Software supply chain construction and visualization system and method

Abstract

The invention discloses a software supply chain construction and visualization system and method, belongs to the technical field of open source software, and is applied to the aspect of construction of a supply chain and a dependency relationship of the open source software. The implementation method comprises the following steps: 1, constructing a root node of a software supply chain; 2, constructing a node dependence analysis processing process of the software supply chain; 3, performing dependency analysis on the root node of the software supply chain in the step 1 by adopting the node dependency analysis processing process of the software supply chain in the step 2 to obtain a dependency relationship between the software package set and the software packages; 4, generating a software supply chain directed graph according to the dependency relationship between the software package set and the software packages; 5, visualizing the software supply chain by using the directed graph of the software supply chain and adopting a node link drawing mode of the directed graph; compared with the prior art, the technical problems of construction and visualization of the software supply chain of the Python language are solved under the environment that a software package is not installed in an open source environment.

Description

Technical Field

[0001] The present invention relates to a software supply chain construction and visualization system and method, belongs to the technical field of open source software, and is applied to the supply chain and dependency relationship of building open source software. Background Art

[0002] In the open source environment, the current status of the software supply chain is as follows: As a package management tool for Python, pip has its own dependency resolution algorithm, which can handle the dependencies of installed Python packages while installing third-party software packages. However, pip does not provide a software supply chain construction and visualization function.

[0003] In an open source environment, pip's dependency resolution has the following defects: pip's dependency resolution process is combined with the software installation process, resulting in high time and space costs.

[0004] Therefore, how to build and visualize the software supply chain in Python language in an open source environment without installing software packages has become an urgent problem to be solved. Summary of the invention

[0005] The purpose of the present invention is to solve the technical problem of building and visualizing a software supply chain in Python language in an open source environment without installing a software package, and to propose a system and method for building and visualizing a software supply chain.

[0006] The objective of the present invention is achieved through the following technical solutions:

[0007] The present invention discloses a method for constructing and visualizing a software supply chain, comprising the following steps:

[0008] Step 1: Build the root node of the software supply chain;

[0009] Step 1.1: Get the software package name using the input method;

[0010] Step 1.2: Calling the application programming interface to obtain the real-time updated version information of the software package, and obtaining the software package version number in an optional manner;

[0011] Step 1.3: Use the software package name and version number to build the root node of the software supply chain;

[0012] Step 2: Construct the node dependency parsing process of the software supply chain;

[0013] Step 2.1: Call the dependency list to obtain the directly dependent child node; further obtain the package name and package version range of the directly dependent child node;

[0014] Step 2.2: Use the breadth-first traversal method to traverse the directly dependent child nodes to obtain the indirectly dependent child nodes;

[0015] Step 3: The root node of the software supply chain described in step 1 is subjected to dependency resolution using the software supply chain node dependency resolution processing process described in step 2 to obtain the software package set and the dependency relationship between the software packages;

[0016] Step 4: Generate a software supply chain directed graph by using the software package set and the dependency relationships between software packages in the manner shown in formula (1);

[0017] G=<V,E> (1)

[0018] Among them, G represents the software supply chain, V represents the Python software package set, and E represents the dependency set between software packages.

[0019] Step 5: Use the software supply chain directed graph to visualize the software supply chain using the node link drawing method of the directed graph;

[0020] The invention discloses a software supply chain construction and visualization system, which is used to implement the above method. The invention discloses a software supply chain construction and visualization system, which includes a dependency parsing module, a software supply chain construction module, and a software supply chain visualization module.

[0021] The dependency parsing module is used to perform dependency parsing according to the software package name and version, and parse out all the software packages that the software package needs to depend on and the dependency relationships between them; this will serve as the input of the software supply chain building module;

[0022] The software supply chain construction module is used to construct a mathematical expression of the software supply chain based on the software packages parsed by the dependency parsing module and the dependency relationships between them; this will serve as the input of the software supply chain visualization module;

[0023] The software supply chain visualization module is used to display a visualized software supply chain on the front end according to the software supply chain data output by the software supply chain construction module;

[0024] Beneficial effects:

[0025] Compared with the existing pip dependency parsing algorithm, it has the following benefits:

[0026] 1. The present invention can complete the dependency resolution process without actually installing the software package, effectively reducing the time and space costs of dependency resolution.

[0027] 2. Although pip can complete the dependency resolution process, it does not have the function of building a software supply chain. This system can clearly display the software supply chain of the software package to users. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It is a schematic diagram of the home page of the website of the present invention;

[0029] Figure 2 is a schematic diagram of a search result interface of the present invention;

[0030] Figure 3 A schematic diagram of the supply chain display interface of the present invention. DETAILED DESCRIPTION

[0031] In order to better illustrate the purpose and advantages of the present invention, the invention is further described below in conjunction with the accompanying drawings and examples. It should be noted that the implementation of the present invention is not limited to the following embodiments, and any form of modification or change made to the present invention will fall within the protection scope of the present invention.

[0032] Example

[0033] The system and method for building and visualizing a software supply chain of the present invention are specifically implemented in the following steps: Step 1: Building a root node of the software supply chain;

[0034] Step 1.1: Get the software package name using the input method;

[0035] In the embodiment, Figure 1 As shown, users can enter keywords in the input box to jump to Figure 2 The search results interface shows a list of software packages sorted from high to low based on the relevance of the keyword, and the user can select the software package name from the list.

[0036] Step 1.2: Calling the application programming interface to obtain the real-time updated version information of the software package, and obtaining the software package version number in an optional manner;

[0037] In the embodiment, Figure 3 As shown in the figure, after the user selects the boto3 package, the backend will query all versions of the package and send them to the frontend. The user can select a version of the package in the drop-down menu. Figure 3 In the example, the user selected version 1.34.101 of boto3.

[0038] Step 1.3: Use the software package name and version number to build the root node of the software supply chain;

[0039] In the embodiment, Figure 3As shown, after the front end determines the software package name boto3 and the software package version number 1.34.101, it builds it into the root node boto3 1.34.101 of the software supply chain and sends the root node to the back end.

[0040] Step 2: Construct the node dependency parsing process of the software supply chain;

[0041] Step 2.1: Call the dependency list to obtain the directly dependent child node; further obtain the package name and package version range of the directly dependent child node;

[0042] Step 2.2: Use the breadth-first traversal method to traverse the directly dependent child nodes to obtain the indirectly dependent child nodes;

[0043] Step 3: The root node of the software supply chain described in step 1 is subjected to dependency resolution using the software supply chain node dependency resolution processing process described in step 2 to obtain the software package set and the dependency relationship between the software packages;

[0044] In the embodiment, for the software package boto3 1.34.101 and all its child node software packages, the direct dependency information of each software package is stored in the setup.py file or the pyproject.toml file. By scanning these two files, the direct dependencies of the software package and the required version number range thereof can be obtained without installing the software package.

[0045] Starting from boto3 1.34.101, perform breadth-first traversal. For each node, ensure that the version number of the node meets the version range requirements of all software packages in the supply chain. If there is a version number that meets the requirements, add the direct dependencies of this version of the software package and their version number requirement range until all nodes are traversed and all software package names, version numbers, and dependencies between software packages are obtained.

[0046] Step 4: Generate a software supply chain directed graph by using the software package set and the dependency relationships between software packages in the manner shown in formula (1);

[0047] G=<V,E> (1)

[0048] Among them, G represents the software supply chain, V represents the Python software package set, and E represents the dependency set between software packages.

[0049] In the embodiment, G=<V,E>

[0050] V={boto31.34.101, botocore 1.34.101, jmespath 1.0.1, s3transfer 0.10.0, urllib31.26.18, awscrt 0.20.9, python-dateutil 2.8.2, six 1.16.0}

[0051] E={boto31.34.101→botocore 1.34.101, boto31.34.101

[0052] →jmespath 1.0.1, boto31.34.101

[0053] →s3transfer 0.10.0, botocore 1.34.101

[0054] →jmespath 1.0.1,botocore 1.34.101

[0055] →urllib31.26.18, botocore 1.34.101

[0056] →awscrt 0.20.9, botocore 1.34.101

[0057] → python-dateutil 2.8.2, python-dateutil 2.8.2 → six 1.16.0}

[0058] Step 5: Use the software supply chain directed graph to visualize the software supply chain using the node link drawing method of the directed graph;

[0059] In the embodiment, a front-end and back-end separation architecture is adopted, and the front-end adopts Vu e The backend uses the Python Django framework. After the directed graph G constructed by the backend in step 4 is passed to the frontend, the frontend uses the D3.js library to draw the software supply chain in the form of a directed graph node link to achieve visualization of the software supply chain, such as Figure 3 As shown, we can observe the software supply chain with boto31.34.101 as the root node.

[0060] The invention discloses a software supply chain construction and visualization system, which is used to implement the above method. The invention discloses a software supply chain construction and visualization system, which includes a dependency parsing module, a software supply chain construction module, and a software supply chain visualization module.

[0061] The dependency parsing module is used to perform dependency parsing according to the software package name and version, and parse out all the software packages that the software package needs to depend on and the dependency relationships between them; this will serve as the input of the software supply chain building module;

[0062] The software supply chain construction module is used to construct a mathematical expression of the software supply chain based on the software packages parsed by the dependency parsing module and the dependency relationships between them; this will serve as the input of the software supply chain visualization module;

[0063] The software supply chain visualization module is used to display a visualized software supply chain on the front end according to the software supply chain data output by the software supply chain construction module;

[0064] To further illustrate the practicability of the present invention in the application field, Figure 3 The following is illustrated using the following visualization.

[0065] Figure 3 In the dialog box, the blue area is the user selection area where you can select the version number of the software package.

[0066] The right side below is the display area of ​​the software supply chain diagram, with the root node in orange and the rest as dependencies. We can clearly visualize the structure of the software supply chain of the boto3 package 1.34.101 version and the dependencies between each package in the supply chain.

[0067] On the left side below is the information display area. We can click on any node to get some basic information of the node from this area, including the name of the software package, homepage address, description, license, number of forks, and number of stars.

[0068] The results show that the present invention realizes the construction and visualization of the software supply chain without actually installing the software package.

Claims

1. A method for constructing and visualizing a software supply chain, characterized in that: The following steps are included: Step 1: Build the root node of the software supply chain; Step 1.1: Get the software package name using the input method; Step 1.2: Calling the application programming interface to obtain the real-time updated version information of the software package, and obtaining the software package version number in an optional manner; Step 1.3: Use the software package name and version number to build the root node of the software supply chain; Step 2: Construct the node dependency parsing process of the software supply chain; Step 2.1: Call the dependency list to obtain the directly dependent child node; further obtain the package name and package version range of the directly dependent child node; Step 2.2: Use the breadth-first traversal method to traverse the directly dependent child nodes to obtain the indirectly dependent child nodes; Step 3: The root node of the software supply chain described in step 1 is subjected to dependency resolution using the software supply chain node dependency resolution processing process described in step 2 to obtain the software package set and the dependency relationship between the software packages; Step 4: Generate a software supply chain directed graph by using the software package set and the dependency relationships between software packages in the manner shown in formula (1); G=<V,E> (1) Among them, G represents the software supply chain, V represents the set of Python software packages, and E represents the set of dependencies between software packages; Step 5: Use the software supply chain directed graph to visualize the software supply chain using the node link drawing method of the directed graph.

2. A software supply chain construction and visualization system implementing the method of claim 1, characterized in that: It includes dependency parsing module, software supply chain building module, and software supply chain visualization module; The dependency parsing module is used to perform dependency parsing according to the software package name and version, and parse out all the software packages that the software package needs to depend on and the dependency relationships between them; Will serve as input to software supply chain building blocks; The software supply chain construction module is used to construct a mathematical expression of the software supply chain based on the software packages parsed by the dependency parsing module and the dependency relationships between them; this will serve as the input of the software supply chain visualization module; The software supply chain visualization module is used to display a visualized software supply chain on the front end according to the software supply chain data output by the software supply chain construction module.

Images