Software detection method, system, device, equipment, medium and program product

Abstract

The invention provides a software detection method, system and device, equipment, a medium and a program product. The method comprises the steps that a continuous integration tool platform obtains a compiled and packaged compressed package of target open source software, and an interface of an open source treatment platform is called to send an SCA detection request of the target open source software. After receiving the SCA detection request, the open source management platform performs legality verification on the SCA detection request based on the encrypted identity information; and if the validity verification of the SCA detection request is passed, calling an interface of an SCA tool platform to upload a compressed package of the target open source software, and initiating SCA detection of the target open source software. According to the method provided by the invention, under the connection of the open source governance platform and on the premise of not integrating the continuous integration tool platform and the SCA tool platform, the automatic detection of the target open source software is realized, and the safety quality detection efficiency of the target open source software is improved.

Description

Technical Field

[0001] The present application relates to the field of software security technology, and in particular to a software detection method, system, device, equipment, medium and program product. Background Art

[0002] In the process of developing and testing open source software, in order to ensure that the use of open source software meets security and quality standards, it is necessary to set quality access control for open source software. In the process of setting quality access control for open source software, security quality testing is an important part. Among them, security quality testing mainly needs to consider factors such as the vulnerability level and license risk level of the open source software.

[0003] At present, the main method to implement security quality testing of open source software is to deploy the SCA plug-in of the Software Composition Analysis (SCA) tool platform on the Devops platform. Among them, the SCA tool platform is mainly used to identify the vulnerability level and license risk level of open source software. In the process of the Devops platform initiating testing of open source software through the SCA plug-in, the SCA plug-in is invasive to the Devops platform, and the SCA plug-in process needs to be deployed on the Devops platform. In addition, the SCA plug-in has poor flexibility. The Devops platform needs to input command line parameters to call the SCA plug-in to implement testing, which makes the Devops platform limited to the parameters supported by the SCA plug-in, and it is difficult to implement the SCA plug-in to automatically detect the target open source software.

[0004] Therefore, it is an urgent problem to realize the automatic detection of target open source software by SCA tool platform, so as to improve the efficiency of security quality detection of open source software. Summary of the invention

[0005] The present application provides a software detection method, system, device, equipment, medium and program product to solve the problem of automatic detection of target open source software by the SCA tool platform.

[0006] In a first aspect, the present application provides a software detection method, which is applied to an open source governance platform, and the method includes:

[0007] Receiving an SCA detection request of a target open source software sent by a continuous integration tool platform by calling an interface of the open source governance platform; the SCA detection request carries a compressed package of the target open source software and encrypted identity information;

[0008] Based on the encrypted identity information, verify the legitimacy of the SCA detection request;

[0009] If the legitimacy verification of the SCA detection request passes, the interface of the SCA tool platform is called to upload the compressed package of the target open source software, and the SCA detection of the target open source software is initiated.

[0010] In a possible manner, after the legitimacy verification of the SCA detection request is passed, the method further includes:

[0011] Receiving a query request sent by the continuous integration tool platform through a calling interface; the query request is used to query the SCA detection status and / or SCA detection result of the target open source software; the query request includes: encrypted identity information;

[0012] Based on the encrypted identity information, verify the legitimacy of the query request;

[0013] If the query request passes the legality verification, the interface of the SCA tool platform is called to send the query request;

[0014] Receiving the query result returned by the SCA tool platform;

[0015] The query result is sent to the continuous integration tool platform.

[0016] In one possible embodiment, the method further includes:

[0017] Receiving a quality gate determination request for the target open source software sent by the continuous integration tool platform through a calling interface; the quality gate determination request carries the SCA detection result of the target open source software and the encrypted identity information;

[0018] Based on the encrypted identity information, verify the legitimacy of the quality access control determination request;

[0019] If the legitimacy verification of the quality access control determination request passes, the quality access control determination result of the target open source software is obtained through the quality access control decision tree model and the SCA detection result; the quality access control decision tree model at least includes: a vulnerability risk decision tree and a license risk decision tree; the vulnerability risk decision tree and the license risk decision tree are obtained by pre-training the decision tree using a training data set, and the training data set is constructed by labeling based on the reference classification labeling result provided by the large model;

[0020] Send the quality gate determination result to the continuous integration tool platform.

[0021] In one possible embodiment, the method further includes:

[0022] Receiving an email notification request sent by the continuous integration tool platform through a calling interface; the email notification request is used to request feedback of the SCA detection result and quality access control determination result of the target open source software to a target address via email; the email notification request includes the encrypted identity information;

[0023] Based on the encrypted identity information, verify the legitimacy of the email notification request;

[0024] If the legitimacy verification of the email notification request is passed, an email containing the SCA test results and quality access control determination results of the target open source software is sent to the target address.

[0025] In a second aspect, the present application provides a software detection method, which is applied to a continuous integration tool platform, and the method includes:

[0026] Obtaining a compressed package of the target open source software after compilation and packaging;

[0027] Call the interface of the open source governance platform to send an SCA detection request for the target open source software; the SCA detection request carries a compressed package of the target open source software and encrypted identity information; the SCA detection request is used to trigger the open source governance platform to call the SCA tool platform to perform SCA detection on the target open source software after the legitimacy of the SCA detection request is verified based on the encrypted identity information.

[0028] In one possible embodiment, the method further includes:

[0029] Calling the interface of the open source governance platform to send a query request; the query request is used to query the SCA detection status and / or SCA detection result of the target open source software; the query request includes: encrypted identity information;

[0030] After the open source governance platform verifies the legitimacy of the query request based on the encrypted identity information, the query result obtained by calling the SCA tool platform is received.

[0031] In one possible embodiment, the method further includes:

[0032] Calling the interface of the open source governance platform to send a quality access control determination request for the target open source software; the quality access control determination request carries the SCA detection result of the target open source software and the encrypted identity information;

[0033] After the open source governance platform verifies the legitimacy of the quality access control decision request based on the encrypted identity information, the quality access control decision result of the target open source software is obtained through the quality access control decision tree model and the SCA detection result; the quality access control decision tree model at least includes: a vulnerability risk decision tree and a license risk decision tree; the vulnerability risk decision tree and the license risk decision tree are obtained by pre-training the decision trees using a training data set, and the training data set is constructed by labeling based on the reference classification labeling result provided by the large model.

[0034] In one possible embodiment, the method further includes:

[0035] Call the interface of the open source governance platform to send an email notification request; the email notification request is used to request feedback of the SCA detection results and quality access control determination results of the target open source software to the target address via email; the email notification request includes the encrypted identity information.

[0036] In one possible embodiment, the method further includes:

[0037] When the quality gate determination result is passed, deploying the target open source software;

[0038] When the quality gate determination result is failure, the target open source software is developed, repaired, compiled, packaged, and then retested.

[0039] In a third aspect, the present application provides a software detection method, which is applied to an SCA tool platform, and the method includes:

[0040] Receive the compressed package of the target open source software uploaded by the open source governance platform by calling the interface of the SCA tool platform, and the trigger instruction for performing SCA detection on the target open source software;

[0041] Based on the compressed package, SCA detection is performed on the target open source software.

[0042] In one possible embodiment, the method further includes:

[0043] Receiving a query request sent by the open source governance platform by calling the interface of the SCA tool platform; the query request is used to query the SCA detection status and / or SCA detection result of the target open source software;

[0044] Obtaining query results based on the query request;

[0045] Return the query result to the open source governance platform.

[0046] In a fourth aspect, the present application provides a software detection method, the method comprising:

[0047] The continuous integration tool platform obtains the compressed package of the target open source software;

[0048] The continuous integration tool platform calls the interface of the open source governance platform to send an SCA detection request for the target open source software; the SCA detection request carries a compressed package of the target open source software and encrypted identity information;

[0049] The open source governance platform verifies the legitimacy of the SCA detection request based on the encrypted identity information;

[0050] If the legitimacy verification of the SCA detection request passes, the open source governance platform calls the interface of the SCA tool platform to upload the compressed package of the target open source software, and initiates the SCA detection of the target open source software;

[0051] The SCA tool platform performs SCA detection on the target open source software based on the compressed package.

[0052] In a fourth aspect, the present application provides a software detection system, the software detection system comprising: a continuous integration tool platform, an open source governance platform, and an SCA tool platform; wherein:

[0053] The continuous integration tool platform is deployed with a target script, which is used to execute the method as described in any one of the second aspects by running the target script;

[0054] The open source governance platform is used to execute the method as described in any one of the first aspects;

[0055] The SCA tool platform is used to execute the method as described in any one of the third aspects.

[0056] In a fifth aspect, the present application provides a software detection device, which is applied to an open source governance platform, and the device includes:

[0057] A receiving module, used to receive an SCA detection request of a target open source software sent by a continuous integration tool platform by calling an interface of the open source governance platform; the SCA detection request carries a compressed package of the target open source software and encrypted identity information;

[0058] A verification module, used to verify the legitimacy of the SCA detection request based on the encrypted identity information;

[0059] The calling module, if the legitimacy verification of the SCA detection request passes, calls the interface of the SCA tool platform to upload the compressed package of the target open source software, and initiates the SCA detection of the target open source software.

[0060] In a sixth aspect, the present application provides a software detection device, which is applied to a continuous integration tool platform, and the device includes:

[0061] An acquisition module is used to acquire a compressed package of the target open source software after compilation and packaging;

[0062] A calling module calls the interface of the open source governance platform to send an SCA detection request for the target open source software; the SCA detection request carries a compressed package of the target open source software and encrypted identity information; the SCA detection request is used to trigger the open source governance platform to call the SCA tool platform to perform SCA detection on the target open source software after the legitimacy of the SCA detection request is verified based on the encrypted identity information.

[0063] In a seventh aspect, the present application provides a software detection device, which is applied to an SCA tool platform, and includes:

[0064] A receiving module receives a compressed package of the target open source software uploaded by the open source governance platform by calling the interface of the SCA tool platform, and a trigger instruction for performing SCA detection on the target open source software;

[0065] The detection module performs SCA detection on the target open source software based on the compressed package.

[0066] In an eighth aspect, the present application provides an electronic device, the electronic device comprising: a processor, and a memory communicatively connected to the processor;

[0067] The memory stores computer-executable instructions;

[0068] The processor executes the computer-executable instructions stored in the memory to implement the method described in any one of the first aspect, the second aspect, or the third aspect.

[0069] In a ninth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method described in any one of the first aspect, the second aspect, or the third aspect.

[0070] In a tenth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the method described in any one of the first aspect, the second aspect, or the third aspect.

[0071] The embodiment of the present application realizes the connection between the SCA tool platform and the continuous integration tool platform through the open source governance platform. Compared with the method in the prior art that requires manual deployment and management of SCA plug-ins on the Devops platform, the invasiveness of the SCA plug-in to the continuous integration tool platform is avoided. Regardless of how the target open source software changes, the user only needs to directly call the OpenAPI of the SCA tool platform to implement the security quality detection of the target open source software by the SCA tool platform, which increases the flexibility of the SCA tool platform in detecting the target open source software and realizes the automatic detection of the target open source software by the SCA tool platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0073] Figure 1 A schematic diagram of the connection relationship between the DevOps platform, the open source governance platform, and the SCA tool platform provided in the embodiment of the present application;

[0074] Figure 2 A flowchart of a software detection method provided in an embodiment of the present application;

[0075] Figure 3 It is a flow chart of RSA encryption algorithm;

[0076] Figure 4 A schematic diagram of a process for querying the SCA detection status and detection results provided in an embodiment of the present application;

[0077] Figure 5 A schematic diagram of a process for determining the quality access control of target open source software provided in an embodiment of the present application;

[0078] Figure 6 A schematic diagram of the process of classifying and labeling a training data set provided in this embodiment;

[0079] Figure 7 A flowchart of a continuous integration tool provided in an embodiment of the present application taking different measures according to different quality access control determination results;

[0080] Figure 8 A schematic diagram of a shell script of a continuous integration tool platform provided in an embodiment of the present application;

[0081] Fig. 9 A schematic diagram of the structure of a first software detection device provided in an embodiment of the present application;

[0082] Fig.10 A schematic diagram of the structure of a second software detection device provided in an embodiment of the present application;

[0083] Fig.11 A schematic diagram of the structure of a third software detection device provided in an embodiment of the present application;

[0084] Fig.12 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0085] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0086] In the development and testing process of open source software, since open source software usually involves multiple developers, multiple branches and frequent updates, a strict quality control mechanism is required to ensure the reliability and stability of the software. At present, in order to ensure the reliability and stability of the software, a continuous integration tool platform is usually used to set quality control for open source software.

[0087] The continuous integration tool platform can cover the R&D life cycle by defining pipelines to cover code building, scanning, testing, deployment, and online release. Among them, the testing function of the continuous integration tool platform can include quality access control for software quality. If the access control requirements are not met, the continuous integration tool platform pipeline will not be allowed to execute further. Common continuous integration tool platforms can be DevOps platform, Jenkins platform, TeamCity platform, etc.

[0088] In the process of using continuous integration tool platforms to set quality control for open source software, security quality testing is an important part. Security quality testing focuses on conducting specialized testing on the security of open source software, including vulnerability risk testing of open source software and license risk level testing.

[0089] At present, since the SCA tool platform can detect the vulnerability risks and license risks in the open source software used in source code, product packages and binary files, it has the ability to detect open source software and can ensure the speed and accuracy of open source software detection. Therefore, the existing technology usually integrates the continuous integration tool platform with the SCA tool platform to realize the security quality detection of open source software.

[0090] In the prior art, the Devops platform is used as a continuous integration tool platform to integrate with the SCA tool platform to implement security quality testing of open source software. First, the SCA plug-in is installed and configured on the Devops platform, that is, the SCA plug-in is installed and configured as a component or extension of the Devops platform. Secondly, the Devops platform calls the function of the SCA plug-in through command line parameters. The Devops platform uses the SCA plug-in to perform SCA testing and obtains SCA testing results. The results can reflect the security quality situation, thereby realizing the integration of the Devops platform and the SCA tool platform.

[0091] In this method, the user needs to manually input command line parameters to call the SCA plug-in, which limits the user's ability to update the SCA plug-in in a timely manner according to different needs, and the SCA plug-in has poor flexibility.

[0092] In addition, in this prior art, the SCA plug-in is invasive to the Devops platform, and additional deployment and management operations are required on the Devops platform to maintain the integration relationship between the SCA plug-in and the Devops platform, which increases manual deployment and management costs.

[0093] In addition, because the Devops platform can only call the SCA plug-in by entering command line parameters, the flexibility of the SCA plug-in is limited. If the SCA plug-in does not support certain new detection requirements or parameters, the Devops platform may not be able to meet these requirements directly by modifying the command line parameters, limiting the Devops platform's utilization of the SCA plug-in function.

[0094] The open source management platform is a comprehensive platform that can not only be used to effectively manage open source software and its related resources, but also comprehensively cover and optimize management processes. The platform integrates multiple key functions, including but not limited to user authentication and permission management, organizational structure management, code repository hosting, product library management, integrated continuous integration tool platform and SCA tool platform, etc.

[0095] The open source governance platform also has other functions, such as ledger management, process management, report management, security policy formulation and execution, knowledge base construction, etc. The open source management platform aims to provide an efficient, secure and easy-to-use environment to facilitate the management of the entire life cycle of open source software.

[0096] Therefore, this application associates the SCA tool platform and the continuous integration tool platform through the open source governance platform, so as to realize SCA detection without integrating the two. Take the DevOps platform as an example of the continuous integration tool platform. Figure 1A schematic diagram of the connection relationship between the DevOps platform, open source governance platform, and SCA tool platform provided in an embodiment of the present application.

[0097] like Figure 1 As shown, the open source governance platform is used as the middle layer between the SCA tool platform and the Devops platform. An interface that can interact with Devops and an interface that can interact with the SCA tool platform are set on the open source governance platform.

[0098] Optionally, the interface for the open source governance platform to interact with the Devops platform can be an application programming interface (API), and the interface for the open source governance platform to interact with the SCA tool platform can be an open application programming interface (Open API). The main difference between API and OpenAPI lies in the degree of openness and access rights. OpenAPI is a completely free API that is completely open to the public and can be used without authorization.

[0099] Furthermore, the API for the interaction between the open source governance platform and the Devops platform includes but is not limited to the input and output parameters exchanged between the platforms, the communication protocol, and the authentication mechanism set up to verify the legality of the request. The OpenAPI for the interaction between the open source governance platform and the SCA tool platform may include the operation content of the SCA tool platform to perform security quality testing on the target open source software, as well as the sequence of execution steps of the operation content. For example, the OpenAPI can carry any one or more tasks such as initiating detection, obtaining detection results, generating reports, downloading reports, etc., and carry the execution order of the above tasks.

[0100] By encapsulating and orchestrating the OpenAPI method during the development phase, users no longer need to manually enter command lines to call SCA plug-ins to implement security quality testing of target open source software by the SCA tool platform. They can use the open source governance platform to use APIs to connect the SCA tool platform and the continuous integration tool platform, and directly call the SCA tool platform's OpenAPI to implement security quality testing of the target open source software by the SCA tool platform. This enhances the flexibility of the SCA tool platform in detecting target open source software, reduces manual deployment and management costs, and implements automated testing of the target open source software by the SCA tool platform.

[0101] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0102] Figure 2 The present invention provides a flowchart of a software detection method, which mainly involves continuous integration tools, open source governance platforms and SCA tool platforms. Figure 2 As shown, the method includes:

[0103] S101. The continuous integration tool platform obtains a compressed package of the target open source software.

[0104] Optionally, the compressed package of the target open source software may be a compressed package of the target open source software after compilation and packaging.

[0105] Optionally, the compressed package of the target open source software can be uploaded to the continuous integration tool platform by the user in advance, or developed directly by the user using the continuous integration tool platform, or obtained from an external storage address or storage medium. This application does not limit this.

[0106] S102, the continuous integration tool platform calls the interface of the open source governance platform to send an SCA detection request for the target open source software. The SCA detection request carries a compressed package of the target open source software and encrypted identity information.

[0107] Optionally, the encrypted identity information carried in the SCA detection request can be a token encrypted using an encryption algorithm (Rivest-Shamir-Adleman, RSA). The token can be used for identity authentication to prevent the target open source software from being illegally called. The token encrypted using the RSA public key can ensure that the identity information of the target open source software is not leaked.

[0108] Figure 3 This is a flow chart of the RSA encryption algorithm. Figure 3 As shown, the continuous integration tool platform uses the public key of RSA to encrypt the plain text into cipher text. Among them, the plain text may include any one or more items such as the system source of the target open source software and the expiration time, which are not limited in this application. The system source of the target open source software can be the operating system or platform on which the target open source software is based; the expiration time can be the validity period of a component in the target open source software. After the validity period, the software may no longer operate normally or require a license update to continue to use.

[0109] The continuous integration tool platform can send an SCA detection request of the target open source software by calling the interface of the open source governance platform. The SCA detection request can carry a compressed package of the target open source software and encrypted identity information. Optionally, the encrypted identity information can also be carried by the compressed package of the target open source software itself.

[0110] Optionally, the SCA detection request of the target open source software may also carry any one or more items such as a project identifier (projectId), a task identifier (taskID), etc. Among them, projectId can be used to identify each target open source software, and the target open source software can be determined by the project identifier. taskID can be used to identify the security quality detection task corresponding to the SCA detection request, and taskID can enable the SCA tool platform to clearly understand the security quality detection content required for the target open source software.

[0111] The continuous integration tool platform can write the API of the open source governance platform into a command line script (shell script) plug-in to implement the call to the open source governance platform. Alternatively, the continuous integration tool platform can also directly write the API call of the open source governance platform in the source code.

[0112] S103. The open source governance platform verifies the legitimacy of the SCA detection request based on the encrypted identity information.

[0113] For example, Figure 3 As shown, the open source governance platform uses RSA's private key to decrypt the ciphertext. By verifying the system source of the target open source software of the SCA detection request, it can confirm whether the SCA detection request comes from a trusted and known operating system or platform. Different operating systems or platforms may be subject to different compliance regulations. Verifying the system source can ensure that the SCA detection request meets the relevant compliance requirements, thereby avoiding possible legal risks and compliance issues.

[0114] By verifying the expiration time of the SCA detection request, potential security risks in the target open source software can be prevented, because after the expiration time, the target open source software may introduce potential security compliance risks.

[0115] Therefore, if the system source of the SCA detection request is correct and the expiration time has not expired, it means that the target open source software meets the relevant security compliance requirements and has the relevant permissions, and the SCA detection request is determined to be legal; otherwise, it means that the target open source software does not meet the relevant security compliance requirements and / or does not have the relevant permissions, and the SCA detection request is determined to be illegal.

[0116] S104. If the legitimacy verification of the SCA detection request passes, the open source governance platform calls the interface of the SCA tool platform to upload the compressed package of the target open source software, and initiates the SCA detection of the target open source software.

[0117] Optionally, SCA detection may include vulnerability matching and / or license matching for the target open source software.

[0118] Vulnerability matching can be to compare the vulnerabilities of the target open source software with the known open source vulnerability database. Through vulnerability matching, security vulnerabilities in the target open source software can be discovered in time so that they can be repaired in time to avoid security risks.

[0119] License matching can be to compare the license in the target open source software with the known license. Through license matching, it is ensured that the components included in the software comply with their license requirements, thus avoiding potential security risks.

[0120] S105. The SCA tool platform performs SCA detection on the target open source software based on the compressed package.

[0121] As mentioned above, the SCA tool platform can detect the vulnerabilities of the target open source software by matching the vulnerabilities of the target open source software from the vulnerability library based on the compressed package of the target open source software. It can also extract the license of the target open source software and classify the risks of the license through license matching, thereby detecting the risk level of the license of the target open source software.

[0122] The embodiment of the present application realizes the connection between the SCA tool platform and the continuous integration tool platform through the open source governance platform. Compared with the method in the prior art that requires manual deployment and management of SCA plug-ins on the Devops platform, the invasiveness of the SCA plug-in to the continuous integration tool platform is avoided. Regardless of how the target open source software changes, the user only needs to directly call the OpenAPI of the SCA tool platform to realize the security quality detection of the target open source software by the SCA tool platform, which increases the flexibility of the SCA tool platform and realizes the automatic detection of the target open source software by the SCA tool platform.

[0123] During the process of the SCA tool platform detecting the compressed package of the benchmark open source software, the continuous integration tool platform can query the SCA detection status and / or the SCA detection result. Figure 4 The flowchart of querying SCA detection status and detection results provided in the embodiment of the present application is as follows. Figure 4 As shown, the method includes:

[0124] S201, calling the interface of the open source governance platform to send a query request. The query request is used to query the SCA detection status and / or SCA detection results of the target open source software. The query request includes: encrypted identity information.

[0125] Correspondingly, the open source governance platform receives the query request.

[0126] Optionally, the SCA detection status of the target open source software may be detection status such as detection started, detection in progress, detection completed, etc. The SCA detection result of the target open source software may include a vulnerability detection result and a license risk detection result of the target open source software.

[0127] Optionally, the encrypted identity information included in the query request is consistent with the above-mentioned encrypted identity information. The encrypted identity information can ensure the security of the identity information of the target open source software and prevent the identity information of the target open source software from being leaked.

[0128] Optionally, the continuous integration tool platform can write the API of the open source governance platform into a command line script (shell script) plug-in to implement the call to the open source governance platform. Alternatively, the continuous integration tool platform can also directly write the API call of the open source governance platform in the source code.

[0129] S202. The open source governance platform verifies the legitimacy of the query request based on the encrypted identity information.

[0130] The process by which the open source governance platform verifies the legitimacy of query requests based on encrypted identity information is consistent with the process by which the open source governance platform verifies the legitimacy of SCA detection requests based on encrypted identity information, and will not be repeated here.

[0131] S203. If the legitimacy verification of the query request passes, the open source governance platform calls the interface of the SCA tool platform to send the query request.

[0132] Correspondingly, the SCA tool platform receives the query request.

[0133] Optionally, the open source governance platform can call the SCA tool platform through the OpenAPI of the SCA tool platform.

[0134] S204. The SCA tool platform obtains query results based on the query request.

[0135] Optionally, the SCA tool platform query result corresponds to the query request, that is, it may include the SCA detection status and / or the SCA detection result. The SCA detection status of the target open source software may be detection status such as detection started, detection in progress, detection completed, etc. The SCA detection result of the target open source software may include the vulnerability detection result and the license risk detection result of the target open source software.

[0136] S205. The SCA tool platform returns the query result to the open source governance platform.

[0137] Accordingly, the open source governance platform receives the query result.

[0138] Optionally, the SCA tool platform may return the above query results to the open source governance platform through OpenAPI.

[0139] S206. The open source governance platform sends the query results to the continuous integration tool platform.

[0140] Accordingly, the continuous integration tool platform receives the query result.

[0141] Optionally, the open source governance platform may return the above query results to the continuous integration tool platform via an API.

[0142] The above description is that the continuous integration tool platform obtains the query results by initiating a query to the open source governance platform. Optionally, the open source governance platform can also upload the compressed package of the target open source software and initiate the SCA detection of the target open source software after calling the interface of the SCA tool platform, and then actively report the query results to the continuous integration tool platform.

[0143] In this implementation, the query result can be obtained by the open source governance platform from the SCA tool platform by initiating a query to the SCA tool platform, or it can be actively reported to the open source governance platform by the SCA tool platform itself.

[0144] The embodiment of the present application implements the query of SCA detection status and / or SCA detection results by the continuous integration tool platform through the open source governance platform, which facilitates the continuous integration tool platform to continuously track the detection status and results of the open source software by the SCA tool platform, and facilitates the subsequent process.

[0145] After the continuous integration tool platform obtains the detection results of the target open source software, it can determine the quality gate of the target open source software based on the detection results. The quality gate is used to control the quality of the software. If the gate requirements are not met, the continuous integration tool platform pipeline will not be allowed to execute further, thereby achieving risk control of the target open source software.

[0146] The quality gate of the target open source software can be determined by the continuous integration tool platform itself or by the open source governance platform. The following takes the determination by the open source governance platform as an example for explanation.

[0147] Figure 5 The flowchart of the quality access control determination of the target open source software provided by the embodiment of the present application is as follows. Figure 5 As shown, the method includes:

[0148] S301. The continuous integration tool platform calls the interface of the open source governance platform to send a quality access control determination request for the target open source software.

[0149] Correspondingly, the open source governance platform receives the quality gate determination request, wherein the quality gate determination request carries the SCA detection result and encrypted identity information of the target open source software.

[0150] Optionally, the quality gate determination may be to determine whether the target open source software meets quality standards and security requirements based on the vulnerability level and / or license risk level of the target open source software.

[0151] Optionally, when judging whether the target open source software meets the quality standards and security requirements based on the vulnerability level and / or license risk level of the target open source software, the interface used by the continuous integration tool platform to call the open source governance platform may be the same or different.

[0152] For example, the interface called to determine whether the target open source software meets the quality standards and security requirements based on the vulnerability level of the target open source software and the interface called to determine whether the target open source software meets the quality standards and security requirements based on the license risk level of the target open source software can be the same interface or two different interfaces, and this application does not limit this.

[0153] S302. The open source governance platform verifies the legitimacy of the quality access control determination request based on the encrypted identity information.

[0154] The process of the open source governance platform verifying the legitimacy of quality access control requests and requests based on encrypted identity information is consistent with the process of the open source governance platform verifying the legitimacy of SCA detection requests based on encrypted identity information, and will not be repeated here.

[0155] S303. If the legitimacy verification of the quality access control determination request passes, the quality access control determination result of the target open source software is obtained through the quality access control decision tree model and the SCA detection result. The quality access control decision tree model at least includes: a vulnerability risk decision tree and a license risk decision tree. The vulnerability risk decision tree and the license risk decision tree are obtained by pre-training the decision tree using a training data set, and the training data set is constructed by labeling based on the reference classification labeling results provided by the large model.

[0156] Optionally, the quality gate determination result may be pass or fail.

[0157] Optionally, the quality gate decision tree model can be implemented by the following principles:

[0158] First, we construct a training data set D, feature set A, threshold z, and generate a decision tree T. Table 1 shows the feature set of the target software's security vulnerabilities. For the vulnerability risk decision tree, feature set A includes features such as "business system level", "whether it is Internet-oriented", "whether the vulnerability has a public proof of concept (POC)", "whether the vulnerability can be exploited", and "vulnerability hazard level".

[0159] Table 1

[0160]

[0161] Table 2

[0162]

[0163] Table 2 shows the feature set of license risk. For the license risk decision tree, feature set A includes features such as “business system level”, “whether to provide external services”, “license risk level”, “system distribution method”, and “open source software usage scenario”.

[0164] Among them, the Open Source Initiative (OSI) is an organization that defines "open source", develops open source protocol standards, maintains the Open Source Definition (OSD) and its list of approved open source licenses. Licenses that comply with the OSI Open Source Definition are recognized as open source licenses, which allow software to be freely used, modified, and shared.

[0165] Software Package Data Exchange (SPDX) is an internationally accepted software bill of materials format.

[0166] The General Public License (GPL) is a mandatory license that requires any derivative work that uses or modifies GPL-licensed software to also use the GPL license.

[0167] The above training data set D can be classified and labeled by security experts and compliance experts in combination with the suggestions of the big model.

[0168] The above-mentioned training data set D can be classified and labeled by security experts in combination with the suggestions of the big model for the training data set D of vulnerability detection results, and the labeled conclusion can be to repair or not repair; the training data set D of license detection results can be classified and labeled by compliance experts in combination with the suggestions of the big model, and the labeled conclusion can be to replace or not replace.

[0169] Figure 6A flow chart of classifying and labeling a training data set provided for this embodiment. Optionally, the number of samples in the training data set in the training data set D may be 500, of which the training sample set may be 400 and the validation sample set may be 100. It should be noted that this application does not limit the number of samples in the training data set and the number of training sample sets and validation sample sets.

[0170] like Figure 6 As shown in the figure, the process of classifying and labeling the training data set is as follows:

[0171] 1. Select 10 representative open source software, for example, management systems, Internet-oriented systems, transaction systems, etc. Please note that there is no limit on the number of open source software.

[0172] 2. The SCA tool platform detects the compressed packages of 10 open source software.

[0173] 3. Obtain vulnerability detection results and license detection results for each open source software.

[0174] Exemplarily, each vulnerability detection result includes: business system level, whether it is Internet-oriented, whether it is customer-oriented, whether it involves core securities transactions, business service time, whether the vulnerability has a public POC, whether the vulnerability can be exploited, vulnerability hazard level, and attack type.

[0175] Each vulnerability detection result includes: business system level, whether to provide external services, license risk level, OSI certification, FSF license, SPDX certification, and GPL compatibility.

[0176] 4. Security experts classify and annotate the open source software of the vulnerability detection results based on the recommendations of the big model. The annotated conclusion can be to fix or not fix.

[0177] Exemplarily, the big model's suggestions for vulnerability detection results may include any one or more of the following:

[0178] Business system level of vulnerability: [Important],

[0179] Is it Internet-oriented: [Yes],

[0180] Whether to serve customers: [Yes],

[0181] Whether it involves core securities transactions: [Yes],

[0182] Business service time: [7*24],

[0183] Is there a public POC for the vulnerability: [Yes],

[0184] Is the vulnerability exploitable: [Yes],

[0185] Vulnerability hazard level: [very critical],

[0186] Attack type: [Ranged].

[0187] Security experts combine the recommendations of the above large model to output a conclusion on whether to repair or not.

[0188] 5. Compliance experts classify and label the open source software in the license detection results based on the recommendations of the big model. The labeled conclusion can be replacement or non-replacement.

[0189] Exemplarily, the big model's recommendations for license detection results may include any one or more of the following:

[0190] Component business system level: [Important],

[0191] Whether to provide external services: [Yes],

[0192] License risk level: [High risk],

[0193] OSI certification: [passed],

[0194] FSF License: [approved],

[0195] SPDX certification: [passed],

[0196] GPL compatibility: [Not approved].

[0197] The compliance experts combine the recommendations of the above large model to output a conclusion on whether to replace or not.

[0198] It should be noted that the present application does not limit the order of step 4 and step 5, and step 4 may be performed first, and then step 5. Alternatively, step 5 may be performed first, and then step 4. Alternatively, step 4 and step 5 may be performed simultaneously.

[0199] After the training data set D is classified and labeled, the quality access control decision tree model is trained using the classified and labeled training data set D. The quality access control decision tree model at least includes: a vulnerability risk decision tree and a license risk decision tree. The specific steps are as follows:

[0200] 1. If all instances in D belong to the same class C k (k means that sample D itself is divided into k categories according to the result), then T is a single-node tree, and class C k Return T as the class label for this node.

[0201] 2. If the feature set A is empty, then T is a single-node tree, and the class C with the largest number of instances in D is k Return T as the class label for this node.

[0202] 3. Calculate the information gain of each feature a in A to D according to the information gain algorithm formula: A g =Gain(D,a), defined as the difference between the information entropy Ent(D) of set D and the information conditional entropy Ent(D|a) of D under the given feature a. That is, the information entropy is calculated by formula (1) and the conditional entropy is calculated by formula (2):

[0203]

[0204] Among them, D v Indicates the number of samples contained in the vth branch node in the a attribute.

[0205] C kv It indicates the number of samples contained in the kth category among the number of samples contained in the vth branch node in the a attribute.

[0206] Select A with the largest information gain g .

[0207] 4. If the information gain of a is A g If it is less than the threshold z, then T is set to a single-node tree, and the class C with the largest number of instances in D is k Return T as the class label for this node.

[0208] 5. If the information gain of a is A g is greater than the threshold z, then for each value of a i , according to a=a i Split D into several non-empty subsets D i , D i The class with the largest number of instances is used as a label, and child nodes are constructed. The tree T is composed of the node and its child nodes, and T is returned.

[0209] 6. For the i-th child node, use D i is the training set, (Aa) is the feature set, and steps 1 to 5 are recursively called to obtain the subtree T i , return to T i .

[0210] After building the decision tree T, considering the complexity and accuracy of vulnerability and license risk identification, it is necessary to prune the decision tree. The steps are as follows:

[0211] Decision tree pruning is often achieved by minimizing the loss function or cost function of the entire decision tree. Let the number of leaf nodes of tree T be |T|, t is a leaf node of tree T, and the leaf node has N t sample points, of which class k has N sample points tk k=1,2,...,K,H t(T) is the empirical entropy on leaf node t, α≥0 is the parameter, and the loss function of decision tree learning can be obtained by formulas (3) to (5):

[0212]

[0213] Further,

[0214]

[0215] C α (T) = C (T) + α | T | (5)

[0216] Determine α and select the model with the smallest loss function, that is, the subtree T with the smallest loss function α To prune, follow these steps:

[0217] 1. Calculate the empirical entropy of each node.

[0218] 2. Recursively shrink upward from the leaf nodes of the tree. Suppose the overall trees before and after a group of leaf nodes shrink to their parent nodes are T A With T B , and the corresponding loss function values ​​are C α (T A ) and C α (T B ), if: C α (T A ) <C α (T B ), pruning is performed, that is, the parent node is changed into a new leaf node.

[0219] 3. Return to step 2 until you can no longer proceed, and obtain the subtree T with the minimum loss function α .

[0220] S304. The open source governance platform sends the quality access control determination result to the continuous integration tool platform.

[0221] Correspondingly, the continuous integration tool platform receives the quality gate determination result.

[0222] Optionally, the open source governance platform can return the above quality access control determination results to the continuous integration tool platform through an API.

[0223] In the prior art, only one of the vulnerability level and the license risk level is selected as a factor to be considered for quality access control, and the refined control of quality access control is ignored. A fixed threshold is often used for all target open source software, or different fixed thresholds are used for different target open source software. The setting of the threshold is based on experience, and it is difficult to accurately perform security quality testing on the target open source software. Compared with the prior art, the embodiment of the present application sets a security quality access control for open source software, and uses a decision tree model based on quality access control. The model is trained based on a large amount of data, and the characteristics of high-risk vulnerabilities and high-risk licenses are learned. It can accurately identify high-risk vulnerabilities and high-risk licenses, and improve the accuracy of security quality testing on target open source software.

[0224] Further, after receiving the quality gate determination result, the continuous integration tool platform will take different measures according to different quality gate determination results. Optionally, the continuous integration tool platform can call a shell script plug-in and configure the shell script plug-in to the continuous integration tool platform pipeline. Figure 7 A flow chart of the continuous integration tool provided in the embodiment of the present application taking different measures for different quality access control determination results, the specific steps are as follows:

[0225] 1. Compile and package the target open source software and output a compressed package.

[0226] 2. Call the shell script plug-in.

[0227] Among them, the Shell script plug-in includes the API of the open source governance platform, and the specific execution process of the API is implemented by calling the OpenAPI of the SCA tool platform.

[0228] 3. Determine whether the quality access control is passed. If yes, go to step 4. If no, go to step 5.

[0229] 4. Continue to deploy the target open source software.

[0230] 5. Based on the quality inspection results, develop and repair the target open source software. After the development and repair are completed, return to step 1.

[0231] like Figure 7 As shown, when the quality gate judgment result is passed, the continuous integration tool platform executes the next step of the continuous integration tool platform pipeline. When the quality gate judgment result is not passed, the continuous integration tool platform develops, repairs, compiles and packages the target open source software. Optionally, the continuous integration tool platform can also send a prompt message to the target address to indicate the reason why the quality gate judgment result is not passed, so that the user can develop, repair, compile and package the target open source software by himself.

[0232] Optionally, when the quality gate determination result is failure, the target open source software is developed, repaired, compiled and packaged, and then the above detection steps for the target open source software are repeated.

[0233] The embodiment of the present application adopts different measures according to different quality access control determination results, and the existing vulnerability risks and license risks can be handled in a timely manner, thereby improving the processing efficiency of the quality access control determination results.

[0234] Furthermore, the shell script of the continuous integration tool platform may also include calling an interface of the open source governance platform to send an email notification request. Figure 8 A schematic diagram of a shell script of a continuous integration tool platform provided in an embodiment of the present application, the main steps are as follows:

[0235] 1. Get parameters such as Token, projectId, taskID, etc.

[0236] 2. Call the detection API of the open source governance platform.

[0237] 3. Check whether the open source governance platform API is detected. If yes, go to step 4. If no, repeat step 3.

[0238] 4. Call the open source governance platform to obtain detection details.

[0239] 5. Call the open source governance platform to obtain the quality access control judgment results.

[0240] 6. Call the open source governance platform to send a notification to the target address.

[0241] like Figure 8 As shown, after calling the open source governance platform to obtain the quality gate determination result, the interface of the open source governance platform can be called to send a notification. Optionally, the notification can be an email notification request, which is used to request feedback of the SCA detection results and / or quality gate determination results of the target open source software to the target address via email. The email notification request includes encrypted identity information. Optionally, the email notification request can carry the target address. Alternatively, the open source governance platform pre-stores a mapping relationship between the target open source software and the target address, or a mapping relationship between the projectID and / or taskID corresponding to the target open source software and the target address.

[0242] The embodiment of the present application can promptly feedback the SCA detection results and quality access control determination results of the target open source software to the target address by means of email notification, which is conducive to developers to process the target open source software in a timely manner and improve work efficiency.

[0243] The embodiment of the present application also provides a software detection system, which includes: a continuous integration tool platform, an open source governance platform, and an SCA tool platform; wherein:

[0244] The continuous integration tool platform is deployed with a target script, which is used to execute the method executed by the continuous integration tool platform in the above embodiment by running the target script.

[0245] The open source governance platform is used to execute the method executed by the open source governance platform in the above embodiment.

[0246] The SCA tool platform is used to execute the method executed by the SCA tool platform in the above embodiment.

[0247] The above is an embodiment of the method provided by the present application. The following is a description of the device provided by the present application.

[0248] Fig. 9 The first software detection device provided in the present application is a schematic diagram of the structure. Fig. 9 As shown, the device can be applied to an open source governance platform, and the software detection device 400 can include, for example: a receiving module 401, a verification module 402, and a calling module 403. Optionally, the device 400 can also include a sending module 404.

[0249] The receiving module 401 is used to receive the SCA detection request of the target open source software sent by the continuous integration tool platform by calling the interface of the open source governance platform; the SCA detection request carries the compressed package of the target open source software and the encrypted identity information.

[0250] The verification module 402 is used to verify the legitimacy of the SCA detection request based on the encrypted identity information.

[0251] The calling module 403 is used to call the interface of the SCA tool platform to upload the compressed package of the target open source software and initiate the SCA detection of the target open source software when the legitimacy verification of the SCA detection request passes.

[0252] Optionally, the receiving module 401 is used to receive a query request sent by the continuous integration tool platform through a calling interface after the verification module 402 passes the legitimacy verification of the SCA detection request; the query request is used to query the SCA detection status and / or SCA detection result of the target open source software; the query request includes: encrypted identity information. The verification module 402 is also used to verify the legitimacy of the query request based on the encrypted identity information. The calling module 403 is also used to call the interface of the SCA tool platform to send a query request when the legitimacy verification of the query request passes; the receiving module 401 is also used to receive the query result returned by the SCA tool platform. The sending module 404 is used to send the query result to the continuous integration tool platform.

[0253] Optionally, the receiving module 401 is also used to receive the quality gate determination request of the target open source software sent by the continuous integration tool platform through the calling interface; the quality gate determination request carries the SCA detection result of the target open source software and the encrypted identity information; the verification module 402 is also used to verify the legitimacy of the quality gate determination request based on the encrypted identity information; if the legitimacy verification of the quality gate determination request passes, the quality gate determination result of the target open source software is obtained through the quality gate decision tree model and the SCA detection result; the quality gate decision tree model at least includes: a vulnerability risk decision tree and a license risk decision tree; the vulnerability risk decision tree and the license risk decision tree are obtained by pre-training the decision tree using a training data set, and the training data set is constructed by labeling based on the reference classification labeling result provided by the large model. The sending module 404 is also used to send the quality gate determination result to the continuous integration tool platform.

[0254] Optionally, the receiving module 401 is also used to receive an email notification request sent by the continuous integration tool platform through a calling interface; the email notification request is used to request feedback of the SCA detection results and quality gate determination results of the target open source software to the target address via email; the email notification request includes the encrypted identity information; the verification module 402 is also used to verify the legitimacy of the email notification request based on the encrypted identity information; the sending module 404 is also used to send an email containing the SCA detection results and quality gate determination results of the target open source software to the target address when the legitimacy verification of the email notification request passes.

[0255] The software detection device 400 provided in the embodiment of the present application can be used to implement the actions performed by the open source governance platform in any of the aforementioned method embodiments. Its implementation principles and technical effects are similar and will not be repeated here.

[0256] Fig.10 This is a schematic diagram of the structure of the second software detection device provided in the embodiment of the present application. Fig.10 As shown, the device can be applied to a continuous integration tool platform, and the software detection device 500 can include, for example: an acquisition module 501 and a calling module 502. Optionally, the software detection device 500 can also include: a receiving module 503.

[0257] The acquisition module 501 is used to acquire the compressed package of the compiled and packaged target open source software;

[0258] Calling module 502 is used to call the interface of the open source governance platform to send an SCA detection request for the target open source software; the SCA detection request carries a compressed package of the target open source software and encrypted identity information; the SCA detection request is used to trigger the open source governance platform to call the SCA tool platform to perform SCA detection on the target open source software after the legitimacy of the SCA detection request is verified based on the encrypted identity information.

[0259] Optionally, the calling module 502 is further used to call the interface of the open source governance platform to send a query request; the query request is used to query the SCA detection status and / or SCA detection result of the target open source software; the query request includes: encrypted identity information. The receiving module 503 is used to receive the query result obtained by the open source governance platform after the query request is verified to be legitimate based on the encrypted identity information and the SCA tool platform is called.

[0260] Optionally, the calling module 502 is also used to call the interface of the open source governance platform to send a quality access control determination request for the target open source software; the quality access control determination request carries the SCA detection result of the target open source software and the encrypted identity information; the receiving module 503 is also used to receive the quality access control determination result of the target open source software obtained by the open source governance platform through a quality access control decision tree model and the SCA detection result after the legitimacy of the quality access control determination request is verified based on the encrypted identity information; the quality access control decision tree model includes at least: a vulnerability risk decision tree and a license risk decision tree; the vulnerability risk decision tree and the license risk decision tree are obtained by pre-training the decision trees using a training data set, and the training data set is constructed by labeling based on the reference classification labeling result provided by the large model.

[0261] Optionally, calling module 502 is also used to call the interface of the open source governance platform to send an email notification request; the email notification request is used to request feedback of the SCA detection results and quality access control determination results of the target open source software to the target address via email; the email notification request includes the encrypted identity information.

[0262] The software detection device 500 provided in the embodiment of the present application can be used to implement the actions performed by the continuous integration tool platform in any of the aforementioned method embodiments. Its implementation principles and technical effects are similar and will not be repeated here.

[0263] Fig.11 The third software detection device provided in the present application is a schematic diagram of the structure. Fig.11 As shown, the device can be applied to the SCA tool platform, and the software detection device 600 can include, for example: a receiving module 601 and a detection module 602. Optionally, the device 600 can also include, for example: an acquisition module 603 and a sending module 604.

[0264] The receiving module 601 is used to receive the compressed package of the target open source software uploaded by the open source governance platform by calling the interface of the SCA tool platform, and the trigger instruction for performing SCA detection on the target open source software;

[0265] The detection module 602 is used to perform SCA detection on the target open source software based on the compressed package.

[0266] Optionally, the receiving module 601 is further used to receive a query request sent by the open source governance platform by calling the interface of the SCA tool platform; the query request is used to query the SCA detection status and / or SCA detection result of the target open source software; the obtaining module 603 is used to obtain the query result based on the query request. The sending module 604 is used to return the query result to the open source governance platform.

[0267] The software detection device 600 provided in the embodiment of the present application can be used to implement the actions performed by the SCA tool platform in any of the aforementioned method embodiments. Its implementation principles and technical effects are similar and will not be repeated here.

[0268] Fig.12 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Fig.12 As shown, the electronic device 900 may include: a memory 901 and a processor 902. The electronic device may be, for example, the aforementioned open source governance platform. Optionally, the electronic device may further include a transceiver 903, wherein the memory 901 and the processor 902 communicate; illustratively, the memory 901, the processor 902 and the transceiver 903 may communicate via a communication bus 904, the memory 901 is used to store a computer program, and the processor 902 executes the computer program to implement the method of the above embodiment.

[0269] Optionally, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc. The steps in the method embodiments disclosed in the present application may be directly implemented as being executed by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor.

[0270] An embodiment of the present application further provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, a method in any of the above method embodiments is implemented.

[0271] An embodiment of the present application also provides a computer program product, including a computer program, which implements the method in any of the above method embodiments when the computer program is executed by a processor.

[0272] All or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned memory (storage medium) includes: read-only memory (ROM), RAM, flash memory, hard disk, solid state drive, magnetic tape, floppy disk, optical disc and any combination thereof.

[0273] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processing unit of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0274] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0275] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0276] Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

[0277] In the present application, the term "include" and its variations may refer to non-restrictive inclusion; the term "or" and its variations may refer to "and / or". The terms "first", "second", etc. in the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. In the present application, "plurality" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previously associated objects are in an "or" relationship.

Claims

1. A software detection method, characterized in that: The method is applied to an open source governance platform, and the method includes: Receiving an SCA detection request of a target open source software sent by a continuous integration tool platform by calling an interface of the open source governance platform; the SCA detection request carries a compressed package of the target open source software and encrypted identity information; Based on the encrypted identity information, verify the legitimacy of the SCA detection request; If the legitimacy verification of the SCA detection request passes, the interface of the SCA tool platform is called to upload the compressed package of the target open source software, and the SCA detection of the target open source software is initiated.

2. The method according to claim 1, characterized in that: After the legitimacy verification of the SCA detection request is passed, the method further includes: Receiving a query request sent by the continuous integration tool platform through a calling interface; the query request is used to query the SCA detection status and / or SCA detection result of the target open source software; the query request includes: encrypted identity information; Based on the encrypted identity information, verify the legitimacy of the query request; If the query request passes the legality verification, the interface of the SCA tool platform is called to send the query request; Receiving the query result returned by the SCA tool platform; The query result is sent to the continuous integration tool platform.

3. The method according to claim 2, characterized in that The method further comprises: Receiving a quality gate determination request for the target open source software sent by the continuous integration tool platform through a calling interface; the quality gate determination request carries the SCA detection result of the target open source software and the encrypted identity information; Based on the encrypted identity information, verify the legitimacy of the quality access control determination request; If the legitimacy verification of the quality access control determination request passes, the quality access control determination result of the target open source software is obtained through the quality access control decision tree model and the SCA detection result; the quality access control decision tree model at least includes: a vulnerability risk decision tree and a license risk decision tree; the vulnerability risk decision tree and the license risk decision tree are obtained by pre-training the decision tree using a training data set, and the training data set is constructed by labeling based on the reference classification labeling result provided by the large model; Send the quality gate determination result to the continuous integration tool platform.

4. The method according to claim 3, characterized in that: The method further comprises: Receiving an email notification request sent by the continuous integration tool platform through a calling interface; the email notification request is used to request feedback of the SCA detection result and quality access control determination result of the target open source software to a target address via email; the email notification request includes the encrypted identity information; Based on the encrypted identity information, verify the legitimacy of the email notification request; If the legitimacy verification of the email notification request is passed, an email containing the SCA test results and quality access control determination results of the target open source software is sent to the target address.

5. A software detection method, characterized in that: The method is applied to a continuous integration tool platform, and the method comprises: Get the compressed package of the compiled and packaged target open source software; Call the interface of the open source governance platform to send an SCA detection request for the target open source software; the SCA detection request carries a compressed package of the target open source software and encrypted identity information; the SCA detection request is used to trigger the open source governance platform to call the SCA tool platform to perform SCA detection on the target open source software after the legitimacy of the SCA detection request is verified based on the encrypted identity information.

6. The method according to claim 5, characterized in that The method further comprises: Calling the interface of the open source governance platform to send a query request; the query request is used to query the SCA detection status and / or SCA detection result of the target open source software; the query request includes: encrypted identity information; After the open source governance platform verifies the legitimacy of the query request based on the encrypted identity information, the query result obtained by calling the SCA tool platform is received.

7. The method according to claim 6, characterized in that The method further comprises: Calling the interface of the open source governance platform to send a quality access control determination request for the target open source software; the quality access control determination request carries the SCA detection result of the target open source software and the encrypted identity information; After the open source governance platform verifies the legitimacy of the quality access control decision request based on the encrypted identity information, the quality access control decision result of the target open source software is obtained through the quality access control decision tree model and the SCA detection result; the quality access control decision tree model at least includes: a vulnerability risk decision tree and a license risk decision tree; the vulnerability risk decision tree and the license risk decision tree are obtained by pre-training the decision trees using a training data set, and the training data set is constructed by labeling based on the reference classification labeling result provided by the large model.

8. The method according to claim 7, characterized in that The method further comprises: Call the interface of the open source governance platform to send an email notification request; the email notification request is used to request feedback of the SCA detection results and quality access control determination results of the target open source software to the target address via email; the email notification request includes the encrypted identity information.

9. The method according to claim 7, characterized in that: The method further comprises: When the quality gate determination result is passed, deploying the target open source software; When the quality gate determination result is failure, the target open source software is developed, repaired, compiled, packaged, and then retested.

10. A software detection method, characterized in that: The method is applied to the SCA tool platform, and the method includes: Receive a compressed package of the target open source software uploaded by the open source governance platform by calling the interface of the SCA tool platform, and a trigger instruction for performing SCA detection on the target open source software; Based on the compressed package, SCA detection is performed on the target open source software.

11. The method according to claim 10, characterized in that The method further comprises: Receiving a query request sent by the open source governance platform by calling the interface of the SCA tool platform; the query request is used to query the SCA detection status and / or SCA detection result of the target open source software; Obtaining query results based on the query request; Return the query result to the open source governance platform.

12. A software detection method, characterized in that: The method comprises: The continuous integration tool platform obtains the compressed package of the target open source software; The continuous integration tool platform calls the interface of the open source governance platform to send an SCA detection request for the target open source software; the SCA detection request carries a compressed package of the target open source software and encrypted identity information; The open source governance platform verifies the legitimacy of the SCA detection request based on the encrypted identity information; If the legitimacy verification of the SCA detection request passes, the open source governance platform calls the interface of the SCA tool platform to upload the compressed package of the target open source software, and initiates the SCA detection of the target open source software; The SCA tool platform performs SCA detection on the target open source software based on the compressed package.

13. A software detection system, characterized in that: The software detection system includes: a continuous integration tool platform, an open source governance platform, and an SCA tool platform; wherein, The continuous integration tool platform is deployed with a target script, which is used to execute the method according to any one of claims 5 to 9 by running the target script; The open source governance platform is used to execute the method as described in any one of claims 1 to 4; The SCA tool platform is used to execute the method according to any one of claims 9 to 10.

14. A software detection device, characterized in that: The device is applied to an open source governance platform, and the device includes: A receiving module, used to receive an SCA detection request of a target open source software sent by a continuous integration tool platform by calling an interface of the open source governance platform; the SCA detection request carries a compressed package of the target open source software and encrypted identity information; A verification module, used to verify the legitimacy of the SCA detection request based on the encrypted identity information; The calling module, if the legitimacy verification of the SCA detection request passes, calls the interface of the SCA tool platform to upload the compressed package of the target open source software, and initiates the SCA detection of the target open source software.

15. A software detection device, characterized in that: The device is applied to a continuous integration tool platform, and the device comprises: Get the module, and get the compressed package of the compiled and packaged target open source software; A calling module calls the interface of the open source governance platform to send an SCA detection request for the target open source software; the SCA detection request carries a compressed package of the target open source software and encrypted identity information; the SCA detection request is used to trigger the open source governance platform to call the SCA tool platform to perform SCA detection on the target open source software after the legitimacy of the SCA detection request is verified based on the encrypted identity information.

16. A software detection device, characterized in that: The device is applied to the SCA tool platform, and the device includes: A receiving module receives a compressed package of the target open source software uploaded by the open source governance platform by calling the interface of the SCA tool platform, and a trigger instruction for performing SCA detection on the target open source software; The detection module performs SCA detection on the target open source software based on the compressed package.

17. An electronic device, characterized in that: The electronic device comprises: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 11.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 11 when executed by a processor.

19. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 11 when being executed by a processor.

Images