software set includes at least one first component, the first component has an identification and license information, each first component includes multiple first files, and the first files have identification and license information; obtaining a second software set, the second software set includes at least one second component, the second component has an identification and license information, each second component includes multiple second files, and the second files have identification and license information; comparing the identification of each second component with the identification of each first component, and when there is a component pair of the first component and the second component with the same identification, comparing the license information of the component pair to obtain a first comparison result; comparing the identification of each second file included in the second component in the component pair with the identification of the first file included in the first component in the component pair, and when there is a file pair of the first file and the second file with the same identification, comparing the license information of the file pair to obtain a second comparison result; generating an evaluation report for the second software set based on at least the first comparison result and the second comparison result.

[0007] Optionally, obtaining the first software set includes: generating a software bill of materials based on the first software set, the software bill of materials including at least one software package data exchange file and a software bill of materials index, each software package data exchange file including identification and licensing information of first files included in the first component, the software bill of materials index including identification and licensing information of each first component, the licensing information including a license and / or copyright; obtaining identification and licensing information of each first component from the software bill of materials index, and obtaining identification and licensing information of each first file from the software package data exchange file.

[0008] Optionally, the software material table includes a package marking list, which includes dependency relationships between each first component, and the dependency relationships are used to indicate components that need to run or compile together; each software material table index is used to indicate the package marking list and software package data exchange file corresponding to the same component.

[0009] Optionally, generating the evaluation report of the second software set based at least on the first comparison result and the second comparison result includes: obtaining constraint information, the constraint information including constraint relationships between license information; determining dependency relationships between second components based on dependency relationships between first components in the package marking list; determining multiple second components with dependencies based on dependency relationships between second components; determining whether the license information of multiple second components complies with the constraint relationships; and adding information of each second component that does not comply with the constraint relationships to the evaluation report.

[0010] Optionally, the software package data exchange file includes a first checksum of each first component, and generating an evaluation report for the second software set based at least on the first comparison result and the second comparison result includes: generating a second checksum for each second file; comparing the second checksum of each second file with the first checksum of the corresponding first file; and adding information of second files whose second checksums are inconsistent with the first checksum of the corresponding first file to the evaluation report.

[0011] Optionally, generating an evaluation report for the second software set based at least on the first comparison result and the second comparison result includes: comparing the identifier of each second component with the identifiers of all first components in the software material list index; if there is no identifier consistent with the identifier of the second component among the identifiers of all first components, adding the information of the second component to the evaluation report; or, comparing the identifier of each first component with the identifiers of all second components; if there is no identifier consistent with the identifier of the first component among the identifiers of all second components, adding the information of the first component to the evaluation report.

[0012] Optionally, generating the evaluation report of the second software set at least according to the first comparison result and the second comparison result includes: adding the licensing information of the first file in all software package data exchange files to the evaluation report.

[0013] Optionally, generating the evaluation report of the second software set based on at least the first comparison result and the second comparison result includes: generating software component scanning data based on the first component, the software component scanning data including second code fragments in a feature library that match the first code fragments in each first file and their license information and positions, the feature library including multiple second code fragments and their license information and positions; comparing the license information of the matched second code fragments in the software component scanning data with the license information of the first file in the software package data exchange file; and adding the license information and position of the second code fragment whose license information is inconsistent with the license information of the first file to the evaluation report.

[0014] Optionally, generating the evaluation report of the second software set based on at least the first comparison result and the second comparison result includes: comparing the identifier of each second file with the identifiers of all first files in the software package data exchange file; if there is no identifier consistent with the identifier of the second file among the identifiers of all first files, adding the information of the second file to the evaluation report; or, comparing the identifier of each first file with the identifiers of all second files; if there is no identifier consistent with the identifier of the first file among the identifiers of all second files, adding the information of the first file to the evaluation report.

[0015] Optionally, generation time of the second software set is later than generation time of the first software set.

[0016] Optionally, the first component includes a derivative class component, and the derivative class component includes a patch file and a native component of its application. The generating of the evaluation report of the second software set based on at least the first comparison result and the second comparison result includes: obtaining all patch files in the derivative class component and the native components of its application; if a native component corresponds to a patch file, applying the patch file to the corresponding native component to obtain a result component, and comparing the code fragment of the native component with the code fragment of the result component to obtain a difference code fragment; if a native component corresponds to multiple patch files, iteratively determining the application component, applying each patch file to the application component, and comparing the code fragment of the applied application component with the code fragment of the application component to obtain a difference code fragment; adding the licensing information of the difference code fragment to the evaluation report.

[0017] Optionally, generating the evaluation report of the second software set based at least on the first comparison result and the second comparison result includes: determining whether the license information of each second component meets a first preset condition; and adding information of the second components whose license information does not meet the first preset condition to the evaluation report.

[0018] Optionally, generating the evaluation report of the second software set based at least on the first comparison result and the second comparison result includes: determining whether the license information of each second file meets a second preset condition; and adding information of the second files whose license information does not meet the second preset condition to the comparison result.

[0019] Optionally, the first software set and the second software set are software sets to be deployed.

[0020] Optionally, when the evaluation report meets preset standards, the license information of all second components is compared with each license information in the blacklist, and the license information of all second components is compared with each license information in the whitelist, the blacklist includes multiple license information, and the whitelist includes multiple license information; when the license information of any second component is consistent with any license information in the blacklist, the second component that is consistent with any license information in the blacklist is recorded; or, when the license information of each second component is consistent with any license information in the whitelist, the second software set is deployed.

[0021] Optionally, when the license information of the second component is inconsistent with any license information in the blacklist, and the license information of the second component is inconsistent with any license information in the whitelist, the license information of the second component is pushed to the terminal device; feedback information sent by the terminal device is obtained, and the feedback information includes agreement or rejection; when the feedback information is agreement, the second software set is deployed, and the license information of the second component is added to the whitelist; or, when the feedback information is rejection, the second component is recorded, and the license information of the second component is added to the blacklist.

[0022] The embodiment of the present invention also discloses a software evaluation device, the device comprising: a first software set acquisition module, used to acquire a first software set, the first software set comprising at least one first component, the first component having identification and license information, each first component comprising a plurality of first files, the first files having identification and license information; a second software set acquisition module, used to acquire a second software set, the second software set comprising at least one second component, the second component having identification and license information, each second component comprising a plurality of second files, the second files having identification and license information; a first comparison module, used to compare the identification of each second component with that of each second component; A first comparison module is used to compare the identifiers of the first components, and when there is a component pair of the first component and the second component with the same identifier, compare the license information of the component pair to obtain a first comparison result; a second comparison module is used to compare the identifiers of the second files included in the second component of the component pair with the identifiers of the first files included in the first component of the component pair, and when there is a file pair of the first file and the second file with the same identifier, compare the license information of the file pair to obtain a second comparison result; an evaluation report generation module is used to generate an evaluation report for the second software set based on at least the first comparison result and the second comparison result.

[0023] An embodiment of the present invention further discloses a server, comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, and when the computer program is executed by the processor, the steps of any one of the above-mentioned software evaluation methods are executed.

[0024] The embodiment of the present invention further discloses a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the above-mentioned software evaluation methods are executed.

[0025] Compared with the prior art, the technical solution of the embodiment of the present invention has the following beneficial effects:

[0026] The present invention proposes a software evaluation method, which facilitates the comparison between the first software set and the second software set by obtaining a first software set, and obtaining the identification and license information of each first component and the identification and license information of each first file in the first software set. By obtaining the second software set, the identification and license information of each second component and the identification and license information of each second file are obtained, the identification in the second component is compared with the identification of each first component, and when there is a component pair of the first component and the second component with the same identification, the license information of the component pair is compared to obtain a first comparison result at the component level. Then, the identification of each second file included in the second component in the component pair is compared with the identification of the first file included in the first component in the component pair, and when there is a file pair of the first file and the second file with the same identification, the license information of the file pair is compared to obtain a second comparison result at the file level, ensuring that each risk point of the second software set is evaluated, and generating an evaluation report of the second software set according to the first comparison result and the second comparison result, so that users can easily trace back the problem according to the evaluation report.

[0027] Furthermore, multiple second components with dependencies are determined based on the dependencies between the components, and it is judged whether the license information of the multiple second components complies with the constraints. The second components that do not comply with the constraints are added to the evaluation report to ensure that the software collection is released in compliance with the authorization scope, thereby guaranteeing the rights and interests of component developers.

[0028] Furthermore, by comparing the identifier of each second component with the identifiers of all first components in the software material table index, and comparing the identifier of each first component with the identifiers of all second components, it can be confirmed whether the second component has been changed, which can prevent the software collection from being maliciously tampered with and ensure the security of the software.

[0029] Furthermore, a special scanning method is adopted for derived components. When a native component corresponds to multiple patch files, the application component is iteratively determined, each patch file is applied to the application component, and the code fragment of the application component after application is calculated and compared with the code fragment of the application component. The licensing information of multiple difference code fragments is summarized and added to the evaluation report. Compared with directly applying all patches and then scanning, this method can obtain an evaluation report for each patch file. When a problem occurs in a derived component, the patch file with the problem can be quickly located, thereby improving the efficiency of repairing the problem patch.

[0030] Furthermore, before deploying the software collection, the code of the software collection to be deployed is evaluated, and then the license information of the components that have passed the evaluation is verified to be in the blacklist or whitelist. Only when the components that have passed the evaluation are in the whitelist can they be deployed, ensuring that each component used meets the preset standards, greatly improving the reliability and security of the components. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is an overall flow chart of a software evaluation method provided by an embodiment of the present invention;

[0032] Figure 2 This is a specific implementation flow chart of generating an evaluation report based on a constraint relationship provided by an embodiment of the present invention;

[0033] Figure 3 It is a specific implementation flow chart of generating an evaluation report based on verification and provided by an embodiment of the present invention;

[0034] Figure 4 It is a specific implementation flow chart of generating an evaluation report according to the identification of a comparison component provided by an embodiment of the present invention;

[0035] Figure 5 This is a specific implementation flow chart of generating an evaluation report according to the identification of a comparison file provided by an embodiment of the present invention;

[0036] Figure 6 This is a specific implementation flow chart of generating an evaluation report based on software component scanning data provided by an embodiment of the present invention;

[0037] Figure 7 It is a specific implementation flow chart of generating an evaluation report of a derivative component provided by an embodiment of the present invention;

[0038] Figure 8 It is a specific implementation flow chart of a deployment software set provided by an embodiment of the present invention;

[0039] Fig. 9 It is a structural schematic diagram of a software evaluation device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0040] As described in the background technology, when Internet companies develop software, they introduce open source code into the code themselves or through third-party code. The software collection at the time of release is prone to problems and needs to be evaluated. When evaluating the code, the existing technology only compares the code with the feature library and provides the scan report formed by the comparison to the inspector for manual analysis. However, the analysis work is very dependent on the experience and ability of the inspector, which is easy to cause misjudgment of the results, and the inspection content is complicated, resulting in low inspection efficiency.

[0041] In the embodiment of the present invention, by acquiring the first software set, and acquiring the identification and license information of each first component in the first software set, and the identification and license information of each first file, it is convenient to compare the first software set with the second software set. By acquiring the second software set, the identification and license information of each second component and the identification and license information of each second file are obtained, the identification in the second component is compared with the identification of each first component, and when there is a component pair of the first component and the second component with the same identification, the license information of the component pair is compared to obtain a first comparison result at the component level. Then, the identification of each second file included in the second component in the component pair is compared with the identification of the first file included in the first component in the component pair, and when there is a file pair of the first file and the second file with the same identification, the license information of the file pair is compared to obtain a second comparison result at the file level, ensuring that each risk point of the second software set is evaluated, and generating an evaluation report of the second software set based on the first comparison result and the second comparison result, so that users can easily trace back the problem according to the evaluation report.

[0042] Furthermore, multiple second components with dependencies are determined based on the dependencies between the components, and it is judged whether the license information of the multiple second components complies with the constraints. The second components that do not comply with the constraints are added to the evaluation report to ensure that the software collection is released in compliance with the authorization scope, thereby guaranteeing the rights and interests of component developers.

[0043] Furthermore, by comparing the identifier of each second component with the identifiers of all first components in the software material table index, and comparing the identifier of each first component with the identifiers of all second components, it can be confirmed whether the second component has been changed, which can prevent the software collection from being maliciously tampered with and ensure the security of the software.

[0044] Furthermore, a special scanning method is adopted for derived components. When a native component corresponds to multiple patch files, the application component is iteratively determined, each patch file is applied to the application component, and the code fragment of the application component after application is calculated and compared with the code fragment of the application component. The licensing information of multiple difference code fragments is summarized and added to the evaluation report. Compared with directly applying all patches and then scanning, this method can obtain an evaluation report for each patch file. When a problem occurs in a derived component, the patch file with the problem can be quickly located, thereby improving the efficiency of repairing the problem patch.

[0045] Furthermore, before deploying the software collection, the code of the software collection to be deployed is evaluated, and then the license information of the components that have passed the evaluation is verified to be in the blacklist or whitelist. Only when the components that have passed the evaluation are in the whitelist can they be deployed, ensuring that each component used meets the preset standards, greatly improving the reliability and security of the components.

[0046] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] Figure 1 It is an overall flow chart of a software evaluation method provided by an embodiment of the present invention.

[0048] The software evaluation method can be executed by a computer device, for example, a server. It should be noted that the computer device is not limited to the server, but can also be other devices with data processing capabilities.

[0049] Specifically, Figure 1 As shown, the software evaluation method may include steps 101 to 105 .

[0050] In step 101, a first software set is obtained.

[0051] In step 102, a second software set is obtained.

[0052] In step 103, the identifier of each second component is compared with the identifier of each first component, and when there is a component pair of the first component and the second component with the same identifier, the license information of the component pair is compared to obtain a first comparison result.

[0053] In step 104, the identifiers of each second file included in the second component of the component pair are compared with the identifiers of the first file included in the first component of the component pair, and when there is a file pair of the first file and the second file with consistent identifiers, the license information of the file pair is compared to obtain a second comparison result.

[0054] In step 105, an evaluation report of the second software set is generated based on at least the first comparison result and the second comparison result. That is, at least the first comparison result and the second comparison result are added to the evaluation report.

[0055] There is no logical order for executing step 101 and step 102. Step 101 may be executed first and then step 102, or step 102 may be executed first and then step 101, or step 101 and step 102 may be executed simultaneously.

[0056] In this embodiment, the evaluation report includes the first comparison result and the second comparison result. Further, the evaluation report may also include other contents, such as information of each second component that does not meet the constraint relationship, information of the second file whose second checksum is inconsistent with the first checksum of the corresponding first file, information of the second component whose license information does not meet the first preset condition, etc.

[0057] In a specific implementation, the first software set includes at least one first component, each first component includes multiple first files, and the first component and the first file have identification and license information. The second software set includes at least one second component, each second component includes multiple second files, and the second component and the second file have identification and license information. The generation time of the second software set is later than the generation time of the first software set. The content included in the first software set and the content included in the second software set may be the same or different. Specifically, the first software set and the second software set may be different versions of the software set of the same software product. The identification can be used to indicate a component or a file, for example, it can be the file name of the component.

[0058] For example, a software material list of a first software set is generated at 10:00 on January 1, and an evaluation report of a second software set is generated at 10:00 on January 2. During this period, the software set of the software product may have code changes.

[0059] In a non-limiting embodiment, a software bill of material is generated based on a first software set, the software bill of material (Sofware Bill of Material, SBoM) includes at least one Software Package Data Exchange (Software Package Data Exchange, SPDX) and a software bill of material index (Sofware Bill of Material Index, SBoM Index), each software package data exchange file includes licensing information of a first file included in a first component, the software bill of material index includes licensing information of each first component, and the licensing information includes a license and / or copyright.

[0060] In a specific implementation, the software package data exchange file may be obtained by adding a subtask, such as Generate_SPDX_Task, to the first software set to generate a software package data exchange file for each component.

[0061] In a non-limiting embodiment, the software bill of materials may also include a package tag list (PTL), which includes dependency relationships between the first components, and the dependency relationships are used to indicate components that need to run or compile together; each software bill of materials index is used to indicate the package tag list and software package data exchange file corresponding to the same component.

[0062] In a specific implementation, the package marking list may be obtained by adding a subtask, such as Generate_PTL_Task, to the first software set to generate a package marking list for each component.

[0063] In the specific implementation of step 105, an evaluation report of the second software set is generated at least according to the first comparison result and the second comparison result. Software is constructed by code, and evaluating software is to evaluate the software code.

[0064] In a non-limiting specific implementation, the permission information of the first file in all the software package data exchange files is added to the evaluation report;

[0065] Determining whether the license information of each second component meets the first preset condition, and adding information of the second components whose license information does not meet the first preset condition to the evaluation report;

[0066] It is determined whether the permission information of each second file meets the second preset condition, and the information of the second files whose permission information does not meet the second preset condition is added to the evaluation report.

[0067] In a specific implementation, the first preset condition is used to limit the content of the license information of the second component, and the second preset condition is used to limit the content of the license information of the second file. For example, the first preset condition may be that the license information of the second component cannot include only numbers, or the second preset condition may be that the license information of the second file cannot be a null value.

[0068] In a specific implementation, the source code of the component can be stored in the form of a code repository, and each component corresponds to a code repository. The code repository includes the source code of the component and its component type and license information, and the component type and license information can be stored in the remark information of the source code or in a database. When the component type and license information are stored in a database, the component has a corresponding relationship with the database, and the component type and license information can be obtained from the database.

[0069] In a specific implementation, the information of the second component may include the storage location, component type and permission information of the second component. The information of the second file may include the storage location, component type and permission information of the second file and information of the component to which it belongs.

[0070] It should be pointed out that the serial numbers of the steps in this embodiment do not limit the execution order of the steps.

[0071] It is understandable that, in a specific implementation, the software evaluation method can be implemented in the form of a software program, and the software program runs in a processor integrated inside a chip or a chip module. The method can also be implemented in the form of software combined with hardware, which is not limited in this application.

[0072] In addition to the above methods for generating assessment reports, Figures 2 to 7 The methods for generating the remaining evaluation reports are described in detail.

[0073] Figure 2 It is a specific implementation flow chart of generating an evaluation report according to a constraint relationship provided by an embodiment of the present invention.

[0074] Specifically, Figure 2 As shown, generating an evaluation report based on the constraint relationship may include the following steps:

[0075] In the specific implementation of step 201, constraint information is obtained. The constraint information includes constraint relations between permission information.

[0076] In a specific implementation, the constraint information can be obtained from the license information of the component, or imported from the outside, and the constraint information is used to constrain the license information. For example, there is a constraint relationship between the license information of component A and the license information of component B, that is, component A is not allowed to be compiled or run together with component B. Alternatively, there is no constraint relationship between the license information of component A and the license information of component B. In this case, the constraint information imported from the outside includes the constraint relationship between component A and component B, that is, component A is not allowed to be compiled or run together with component B.

[0077] In the specific implementation of step 202, the dependency relationship between each second component is determined according to the dependency relationship between each first component in the package marking list. The package marking list includes the dependency relationship between each first component, the first component and the second component have a corresponding relationship, the dependency relationship between the first components is consistent with the dependency relationship between the second components, and the dependency relationship between the second components can be determined by the dependency relationship between the first components in the package marking list.

[0078] In the specific implementation of step 203, a plurality of second components having dependency relationships are determined according to the dependency relationships between the second components.

[0079] In a specific implementation, the dependency relationship is used to indicate components that need to be run or compiled together. For example, component A and component B have a dependency relationship, that is, component A needs to be run or compiled together with component B.

[0080] In the specific implementation of step 204, it is determined whether the license information of the plurality of second components conforms to the constraint relationship, and the information of each second component that does not conform to the constraint relationship is added to the evaluation report.

[0081] In a specific embodiment, according to the dependency relationship between each first component in the package marking list, it is determined that the second component A has a dependency relationship with the second component B and the second component C, and the second component A, the second component B, and the second component C need to run or compile together. According to the constraint information included in the license information of component C, that is, component C is not allowed to be compiled or run together with component A, and components A and C do not meet the constraint relationship, and the information of components A and C is added to the evaluation report; or, according to the dependency relationship between each first component in the package marking list, it is determined that the second component A has a dependency relationship with the second component B and the second component C, and the second component A, the second component B, and the second component C need to run or compile together. The constraint information imported externally includes the constraint relationship between component C and component A, that is, component C is not allowed to be compiled or run together with component A, and components A and C do not meet the constraint relationship, and the information of components A and C is added to the evaluation report.

[0082] In this embodiment, multiple second components with dependencies are determined based on the dependencies between components, and it is determined whether the license information of the multiple second components complies with the constraints. The second components that do not comply with the constraints are added to the evaluation report to ensure that the software collection is released in compliance with the authorization scope, thereby guaranteeing the rights and interests of component developers.

[0083] Figure 3 It is a specific implementation flow chart of generating an evaluation report based on verification and provided by an embodiment of the present invention.

[0084] Specifically, Figure 3 As shown, generating an evaluation report based on the verification and verification may include the following steps:

[0085] In step 301, a second checksum of each second file is generated.

[0086] In step 302, the second checksum of each second file is compared with the first checksum of the corresponding first file in the software package data exchange file.

[0087] In a specific implementation, the checksum can be calculated by an algorithm. For example, Secure Hash Algorithm 1 (SHA-1) or Secure Hash Algorithm 256 (SHA-256) can be used as a calculation algorithm for the checksum.

[0088] In step 303, information about the second file whose second checksum is inconsistent with the first checksum of the corresponding first file is added to the evaluation report.

[0089] In this embodiment, by comparing the second checksum of each second file with the first checksum of the corresponding first file, it can be determined whether each second file is consistent with the corresponding first file, confirming that the second file has not been tampered with, and ensuring the security of the file. The first checksum refers to the checksum of the first file, the second checksum refers to the checksum of the second file, and the checksum refers to the accumulation of the number of transmission bits.

[0090] Figure 4 It is a specific implementation flow chart of generating an evaluation report according to the license information of the comparison component provided by an embodiment of the present invention.

[0091] Specifically, Figure 4 As shown, generating an evaluation report according to the identification of the comparison component may include the following steps:

[0092] In a specific implementation of step 401, the identifier of each second component is compared with the identifiers of all first components in the software material table index.

[0093] In the specific implementation of step 402, it is determined whether there is an identification consistent with the identification of the second component among all the identifications of the first components. If there is no identification consistent with the identification of the second component among all the identifications of the first components, the information of the second component is added to the evaluation report.

[0094] In a specific implementation of step 403, the identifier of each first component is compared with the identifiers of all second components.

[0095] In the specific implementation of step 404, it is determined whether there is an identification consistent with the identification of the first component among all the identifications of the second components. If there is no identification consistent with the identification of the first component among all the identifications of the second components, the information of the first component is added to the evaluation report.

[0096] In a specific implementation, the information of the first component may include the storage location, component type and permission information of the first component.

[0097] In this embodiment, by comparing the identifier of each second component with the identifiers of all first components in the software material table index, and comparing the identifier of each first component with the identifiers of all second components, it is confirmed whether the second component has been changed, thereby preventing the software collection from being maliciously tampered with and ensuring the security of the software.

[0098] Figure 5 It is a specific implementation flow chart of generating an evaluation report according to the identification of a comparison file provided by an embodiment of the present invention.

[0099] Specifically, Figure 5 As shown, generating an evaluation report based on the identifier of the comparison file may include the following steps:

[0100] In a specific implementation of step 501, the identifier of each second file is compared with the identifiers of all first files in the software package data exchange file.

[0101] In the specific implementation of step 502, it is determined whether there is an identifier consistent with the identifier of the second file among all the identifiers of the first file. If there is no identifier consistent with the identifier of the second file among all the identifiers of the first file, the information of the second file is added to the evaluation report.

[0102] In a specific implementation of step 503, the identifier of each first file is compared with the identifiers of all second files.

[0103] In the specific implementation of step 504, it is determined whether there is an identifier consistent with the identifier of the first file among all the identifiers of the second files. If there is no identifier consistent with the identifier of the first file among all the identifiers of the second files, the information of the first file is added to the evaluation report.

[0104] In a specific implementation, the information of the first file may include the storage location of the first file, the component type, the license information, and the information of the component to which the first file belongs.

[0105] In this embodiment, by comparing the identifier of each second file with the identifiers of all first files, and comparing the identifier of each first file with the identifiers of all second files, it is confirmed whether the second file has been changed, thereby avoiding the possibility of the software collection being maliciously tampered with and ensuring the security of the software.

[0106] Figure 6 It is a specific implementation flow chart of generating an evaluation report based on software component scanning data provided by an embodiment of the present invention.

[0107] Specifically, Figure 6 As shown, generating an assessment report based on software component scanning data may include the following steps:

[0108] In the specific implementation of step 601, software component scanning data is generated according to the first component. The software component scanning data includes the second code fragments in the feature library that match the first code fragments in each first file and their license information and positions, and the feature library includes multiple second code fragments and their license information and positions.

[0109] In a specific implementation, the feature library includes multiple second code snippets and their permission information and positions. The position of the second code snippet is used to indicate the specific storage location of the second code snippet, such as the path of the file to which the second code snippet belongs and the offset position of the second code snippet.

[0110] In a specific implementation, the software component scanning data may be obtained by adding a subtask, such as Generate_SCAData_Task, to the first software set to generate software component scanning data for each component.

[0111] In step 602, the license information of the matching second code segment in the software component scanning data is compared with the license information of the first file in the software package data exchange file.

[0112] In step 603, the license information and location of the second code segment whose license information is inconsistent with the license information of the first file are added to the evaluation report.

[0113] Figure 7 It is a specific implementation flow chart of generating an evaluation report of a derivative component provided by an embodiment of the present invention.

[0114] Specifically, Figure 7 As shown, generating an evaluation report for a derived class component may include the following steps:

[0115] In the specific implementation of step 701, all patch files in the derived class component and the native components applied thereto are obtained.

[0116] In a specific implementation, the first component includes a derived component, an open source component and a third-party component. The derived component is developed based on the native component, and the native component can be an open source component or a third-party component.

[0117] In the specific implementation of step 702, the application component is iteratively determined, each patch file is applied to the application component, and the code fragment of the applied application component is compared with the code fragment of the application component. The difference code fragments are obtained by comparison, and the native component corresponds to multiple patch files.

[0118] In a specific embodiment, there are two patch files in the derived component A, and the application order is patch file 1 and patch file 2. The native component of the derived component A is component B. Patch file 1 is first applied to component B, and component B is now an application component, to obtain application component B1 after application, and calculate the difference code fragment C1 between component B1 and component B. Patch file 2 is then applied to component B1, and component B1 is now an application component, to obtain application component B2 after application, and calculate the difference code fragment C2 between component B2 and component B1.

[0119] In a specific implementation, if a native component corresponds to a patch file, the patch file is applied to the corresponding native component, and the code snippet of the native component is compared with the code snippet in the result component to obtain a difference code snippet.

[0120] In the specific implementation of step 703, the licensing information of the difference code fragment is added to the evaluation report.

[0121] In an embodiment of the present invention, a special scanning method is adopted for derived components. When a native component corresponds to multiple patch files, the application component is iteratively determined, each patch file is applied to the application component, and the code fragment of the application component after application is calculated and compared with the code fragment of the application component. The licensing information of multiple difference code fragments is summarized and added to the evaluation report. Compared with directly applying all patches and then scanning, this method can obtain an evaluation report for each patch file. When a problem occurs in the derived component, the patch file with the problem can be quickly located, thereby improving the repair efficiency of the problem patch.

[0122] Figure 8 It is a specific implementation flow chart of a deployment software set provided by an embodiment of the present invention.

[0123] In the specific implementation of step 801, the software set to be deployed is obtained, and an evaluation report of the software set to be deployed is generated. The method for generating the evaluation report of the software set to be deployed can refer to the aforementioned evaluation report generation steps, which will not be repeated here.

[0124] In a specific implementation, a software material list is generated according to the software set to be deployed, the software set to be deployed at this time is the first software set, and the software material list is generated at the first time. The software set to be deployed is compared with the software material list at the second time to obtain an evaluation report, the software set to be deployed at this time is the second software set, and the first time is earlier than the second time.

[0125] In the specific implementation of step 802, when the evaluation report of the second software set meets the preset standard, a blacklist and a whitelist are obtained. The blacklist includes multiple license information, and the whitelist includes multiple license information. When the license information of any second component is consistent with the evaluation report license information of any software set to be deployed in the blacklist, the second software set is not allowed to be deployed. When the license information of each second component is consistent with any license information in the whitelist, the second software set is allowed to be deployed.

[0126] In a specific implementation, compliance with the preset standard means that the content in the evaluation report of the second software set is consistent with the preset standard set by the user. For example, the preset standard can be that the evaluation report only includes the license information of the first file in all software package data exchange files, and no inconsistent license information is recorded. Failure to meet the preset standard can be the presence of inconsistent license information, for example, the evaluation report includes components with conflicting license information, or the evaluation report contains files with inconsistent checksums. The second software set's compliance with the preset standard is a prerequisite for deploying the second software set, and the preset standard can be customized by the user.

[0127] In the specific implementation of step 803, it is determined whether the license information of any second component is consistent with any license information in the blacklist. If so, step 804 is executed to record the second component that is consistent with any license information in the blacklist; otherwise, step 805 is executed.

[0128] In the specific implementation of step 805, it is determined whether the license information of each second component is consistent with any license information in the whitelist. If so, step 806 is executed to deploy the second software set; otherwise, step 807 is executed to push the license information of the second component to the terminal device.

[0129] In step 808, feedback information sent by the terminal device is obtained, and the feedback information includes approval or rejection. When the feedback information is approval, the second software set is allowed to be deployed, and the license information of the second component is added to the whitelist; when the feedback information is rejection, the second software set is not allowed to be deployed, the second component is recorded, and the license information of the second component is added to the blacklist.

[0130] In step 809, determine whether the feedback information is agreed. If so, execute step 810 to deploy the second software set and add the license information of the second component to the whitelist; otherwise, execute step 811 to record the second component and add the license information of the second component to the blacklist.

[0131] In the embodiment of the present invention, before deploying the software set, the code evaluation is performed on the software set to be deployed. When the evaluation report of the second software set meets the preset standard, it is determined whether the license information of the second component is in the blacklist or the whitelist. The second component can be deployed only when the license information is consistent with the license information in the whitelist, ensuring that each component to be applied meets the preset standard, greatly improving the reliability and security of the component.

[0132] like Fig. 9 As shown, the embodiment of the present invention also discloses a software evaluation device. The software evaluation device 90 includes:

[0133] A first software set acquisition module 901 is used to acquire a first software set, wherein the first software set includes at least one first component, the first component has identification and license information, and each first component includes a plurality of first files, the first files have identification and license information;

[0134] A second software set acquisition module 902, configured to acquire a second software set, wherein the second software set includes at least one second component, the second component has identification and license information, each second component includes a plurality of second files, and the second files have identification and license information;

[0135] A first comparison module 903 is used to compare the identifier of each second component with the identifier of each first component, and when there is a component pair of the first component and the second component with the same identifier, compare the license information of the component pair to obtain a first comparison result;

[0136] A second comparison module 904 is used to compare the identifiers of each second file included in the second component of the component pair with the identifiers of the first file included in the first component of the component pair, and when there is a file pair of the first file and the second file with the same identifier, compare the license information of the file pair to obtain a second comparison result;

[0137] The evaluation report generating module 905 is used to generate an evaluation report of the second software set according to at least the first comparison result and the second comparison result.

[0138] In a specific implementation, the above-mentioned software evaluation device can correspond to a chip with a code evaluation function in a server, such as a SOC (System-On-a-Chip), a baseband chip, etc.; or correspond to a chip module with a code evaluation function in a server; or correspond to a chip module with a data processing function chip, or correspond to a server.

[0139] For more information about the working principle and working method of the software evaluation device 90, please refer to Figures 1 to 8 The relevant description in will not be repeated here.

[0140] Regarding the various modules / units included in the various devices and products described in the above embodiments, they can be software modules / units, or hardware modules / units, or they can be partially software modules / units and partially hardware modules / units. For example, for various devices and products applied to or integrated in a chip, the various modules / units included therein can all be implemented in the form of hardware such as circuits, or at least some of the modules / units can be implemented in the form of software programs, which run on a processor integrated inside the chip, and the remaining (if any) modules / units can be implemented in the form of hardware such as circuits; for various devices and products applied to or integrated in a chip module, the various modules / units included therein can all be implemented in the form of hardware such as circuits, and different modules / units can be located in the same component (such as a chip, circuit module, etc.) or different components of the chip module, or at least some of the modules / units can be implemented in the form of hardware such as circuits. The element can be implemented in the form of a software program, which runs on a processor integrated inside the chip module, and the remaining (if any) modules / units can be implemented in the form of hardware such as circuits; for various devices and products applied to or integrated in the terminal, the various modules / units contained therein can be implemented in the form of hardware such as circuits, and different modules / units can be located in the same component (for example, chip, circuit module, etc.) or in different components in the terminal, or, at least some modules / units can be implemented in the form of a software program, which runs on a processor integrated inside the terminal, and the remaining (if any) modules / units can be implemented in the form of hardware such as circuits.

[0141] The embodiment of the present invention also discloses a storage medium, which is a computer-readable storage medium and stores a computer program. When the computer program is run, it can execute Figures 1 to 8 The steps of the method shown in . The storage medium may include ROM, RAM, magnetic disk or optical disk, etc. The storage medium may also include non-volatile memory (non-volatile) or non-transitory memory, etc.

[0142] The embodiment of the present invention further discloses a server, which may include a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and the processor can execute the computer program when running the computer program. Figures 1 to 8 The steps of the method shown in .

[0143] The "plurality" appearing in the embodiments of the present application refers to two or more.

[0144] The first, second, etc. descriptions appearing in the embodiments of the present application are only used for illustration and distinction of the description objects. There is no order, nor do they indicate any special limitation on the number of devices in the embodiments of the present application, and cannot constitute any limitation on the embodiments of the present application.

[0145] It should be understood that in the embodiments of the present application, the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0146] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM) and direct rambus RAM (DR RAM).

[0147] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0148] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0149] In the several embodiments provided in the present application, it should be understood that the disclosed methods, devices and systems can be implemented in other ways. For example, the device embodiments described above are merely schematic; for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation; for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0150] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0151] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be physically included separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0152] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store program codes.

[0153] Although the present invention is disclosed as above, the present invention is not limited thereto. Any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the scope defined by the claims.

Claims

1. A software evaluation method, characterized in that: include: Acquire a first software set, the first software set includes at least one first component, the first component has identification and license information, each first component includes a plurality of first files, the first files have identification and license information; Acquire a second software set, wherein the second software set includes at least one second component, the second component has identification and license information, each second component includes a plurality of second files, and the second files have identification and license information; Comparing the identifier of each second component with the identifier of each first component, and when there is a component pair of the first component and the second component with the same identifier, comparing the license information of the component pair to obtain a first comparison result; Comparing the identifiers of each second file included in the second component of the component pair with the identifiers of the first file included in the first component of the component pair, and when there is a file pair of the first file and the second file with the same identifier, comparing the license information of the file pair to obtain a second comparison result; An evaluation report of the second software set is generated at least according to the first comparison result and the second comparison result.

2. The software evaluation method according to claim 1, characterized in that: The obtaining of the first software set comprises: Generate a software bill of materials based on the first software set, the software bill of materials including at least one software package data exchange file and a software bill of materials index, each software package data exchange file including identification and licensing information of first files included in the first component, the software bill of materials index including identification and licensing information of each first component, the licensing information including license and / or copyright; obtain the identification and licensing information of each first component from the software bill of materials index, and obtain the identification and licensing information of each first file from the software package data exchange file.

3. The software evaluation method according to claim 2, characterized in that: The software material table includes a package tag list, which includes dependencies between various first components, and the dependencies are used to indicate components that need to run or compile together; each software material table index is used to indicate the package tag list and software package data exchange file corresponding to the same component.

4. The software evaluation method according to claim 3, characterized in that: Generating an evaluation report for the second software set at least according to the first comparison result and the second comparison result includes: Acquire constraint information, wherein the constraint information includes a constraint relationship between permission information; Determine the dependency relationship between each second component according to the dependency relationship between each first component in the package tag list; Determine a plurality of second components having dependency relationships according to dependency relationships between the second components; Determining whether the permission information of the plurality of second components conforms to the constraint relationship; The information of each second component that does not meet the constraint relationship is added to the evaluation report.

5. The software evaluation method according to claim 2, characterized in that: The software package data exchange file includes first checksums of the first components, and generating an evaluation report of the second software set at least according to the first comparison result and the second comparison result includes: generating a second checksum for each second file; The second checksum of each second file is compared with the first checksum of the corresponding first file; and information of the second file whose second checksum is inconsistent with the first checksum of the corresponding first file is added to the evaluation report.

6. The software evaluation method according to claim 2, characterized in that: Generating an evaluation report for the second software set at least according to the first comparison result and the second comparison result includes: Comparing the identifier of each second component with the identifiers of all first components in the software material list index; If there is no identification consistent with the identification of the second component among all the identifications of the first components, adding the information of the second component to the evaluation report; Alternatively, the identification of each first component is compared with the identifications of all second components; If there is no identification consistent with the identification of the first component among all the identifications of the second components, the information of the first component is added to the evaluation report.

7. The software evaluation method according to claim 2, characterized in that: Generating an evaluation report for the second software set at least according to the first comparison result and the second comparison result includes: The permission information of the first file in all the software package data exchange files is added to the evaluation report.

8. The software evaluation method according to claim 2, characterized in that: Generating an evaluation report for the second software set at least according to the first comparison result and the second comparison result includes: Generate software component scanning data according to the first component, the software component scanning data including second code fragments in a feature library that match the first code fragments in each first file and their license information and positions, the feature library including multiple second code fragments and their license information and positions; comparing the licensing information of the matched second code segment in the software component scan data with the licensing information of the first file in the software package data exchange file; The license information and location of the second code segment whose license information is inconsistent with the license information of the first file are added to the evaluation report.

9. The software evaluation method according to claim 2, characterized in that: Generating an evaluation report for the second software set at least according to the first comparison result and the second comparison result includes: comparing the identifier of each second file with the identifiers of all first files in the software package data exchange file; If there is no identification consistent with the identification of the second file among all the identifications of the first files, adding the information of the second file to the evaluation report; Alternatively, the identifier of each first file is compared with the identifiers of all second files; If there is no identifier consistent with the identifier of the first file among all the identifiers of the second files, the information of the first file is added to the evaluation report.

10. The software evaluation method according to claim 1, characterized in that: The generation time of the second software set is later than the generation time of the first software set.

11. The software evaluation method according to claim 1, characterized in that: The first component includes a derived component, and the derived component includes a patch file and a native component of its application. The generating of the evaluation report of the second software set at least according to the first comparison result and the second comparison result includes: Obtain all patch files in the derived component and the native components they apply to; If a native component corresponds to a patch file, the patch file is applied to the corresponding native component to obtain a result component, and the code snippet of the native component is compared with the code snippet of the result component to obtain a difference code snippet; If a native component corresponds to multiple patch files, iteratively determine the application component, apply each patch file to the application component, and compare the code snippet of the applied application component with the code snippet of the application component to obtain a difference code snippet; The permission information of the difference code fragment is added to the evaluation report.

12. The software evaluation method according to claim 1, characterized in that: Generating an evaluation report for the second software set at least according to the first comparison result and the second comparison result includes: Determining whether the permission information of each second component meets the first preset condition; Information about the second component whose licensing information does not meet the first preset condition is added to the evaluation report.

13. The software evaluation method according to claim 1, characterized in that: Generating an evaluation report for the second software set at least according to the first comparison result and the second comparison result includes: Determining whether the permission information of each second file meets the second preset condition; The information of the second file whose permission information does not meet the second preset condition is added to the comparison result.

14. The software evaluation method according to claim 1, characterized in that: The first software set and the second software set are software sets to be deployed.

15. The software evaluation method according to claim 14, characterized in that: Also includes: When the evaluation report meets the preset standard, comparing the license information of all second components with each license information in the blacklist, and comparing the license information of all second components with each license information in the whitelist, the blacklist includes multiple license information, and the whitelist includes multiple license information; When the permission information of any second component is consistent with any permission information in the blacklist, the second component consistent with any permission information in the blacklist is recorded; Alternatively, when the license information of each second component is consistent with any license information in the whitelist, the second software set is deployed.

16. The software evaluation method according to claim 15, characterized in that: Also includes: When the permission information of the second component is inconsistent with any permission information in the blacklist, and the permission information of the second component is inconsistent with any permission information in the whitelist, pushing the permission information of the second component to the terminal device; Acquiring feedback information sent by the terminal device, wherein the feedback information includes approval or rejection; When the feedback information indicates that the user agrees, the second software set is deployed, and the license information of the second component is added to the whitelist; Alternatively, when the feedback information is rejection, the second component is recorded, and the permission information of the second component is added to the blacklist.

17. A software evaluation device, characterized in that: include: A first software set acquisition module, used for acquiring a first software set, wherein the first software set includes at least one first component, the first component has identification and license information, each first component includes a plurality of first files, and the first files have identification and license information; A second software set acquisition module, used to acquire a second software set, wherein the second software set includes at least one second component, the second component has identification and license information, each second component includes a plurality of second files, and the second files have identification and license information; A first comparison module, used to compare the identifier of each second component with the identifier of each first component, and when there is a component pair of the first component and the second component with the same identifier, compare the license information of the component pair to obtain a first comparison result; a second comparison module, configured to compare the identifiers of the second files included in the second component of the component pair with the identifiers of the first files included in the first component of the component pair, and, when there is a file pair of the first file and the second file with the same identifier, compare the license information of the file pair to obtain a second comparison result; An evaluation report generating module is used to generate an evaluation report of the second software set based on at least the first comparison result and the second comparison result.

18. A server comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, characterized in that: When the processor runs the computer program, the processor performs the steps of the software evaluation method according to any one of claims 1 to 16.

19. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the software evaluation method according to any one of claims 1 to 16 are executed.

Images