Verification method and device for software integration correctness and electronic equipment

Abstract

The invention relates to the technical field of software verification, and discloses a verification method and device for software integration correctness and electronic equipment. The verification method comprises the steps of generating a unique identifier under the condition of monitoring that a Tag event is released in a source code warehouse, and recording the unique identifier to a metadatabase; analyzing a configuration file which needs to be integrated into the software product package in the source code warehouse, and writing a unique identifier in an additional annotation line at the tail of the configuration file; constructing the configuration file with the unique identifier into a software product package, extracting the unique identifier in the configuration file and the identifier recorded in the metadatabase for verification in the stage of constructing the software product package, and confirming the verification result of the correctness of the configuration file version needing to be integrated in the software product package; and performing graded alarm according to a verification result. According to the application, the configuration file in the software product package can be ensured to be consistent with the version of the source code warehouse in the assembly line integration process, so that an error code is prevented from being pushed to a user vehicle.

Description

Technical Field

[0001] The present application relates to the field of software verification technology, for example, to a method and device for verifying the correctness of software integration, and an electronic device. Background Art

[0002] During software development and integration, the correct integration of configuration files within the software product package is crucial. Configuration files contain key information such as various parameters and dependencies required for software operation. Errors in these configuration files during integration can lead to software failures, malfunctions, or even crashes of the intelligent driving system.

[0003] In the related art, after a software product package is generated, the integrity of the software product package is usually verified by performing MD5 verification.

[0004] During the implementation of the embodiments of the present disclosure, it was found that at least the following problems exist in the related art:

[0005] In related technologies, version mismatches cannot be detected. If the integrated configuration file version is tampered with or replaced during the software package construction phase, a problematic software package will be generated, which will result in the incorrect software package being pushed to the user's vehicle.

[0006] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to ordinary technicians in this field. Summary of the Invention

[0007] One of the purposes of the present invention is to provide a method for verifying the correctness of software integration, so as to solve the problem in the prior art that, during the stage of building a software product package, if the integrated configuration file version is tampered with or replaced, a problematic software product package will be generated, resulting in the wrong software product package being pushed to the user's vehicle; the second purpose is to provide a device for verifying the correctness of software integration; and the third purpose is to provide an electronic device.

[0008] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0009] In some embodiments, a method for verifying the correctness of software integration includes: generating a unique identifier and recording the unique identifier in a metadata database when monitoring a tag event released in a source code repository; parsing a configuration file in the source code repository that needs to be integrated into a software product package, and appending a comment line at the end of the configuration file to write the unique identifier; constructing the configuration file after writing the unique identifier into a software product package, and in the stage of constructing the software product package, extracting the unique identifier in the configuration file and the identifier recorded in the metadata database for verification, and confirming the verification result of the correctness of the configuration file version to be integrated in the software product package; and issuing graded alarms based on the verification results.

[0010] In this embodiment, a unique identifier is generated when a Tag event is monitored in a source code repository, and a unique tag can be provided for each software version, which helps to track the corresponding software version during the pipeline integration process. After the unique identifier is generated, the unique identifier is written to the end of the configuration file that needs to be integrated into the software product package, and the unique identifier is recorded in the metadata database. During the construction phase of constructing the configuration file after writing the unique identifier into the software product package, the unique identifier and the identifier recorded in the metadata database can be compared and verified to determine whether the configuration file has been tampered with or replaced during the integration process. After the verification is completed, a hierarchical alarm mechanism is used to trigger an alarm when the configuration file versions are inconsistent, which can prevent the release of the wrong version of the software product package.

[0011] Optionally, generating a unique identifier includes: using a combined algorithm to integrate a timestamp, a Git short hash, and a random salt value to generate a unique identifier; using an encryption algorithm to perform tamper-proof processing on the unique identifier, and adding a timestamp fingerprint.

[0012] In this embodiment, a unique identifier is generated by combining a timestamp, a Git short hash, and a random salt value using a combination algorithm. After the unique identifier is generated, an encryption algorithm is used to protect it from tampering and a timestamp fingerprint is added. This ensures that the unique identifier is highly unique and difficult to crack, while also reducing the risk of tampering when using it to identify configuration file versions.

[0013] Optionally, a comment line is appended at the end of the configuration file to write the unique identifier, including: writing the unique identifier into the comment line appended at the end of the configuration file through a flock file lock; after the writing is completed, forcibly including the configuration file in version control.

[0014] In this embodiment, the unique identifier is written into the comment line of the configuration file using flock file locks. After writing, the configuration file is also forcibly placed under version control. This effectively protects the data integrity of the configuration file in a concurrent environment and ensures the traceability of configuration file version changes.

[0015] Optionally, during the stage of building the software product package, the unique identifier in the configuration file and the identifier recorded in the metadata database are extracted for verification to confirm the verification result of the correctness of the configuration file version to be integrated in the software product package, including: building an isolated verification environment; in the isolated verification environment, performing forward verification and reverse verification on the configuration file based on the unique identifier and the identifier recorded in the metadata database, and performing signature verification; if the forward verification, reverse verification and signature verification are all passed, it is determined that the configuration file version to be integrated in the software product package is correct.

[0016] In this embodiment, by building an isolated verification environment, extracting identifiers in the isolated verification environment to perform forward verification and reverse verification, and performing signature verification, the security and reliability of the configuration file version verification are ensured.

[0017] Optionally, building an isolated verification environment includes: building a read-only file system; fixing a tool chain version and pre-installing a verification tool set in the read-only file system.

[0018] In this embodiment, by constructing a read-only file system and pre-installing a verification tool set in the read-only file system, a verification tool can be provided for the verification process. By fixing the tool chain version in the read-only file system, the consistency of the tool version used in the verification process can be ensured.

[0019] Optionally, graded alarms are issued based on the verification results, including: when the forward verification, reverse verification and signature verification are all passed, no alarm is issued; when the forward verification is passed but there is a minor warning, and the reverse verification and signature verification are both passed, the first preset method is used for alarm notification; when the forward verification is passed but there is a minor warning, the reverse verification fails, and the signature verification is passed, the first preset method and the second preset method are used for alarm notification; when both the forward verification and the reverse verification fail, or the signature verification fails, the first preset method and the second preset method are used for alarm notification, and the release of this software product package is terminated.

[0020] This embodiment uses different alert notification strategies for different verification results. This way, if a serious problem is detected, the software package build process can be promptly blocked and an emergency response can be triggered, quickly isolating the risk and ensuring timely and secure responses to problems during software package build and release.

[0021] Optionally, before generating a unique identifier, the verification method also includes: using a hook program to perform preliminary verification of the directory structure and file format legitimacy of the configuration file, and detecting uncommitted local modifications; if the preliminary verification passes and there are no uncommitted local modifications, a unique identifier is generated.

[0022] In this embodiment, before generating a unique identifier, a hook program is first used to perform a preliminary verification of the directory structure and file format of the configuration file, and to detect uncommitted local modifications. Only when the preliminary verification passes and there are no uncommitted local modifications will the unique identifier be generated. This improves the success rate of generating a unique identifier and ensures that the generated unique identifier is consistent with expectations.

[0023] In some embodiments, a device for verifying the correctness of software integration includes: a generation module, configured to generate a unique identifier and record the unique identifier in a metadata database when monitoring a tag event released in a source code repository; a writing module, configured to parse a configuration file in the source code repository that needs to be integrated into a software product package, and append a comment line at the end of the configuration file to write the unique identifier; a verification module, configured to construct the configuration file after the unique identifier is written into a software product package, and in the stage of constructing the software product package, extract the unique identifier in the configuration file and the identifier recorded in the metadata database for verification to confirm the verification result of the correctness of the configuration file version to be integrated in the software product package; and an alarm module, configured to issue graded alarms based on the verification results.

[0024] In some embodiments, a device for verifying software integration correctness includes a processor and a memory storing program instructions, and the processor is configured to execute the above-mentioned method for verifying software integration correctness when running the program instructions.

[0025] In some embodiments, an electronic device includes: a device body; and the verification device for software integration correctness as described above, which is installed in the device body.

[0026] Beneficial effects of the present invention:

[0027] (1) The present invention generates a unique identifier upon detecting a tag release event in a source code repository, writes the unique identifier to the end of a configuration file to be integrated into a software product package, and records the unique identifier in a metadata repository. During the software product package construction phase, the unique identifier can be compared with the identifier recorded in the metadata repository to determine whether the configuration file has been tampered with or replaced during the integration process.

[0028] (2) After verification is complete, the present invention adopts different alarm notification strategies for different verification results. In this way, when a serious problem is detected, the software product package construction process can be promptly blocked and an emergency response can be triggered, quickly isolating the risk and ensuring the timeliness and security of the response to problems during the construction and release of the software product package. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] One or more embodiments are exemplarily described by corresponding drawings. These exemplary descriptions and drawings do not limit the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements. The drawings do not constitute a scale limitation. In addition,

[0030] Figure 1 is a schematic diagram of a method for verifying the correctness of software integration provided by an embodiment of the present disclosure;

[0031] Figure 2 is a schematic diagram of another method for verifying the correctness of software integration provided by an embodiment of the present disclosure;

[0032] Figure 3 is a schematic diagram of another method for verifying the correctness of software integration provided by an embodiment of the present disclosure;

[0033] Figure 4 is a schematic diagram of another method for verifying the correctness of software integration provided by an embodiment of the present disclosure;

[0034] Figure 5 is a schematic diagram of a version control system execution verification method provided by an embodiment of the present disclosure;

[0035] Figure 6 is a schematic diagram of a device for verifying the correctness of software integration provided by an embodiment of the present disclosure;

[0036] Figure 7 It is a schematic diagram of an electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0037] The following describes the embodiments of the present invention with reference to the accompanying drawings and preferred embodiments. Those skilled in the art will readily appreciate the other advantages and benefits of the present invention from the disclosure herein. The present invention may also be implemented or applied through various other specific embodiments, and the various details in this specification may be modified or altered based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are intended only to illustrate the present invention and are not intended to limit the scope of protection of the present invention.

[0038] It should be noted that the illustrations provided in the following embodiments are merely schematic illustrations of the basic concept of the present invention. Therefore, the illustrations only show components related to the present invention and are not drawn according to the number, shape, and size of components in actual implementation. In actual implementation, the type, quantity, and proportion of each component may be changed arbitrarily, and the component layout may also be more complex.

[0039] Combine Figure 1 As shown, an embodiment of the present disclosure provides a method for verifying the correctness of software integration. The execution subject of the verification method may be a processor. The verification method includes:

[0040] S101: When a Tag event is released in a source code repository, the processor generates a unique identifier and records the unique identifier in a metadata database.

[0041] Specifically, a source code repository is a database used to store and manage project source code, such as a Git database.

[0042] Specifically, a tag is used to mark a specific version of code in a source code repository. For example, it can mark the configuration file of a vehicle software version to be released.

[0043] Specifically, a unique identifier is a code that uniquely identifies each configuration file version during software integration. It is generated by an algorithm and has extremely high uniqueness.

[0044] Specifically, if a Tag Release event is detected in the source code repository, it indicates that the developer has officially released the tag in the code repository. In this case, it can be determined that the developer has completed the development of a software product package and wants to release it. By generating a unique identifier, the configuration file to be integrated into the software product package can be versioned. Therefore, when a Tag Release event is detected in the source code repository, a unique identifier needs to be generated.

[0045] Specifically, after generating a unique identifier, the unique identifier and other relevant information generated during each software integration process are recorded in the metadata database. This facilitates subsequent query and verification. For example, during a subsequent verification process, the previously generated unique identifier can be retrieved from the metadata database and compared with the unique identifier extracted from the configuration file to be integrated into the software product package to confirm whether the configuration file version is correct.

[0046] Optionally, when a Tag event is detected in the source code repository, a pipeline is used to automatically trigger the generation of a unique identifier and subsequent processes.

[0047] S102: The processor parses the configuration file to be integrated into the software product package in the source code repository, and adds a comment line to the end of the configuration file to write a unique identifier.

[0048] Specifically, during software development, configuration files are used to define various software parameters and settings, such as database connection information, server addresses, and feature switches. When developing a software product package, developers select or mark the required configuration files in the source code repository. Therefore, through parsing, it is possible to determine the configuration files in the source code repository that need to be integrated into the software product package.

[0049] Specifically, a comment line is a line in the configuration file that contains explanatory text. The content in the comment line is not executed. Therefore, a comment line can be added to the end of the configuration file to write a unique identifier. This unique identifier is associated with the configuration file to be integrated into the software product package. In the subsequent verification process, the unique identifier in the configuration file can be read to confirm whether the configuration file belongs to the currently ongoing software integration process.

[0050] S103, the processor constructs the configuration file after writing the unique identifier into a software product package, and in the stage of constructing the software product package, extracts the unique identifier in the configuration file and the identifier recorded in the metadata database for verification, and confirms the verification result of the correctness of the configuration file version to be integrated in the software product package.

[0051] Specifically, a software product package is a package of source code, configuration files, resource files, etc. into a deployable unit, usually in a specific format, such as WAR, JAR, Docker image, etc.

[0052] Specifically, during the process of building the software product package, the unique identifier written in the comment line of the configuration file is extracted from the file, and the corresponding identifier previously recorded is obtained from the metadata database for comparison and verification. This can confirm whether the version of the configuration file to be integrated into the software product package is correct. If the two identifiers match, it means that the configuration file is the version correctly processed during the current integration process; if they do not match, it indicates that there is an error in the configuration file version or that a problem occurred during the integration process. Therefore, the verification result of the correctness of the configuration file version to be integrated into the software product package can be confirmed.

[0053] S104: The processor issues graded alarms based on the verification results.

[0054] Specifically, graded alarms classify alarm information into different levels according to the severity of the verification results, such as level 1, level 2, and level 3, and notify developers accordingly, such as through email, text messages, instant messaging tools, etc.

[0055] In the embodiment of the present disclosure, a unique identifier is generated when a Tag event is monitored in the source code repository, and a unique tag can be provided for each software version, which helps to track the corresponding software version during the pipeline integration process. After the unique identifier is generated, the unique identifier is written to the end of the configuration file that needs to be integrated into the software product package, and the unique identifier is recorded in the metadata database. In the construction phase of constructing the configuration file after writing the unique identifier into the software product package, it can be determined whether the configuration file has been tampered with or replaced during the integration process by verifying the unique identifier and the identifier recorded in the metadata database. After the verification is completed, a hierarchical alarm mechanism is used to trigger an alarm when the configuration file version is inconsistent, which can prevent the release of the wrong version of the software product package. Therefore, the embodiment of the present disclosure can ensure that the configuration file in the software product package is consistent with the version of the source code repository during the pipeline integration process, thereby avoiding pushing the wrong code to the user's vehicle.

[0056] In some embodiments, generating a unique identifier includes: using a combined algorithm to integrate a timestamp, a Git short hash, and a random salt value to generate a unique identifier; using an encryption algorithm to perform tamper-proof processing on the unique identifier, and adding a timestamp fingerprint.

[0057] Combine Figure 2 As shown, the embodiment of the present disclosure provides another method for verifying the correctness of software integration, including:

[0058] S201: When a Tag event is detected in a source code repository, the processor uses a combination algorithm to integrate a timestamp, a Git short hash, and a random salt value to generate a unique identifier.

[0059] Specifically, the timestamp represents the precise time when the tag event was triggered, with millisecond accuracy. When generating a unique identifier, integrating the timestamp ensures its uniqueness across time. By integrating Git short hashes, for example, the first 8 digits of the hash of the current Git commit, the unique identifier can be associated with the code version. By integrating a random salt value, for example, a randomly generated 16-bit string, the risk of hash collisions and prediction attacks in the generated unique identifier can be reduced.

[0060] Optionally, the combined algorithm is an irreversible algorithm for concatenating the timestamp, the Git short hash, and the random salt value and then encrypting the concatenated value, for example, the SHA-256 algorithm.

[0061] S202: The processor uses an encryption algorithm to perform tamper-proof processing on the unique identifier, adds a timestamp fingerprint, and records the unique identifier in a metadata database.

[0062] Specifically, an encryption algorithm may be used, for example, an HMAC-SHA256 algorithm may be used to sign the unique identifier and generate a digital fingerprint to perform tamper-proof processing on the unique identifier.

[0063] Specifically, after the unique identifier is tamper-proofed, a timestamp fingerprint can be added to form a tuple of signature value + timestamp fingerprint on the unique identifier, thereby achieving strong protection for the unique identifier.

[0064] S203: The processor parses the configuration file to be integrated into the software product package in the source code repository, and adds a comment line to the end of the configuration file to write a unique identifier.

[0065] S204, the processor constructs the configuration file after writing the unique identifier into a software product package, and in the stage of constructing the software product package, extracts the unique identifier in the configuration file and the identifier recorded in the metadata database for verification, and confirms the verification result of the correctness of the configuration file version to be integrated in the software product package.

[0066] S205: The processor issues a graded alarm based on the verification result.

[0067] In the disclosed embodiment, a unique identifier is generated by combining a timestamp, a Git short hash, and a random salt value using a combination algorithm. After the unique identifier is generated, an encryption algorithm is used to protect it from tampering and a timestamp fingerprint is added. This ensures that the unique identifier is highly unique and difficult to crack, while also reducing the risk of tampering when using it to identify configuration file versions.

[0068] In some embodiments, appending a comment line at the end of the configuration file to write the unique identifier includes: writing the unique identifier into the comment line appended at the end of the configuration file through a flock file lock; after writing is completed, forcibly including the configuration file in version control.

[0069] Combine Figure 3 As shown, the embodiment of the present disclosure provides another method for verifying the correctness of software integration, which includes:

[0070] S301: When a Tag event is released in a source code repository, the processor generates a unique identifier and records the unique identifier in a metadata database.

[0071] S302: The processor parses the configuration file to be integrated into the software product package in the source code repository, writes the unique identifier into the comment line appended to the end of the configuration file through the flock file lock, and after writing is completed, forces the configuration file to be included in the version control.

[0072] Specifically, flock file lock is a file locking tool that writes a unique identifier into a comment line appended to the end of a configuration file through flock file lock, thereby preventing concurrent write conflicts that occur when the unique identifier is written into the comment line.

[0073] Specifically, after writing the unique identifier into the comment line, the traceability of the configuration file changes can be ensured by forcibly putting the configuration file into version control.

[0074] S303, the processor constructs the configuration file after writing the unique identifier into a software product package, and in the stage of constructing the software product package, extracts the unique identifier in the configuration file and the identifier recorded in the metadata database for verification, and confirms the verification result of the correctness of the configuration file version to be integrated in the software product package.

[0075] S304: The processor issues a graded alarm based on the verification result.

[0076] In the disclosed embodiment, the unique identifier is written into the comment line of the configuration file using a flock file lock. After writing, the configuration file is also forcibly placed under version control. This effectively safeguards the data integrity of the configuration file in a concurrent environment and ensures traceability of configuration file version changes.

[0077] In some embodiments, during the stage of building a software product package, the unique identifier in the configuration file and the identifier recorded in the metadata database are extracted for verification to confirm the verification result of the correctness of the configuration file version to be integrated in the software product package, including: building an isolated verification environment; in the isolated verification environment, performing forward verification and reverse verification on the configuration file based on the unique identifier and the identifier recorded in the metadata database, and performing signature verification; if the forward verification, reverse verification and signature verification are all passed, it is determined that the configuration file version to be integrated in the software product package is correct.

[0078] Specifically, when building a software product package, by constructing an isolated verification environment, subsequent verification processes can be performed in this isolated verification environment. This prevents malicious code or unauthorized access from tampering with configuration files, and prevents other processes from interfering with the verification process, thereby improving the security and reliability of subsequent verification processes.

[0079] Optionally, building an isolated verification environment includes: building a read-only file system; fixing a tool chain version and pre-installing a verification tool set in the read-only file system.

[0080] Specifically, by building a read-only file system, the read-only feature can be used to isolate external interference, prevent the isolated verification environment from being maliciously modified, and ensure the reliability of the verification process.

[0081] Specifically, by pre-installing the verification tool set in the read-only file system, verification tools can be provided for the verification process. By fixing the tool chain version in the read-only file system, the consistency of the tool version used in the verification process can be ensured.

[0082] Optionally, a read-only file system can be constructed using containerization technology or virtual machine technology.

[0083] Specifically, forward verification verifies that the unique identifier in the configuration file is consistent with the unique identifier recorded in the metadata repository. Reverse verification verifies that the unique identifier recorded in the metadata repository corresponds to the currently integrated configuration file. Signature verification uses digital signature technology to verify the configuration file, ensuring its integrity and source authenticity.

[0084] Specifically, if the configuration file passes forward verification, reverse verification, and signature verification, it indicates that the correspondence between the configuration file version and the integration event is bidirectionally correct and the configuration file is complete and authentic. Therefore, in this case, it can be determined that the configuration file version to be integrated into the software product package is correct.

[0085] In this embodiment, by building an isolated verification environment, extracting identifiers in the isolated verification environment to perform forward verification and reverse verification, and performing signature verification, the security and reliability of the configuration file version verification are ensured.

[0086] In some embodiments, graded alarms are issued based on the verification results, including: when the forward verification, reverse verification and signature verification are all passed, no alarm is issued; when the forward verification is passed but there is a minor warning, and the reverse verification and signature verification are both passed, the first preset method is used for alarm notification; when the forward verification is passed but there is a minor warning, the reverse verification fails, and the signature verification is passed, the first preset method and the second preset method are used for alarm notification; when both the forward verification and the reverse verification fail, or the signature verification fails, the first preset method and the second preset method are used for alarm notification, and the release of this software product package is terminated.

[0087] Specifically, if the configuration file to be integrated into the software product package passes forward verification, reverse verification, and signature verification, it indicates that the version of the configuration file to be integrated into the software product package is completely correct. Therefore, in this case, no alarm is required.

[0088] Specifically, if the configuration file to be integrated into the software product package passes forward verification but has minor warnings, and passes reverse verification and signature verification, this indicates that although the configuration file passes forward verification, reverse verification, and signature verification, there are some non-critical issues in the configuration file that do not affect the core functions of the software product package (for example, inconsistent file permissions, minor errors in the configuration file format, etc.). Therefore, in this case, only the first preset method is used to issue an alarm notification, prompting the user to manually review it later.

[0089] Optionally, the first preset method is notification via communication software, for example, notification via a WeChat Work robot.

[0090] Specifically, if the configuration file to be integrated into the software product package passes forward verification but has minor warnings, fails reverse verification, and passes signature verification, this indicates that the unique identifier recorded in the metadata database does not correspond to the currently integrated configuration file, and there are some non-critical issues that do not affect the core functionality of the software product package. In this case, although continuing to integrate the software product package can achieve the core functionality of the software product package, there will be some failure issues. Therefore, it is necessary to use both the first preset method and the second preset method to provide alarm notifications.

[0091] Optionally, the second preset method is telephone notification.

[0092] Specifically, if the configuration file that the software product package needs to integrate fails both the forward and reverse checks, or the signature verification fails, it indicates that the unique identifier in the configuration file is inconsistent with the unique identifier recorded in the metadata database, and the unique identifier recorded in the metadata database is also inconsistent with the currently integrated configuration file, or the configuration file is incomplete. In this case, the integrated software product package cannot achieve the functions required by the developer. Therefore, after using the first preset method and the second preset method for alarm notification, it is also necessary to terminate the release of this software product package.

[0093] Optionally, the content of the alarm notification includes the identification code, version number, error level, time and blocking measures of the configuration file.

[0094] Optionally, for recoverable errors during verification (for example, repository synchronization delays caused by network problems, where the repository is a database used to synchronize configuration files when building software product packages), the build cache will be cleared, the repository will be resynchronized, and an incremental build will be triggered (only the content related to the exception will be rebuilt).

[0095] In this embodiment, different alert notification strategies are adopted for different verification results. In this way, when a serious problem is detected, the software product package construction process can be promptly blocked and an emergency response can be triggered, quickly isolating the risk and ensuring the timeliness and security of the response to problems during software product package construction and release.

[0096] In some embodiments, before generating a unique identifier, the verification method also includes: using a hook program to perform a preliminary verification of the directory structure and file format legitimacy of the configuration file, and detecting uncommitted local modifications; if the preliminary verification passes and there are no uncommitted local modifications, a unique identifier is generated.

[0097] Combine Figure 4 As shown, the embodiment of the present disclosure provides another method for verifying the correctness of software integration, which includes:

[0098] S401: When the processor monitors the release of a Tag event in the source code repository, it uses a hook program to perform a preliminary verification of the directory structure and file format validity of the configuration file and detects uncommitted local modifications.

[0099] Optionally, the hook procedure is a pre-tag hook.

[0100] S402: If the preliminary verification passes and there is no uncommitted local modification, the processor generates a unique identifier and records the unique identifier in the metadata database.

[0101] Specifically, the hook program checks whether the directory structure of the configuration file meets expectations, for example, whether the file path and hierarchical relationship are as expected. It also checks whether the file format is legal, for example, whether the file format is parsable. This can avoid the problem of the three elements of the integrated unique identifier being unable to be calculated due to incorrect configuration file format or inconsistent directory structure during the subsequent generation of the unique identifier, thus causing the unique identifier to fail to generate.

[0102] Specifically, by checking whether there are any uncommitted local modifications through a hook program, it is possible to prevent the problem that the subsequently generated unique identifier does not match expectations due to the uncommitted modifications.

[0103] S403: The processor parses the configuration file to be integrated into the software product package in the source code repository, and adds a comment line to the end of the configuration file to write a unique identifier.

[0104] S404, the processor constructs the configuration file after writing the unique identifier into a software product package, and in the stage of constructing the software product package, extracts the unique identifier in the configuration file and the identifier recorded in the metadata database for verification, and confirms the verification result of the correctness of the configuration file version to be integrated in the software product package.

[0105] S405: The processor issues a graded alarm based on the verification result.

[0106] In the disclosed embodiment, before generating a unique identifier, a hook program is used to perform a preliminary check on the directory structure and file format of the configuration file, and to detect uncommitted local modifications. A unique identifier is generated only if the preliminary check passes and there are no uncommitted local modifications. This improves the success rate of generating a unique identifier and ensures that the generated unique identifier is consistent with expectations.

[0107] In some embodiments, the above-mentioned verification method for software integration correctness can be performed as follows: Figure 5 The version control system shown in the figure is implemented. The version control system includes an identity injection engine, a dynamic verifier, and a notification gateway.

[0108] Specifically, the tag events in the source code repository are monitored by the identifier injection engine. When a tag release event is detected, the identifier injection process is automatically triggered through the pipeline, all configuration files in the source code repository that need to be integrated into the software product package are parsed, and a comment line is appended to the end of the configuration file to write the generated unique identifier.

[0109] Specifically, during the software package construction phase, a dynamic verifier parses the configuration file to be integrated into the package, extracts the unique identifier from the configuration file, and compares it with the unique identifier recorded in the metadata database to confirm the correctness of the configuration file version to be integrated into the software package. The verification result is then input into the notification gateway.

[0110] Specifically, the pipeline management and control API interface is called by the notification gateway to receive the verification results and issue graded alarms based on the verification results.

[0111] Combine Figure 6As shown, an embodiment of the present disclosure provides a verification device 600 for the correctness of software integration, comprising: a generation module 601, a writing module 602, a verification module 603 and an alarm module 604. The generation module 601 is configured to generate a unique identifier when a Tag event is monitored in a source code repository, and record the unique identifier in a metadata database. The writing module 602 is configured to parse the configuration file in the source code repository that needs to be integrated into the software product package, and append a comment line at the end of the configuration file to write the unique identifier. The verification module 603 is configured to construct the configuration file after the unique identifier is written into the software product package, and in the stage of constructing the software product package, extract the unique identifier in the configuration file and the identifier recorded in the metadata database for verification, and confirm the verification result of the correctness of the configuration file version to be integrated in the software product package. The alarm module 604 is configured to issue graded alarms based on the verification results.

[0112] Combine Figure 7 As shown, an embodiment of the present disclosure provides an electronic device 700, including: a processor (processor) 701 and a memory (memory) 702. Optionally, the device may also include a communication interface (Communication Interface) 703 and a bus 704. The processor 701, the communication interface 703, and the memory 702 can communicate with each other through the bus 704. The communication interface 703 can be used for information transmission. The processor 701 can call the logic instructions in the memory 702 to execute the verification method for software integration correctness of the above embodiment.

[0113] In addition, the logic instructions in the memory 702 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.

[0114] Memory 702, as a computer-readable storage medium, can be used to store software programs and computer-executable programs, such as program instructions / modules corresponding to the methods in the embodiments of the present disclosure. Processor 701 executes the program instructions / modules stored in memory 702 to perform functional applications and data processing, thereby implementing the software integration correctness verification method in the above-mentioned embodiments.

[0115] The memory 702 may include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function; the data storage area may store data generated based on the use of the terminal device. Furthermore, the memory 702 may include high-speed random access memory and non-volatile memory.

[0116] An embodiment of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured to execute the above-mentioned method for verifying the correctness of software integration.

[0117] An embodiment of the present disclosure provides a computer program product, which includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes the above-mentioned verification method for software integration correctness.

[0118] The aforementioned computer-readable storage medium may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.

[0119] The above embodiments are only preferred embodiments for fully illustrating the present invention, and the protection scope of the present invention is not limited thereto. Any equivalent substitution or modification made by those skilled in the art based on the present invention is within the protection scope of the present invention.

Claims

1. A method for verifying the correctness of software integration, characterized in that: include: When a Tag event is detected in the source code repository, a unique identifier is generated and recorded in the metadata database. Parse the configuration file in the source code repository that needs to be integrated into the software product package, and append a comment line to the end of the configuration file to write a unique identifier; The configuration file after the unique identifier is written is constructed into a software product package. During the construction of the software product package, the unique identifier in the configuration file is extracted and verified with the identifier recorded in the metadata database to confirm the correctness of the configuration file version to be integrated into the software product package. Issue graded alarms based on the verification results.

2. The verification method according to claim 1, wherein: Generate a unique identifier, including: A combined algorithm is used to integrate timestamp, Git short hash and random salt value to generate a unique identifier; An encryption algorithm is used to prevent the unique identifier from being tampered with and a timestamp fingerprint is added.

3. The verification method according to claim 1, wherein: Append a comment line at the end of the configuration file to write a unique identifier, including: Use the flock file lock to write the unique identifier into the comment line appended to the end of the configuration file; Forces configuration files to be checked into version control after writing.

4. The verification method according to claim 1, wherein: During the software product package construction phase, the unique identifier in the configuration file is extracted and verified against the identifier recorded in the metadata database to confirm the correctness of the configuration file version to be integrated into the software product package. The verification results include: Build an isolated verification environment; In the isolated verification environment, the configuration file is forward- and reverse-checked based on the unique identifier and the identifier recorded in the metadata database, and the signature is verified. If the forward check, reverse check, and signature verification all pass, it is determined that the version of the configuration file to be integrated into the software product package is correct.

5. The verification method according to claim 4, wherein: Build an isolated verification environment, including: Build a read-only file system; Pin toolchain versions and pre-installed verification toolsets in a read-only file system.

6. The verification method according to claim 4, wherein: Based on the verification results, graded alarms are issued, including: If the forward check, reverse check, and signature verification all pass, no alarm will be issued; If the forward check passes but there is a minor warning, and the reverse check and signature verification both pass, the first preset method is used for alarm notification; If the forward verification passes but there is a minor warning, the reverse verification fails, and the signature verification passes, the first preset method and the second preset method are used for alarm notification; If both the forward check and the reverse check fail, or the signature verification fails, an alarm notification is issued using the first preset method and the second preset method, and the release of this software product package is terminated.

7. The verification method according to any one of claims 1 to 6, characterized in that: Before generating a unique identifier, the validation method also includes: Use hook programs to perform preliminary verification of the directory structure and file format validity of the configuration files, and detect uncommitted local modifications; If the preliminary verification passes and there are no uncommitted local modifications, a unique identifier is generated.

8. A device for verifying the correctness of software integration, characterized in that: include: The generation module is configured to generate a unique identifier when monitoring a Tag event released in the source code repository, and record the unique identifier in the metadata database; A writing module is configured to parse a configuration file to be integrated into a software product package in a source code repository, and append a comment line to the end of the configuration file to write a unique identifier; a verification module configured to construct a software product package from the configuration file after the unique identifier is written therein, and during the stage of constructing the software product package, extract the unique identifier in the configuration file and the identifier recorded in the metadata database for verification, thereby confirming the correctness of the configuration file version to be integrated into the software product package; The alarm module is configured to generate graded alarms based on the verification results.

9. An electronic device comprising a processor and a memory storing program instructions, characterized in that: The processor is configured to execute the method for verifying software integration correctness according to any one of claims 1 to 7 when running the program instructions.

10. A readable storage medium storing program instructions, characterized in that: When the program instructions are executed, the computer is configured to execute the method for verifying the correctness of software integration according to any one of claims 1 to 7.

Images