Dependent package privatization management method and computer readable storage medium

Abstract

The invention relates to the field of software development, in particular to a dependency package privatization management method and a computer readable storage medium. Specifically, the private management method for the dependent packet comprises the following steps: acquiring user login information; based on the user login information, user categories are identified, and the user categories comprise an operator, a maintainer and an administrator; if the user category is an operator, a Json file is generated according to the obtained write-in data and a preset template, after a downloading instruction is received, the Json file is sent to an extranet server, and a dependency package is downloaded from the extranet server based on the Json file; if the user category is a maintainer, performing security check on the downloaded dependent packet according to a received check instruction, and uploading the dependent packet passing the security check to an intranet server; and if the user category is an administrator, opening the authority of maintaining all the dependent packets in the intranet server. By adopting the management method, the safety and the convenience can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of software development, in particular to a dependency package privatization management method. BACKGROUND

[0002] Dependency package refers to a package that a software project needs to depend on to run normally or realize its functions. The dependency package can be a library, framework, module or any other form of software component. These packages are usually developed by third parties. How to manage dependency packages is an important problem that needs to be faced in the software development process. In the daily development process, it is usually necessary to download dependency packages from an external network server, which has low security and poor convenience for developers to download the required dependency packages one by one.

[0003] Therefore, there is an urgent need in the art for a dependency package management tool that can solve the above problems, and thus the present application is proposed.

[0004] CONTENT

[0005] The present application aims to provide a dependency package privatization management method, thereby solving at least one technical problem in the background art.

[0006] Specifically, the present application provides a dependency package privatization management method, comprising:

[0007] obtaining user login information;

[0008] identifying the user category based on the user login information, wherein the user category includes an operator, a maintainer and an administrator;

[0009] if the user category is the operator, generating a Json file according to the obtained write data and a preset template, sending the Json file to an external network server after receiving a download instruction, and downloading a dependency package from the external network server based on the Json file;

[0010] if the user category is the maintainer, performing a security check on the downloaded dependency package according to the received check instruction, and uploading the dependency package that passes the security check to an internal network server;

[0011] if the user category is the administrator, opening the permission to maintain all the dependency packages in the internal network server.

[0012] Preferably, the download instruction includes uploading a single Json file or uploading a batch of Json files.

[0013] Preferably, the uploading of a batch of Json files includes serial uploading of a batch of Json files or parallel uploading of a batch of Json files.

[0014] Preferably, the downloading of the dependent package from the external network server based on the Json file specifically comprises:

[0015] sending the Json file to the external network server;

[0016] the external network server reads the Json file, obtains the identification information of all dependent packages, forms a first set of the identification information of all dependent packages, queries dependent packages according to the first set, and generates a Json sub-file according to the identification information of each dependent package, and returns all queried dependent packages and the Json sub-file matched with each dependent package.

[0017] Preferably, all downloaded Json sub-files are traversed.

[0018] all Json sub-files are packaged and sent to the external network server;

[0019] the external network server reads all Json sub-files, obtains the identification information of all dependent packages, forms a second set of the identification information of all dependent packages, queries dependent packages according to the second set, and returns all queried dependent packages.

[0020] Preferably, the identification information comprises a package name and a version number.

[0021] Preferably, the dependent package comprises a development environment dependent package and a project running dependent package.

[0022] Preferably, the security check on the dependent package specifically comprises:

[0023] reading the storage path of the downloaded dependent package, performing a security scan on the dependent package, and prompting on a page if the dependent package contains a vulnerability.

[0024] Preferably, the vulnerability is repaired, and the security scan on the dependent package is performed again.

[0025] The application further provides a computer readable storage medium comprising a computer program, which, when executed on a computer, causes the computer to perform the above method.

[0026] The dependent package privatization management method provided by the application can isolate the management of the dependent package downloaded on the external network server, improve the security, and does not require the developer to download the required dependent package one by one, and has high convenience. BRIEF DESCRIPTION OF DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the present application, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description only some of the embodiments of the present application, and for those skilled in the art, other embodiments can also be obtained from these drawings without creative labor.

[0028] Figure 1 The running steps of the dependency package privatization management method provided in the present application are provided. DETAILED DESCRIPTION

[0029] The present application can describe one or more different disclosures. In addition, for one or more of the present application, it should be understood that these are presented only for illustrative purposes and do not limit the disclosure contained in the present application or the claims presented in any way, and it should be understood that other embodiments can be utilized without departing from the scope of the specific disclosure, and structural, logical, software, electrical and other changes can be made.

[0030] The description of the embodiments with several components associated with each other does not imply that all these components are required, on the contrary, various optional components can be described to show various possible embodiments of one or more of the present application. Similarly, although the process steps, method steps and algorithms, etc. can be described in sequence, such processes, methods and algorithms, etc. can usually be set to other alternative order operations, in other words, any order or order of the steps described in the present application does not indicate that the steps must be executed through this order. In addition, although described or implied as non-simultaneous (for example, one step is described after another step), some steps can be executed simultaneously. In addition, some steps shown in the method can be omitted. The process described with reference to the drawings does not imply that the process shown does not include other variations and modifications. Although each embodiment generally describes a step, this does not mean that they must occur once, some steps can be omitted in some embodiments, or some steps can be executed multiple times.

[0031] For clarity, the technology and mechanisms described or cited in the present application will sometimes be described in singular form. However, it should be understood that unless otherwise specified, a particular implementation can include multiple iterations of the technology or multiple instantiations of the mechanism. The description of the process or the block shown in the drawing should be understood as representing a module, segment or portion of code including one or more executable instructions for implementing a specific logical function or step in the process. Alternative implementations will be included within the scope of the embodiments of the present application, for example, the functions can be executed from the order shown, also including substantially simultaneously or in reverse order, depending on the functions involved, as understood by those skilled in the art.

[0032] Exemplary embodiments will be described in detail with reference to the drawings, wherein like reference numerals refer to like elements throughout. The following detailed description is presented in terms of exemplary embodiments, which are not intended to represent all or the only embodiments in which the application is conceived. They are merely examples of methods consistent with some aspects of the application as detailed in the claims.

[0033] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0034] In order to better understand the above technical solutions, the above technical solutions will be described in detail below in combination with the drawings and specific embodiments of the specification.

[0035] Figure 1 The running steps of the dependency package privatization management method provided in the application are provided.

[0036] The local server acquires user login information input by a user, wherein the user login information includes a username and a password, etc. Based on the user login information, a user category is identified, wherein the user category includes an operator, a maintainer, and an administrator.

[0037] If the user category is an operator, a Json file is generated according to the acquired write data and a preset template, wherein the Json file contains identification information such as a package name and a version number of a plurality of dependency packages required by a developer, and wherein the dependency packages include development environment dependency packages and project running dependency packages.

[0038] When the operator inputs a download instruction, wherein the download instruction includes uploading a single Json file or uploading a batch of Json files, in addition, the local server can upload a plurality of Json files in a serial manner or upload a plurality of Json files in a parallel manner.

[0039] The local server sends a Json file to an external network server, wherein the external network server includes an NPM (Node Package Manager) mirror, a Taobao mirror, a Huawei cloud mirror, a Tencent cloud mirror, etc. The external network server reads the Json file, obtains the identification information of all dependent packages, and forms a first set of the identification information of all dependent packages, wherein the set includes Array, List, or Map and other data storage methods. The external network server queries the dependent packages matching the identification information stored in the database according to the first set, and generates a Json sub-file based on the identification information of each dependent package in the database, and returns all matched dependent packages and the Json sub-file matched with each dependent package.

[0040] The internal network server traverses all downloaded Json sub-files and sends all Json sub-files to the external network server. The external network server reads all Json sub-files, obtains the identification information of all dependent packages, forms a second set of the identification information of all dependent packages, queries the dependent packages matching the identification information stored in the database according to the second set, and returns all queried dependent packages.

[0041] If the user category is a maintenance staff, the local server can perform security checks on the downloaded dependent packages according to the check instructions input by the maintenance staff. Specifically, the local server reads the storage path of the downloaded dependent package, performs a security scan on the dependent package, and if the dependent package contains a vulnerability, prompts on the page. In addition, the vulnerability can be repaired and the dependent package can be scanned again. The tool for performing security scanning can be a third-party tool, such as a Qianxin tool.

[0042] If the user category is an administrator, the permission to open all dependent packages in the internal network server is opened. When the above permission is opened, the administrator can group in the local server according to the release time, download time, size, type, etc. of the dependent package, which is convenient for management. In addition, the administrator can specify the range of dependent packages downloaded to the local server for different operators and maintenance staffs to view.

[0043] It should be noted that the technical features in the above embodiments can be freely combined by those skilled in the art, and the technical solutions formed also belong to the embodiments disclosed in the present application.

[0044] Further, without departing from the principles of the present application, the present application can be improved and modified in several ways, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A method for managing the privatization of dependency packages, characterized in that, include: Obtain user login information; Based on the user login information, user categories are identified, including operators, maintainers, and administrators; If the user category is the operator, a JSON file is generated based on the obtained write data and the preset template. After receiving the download instruction, the JSON file is sent to the external network server, and the dependency package is downloaded from the external network server based on the JSON file. If the user category is the maintainer, then the downloaded dependency package is subjected to a security check according to the received check instruction, and the dependency package that passes the security check is uploaded to the intranet server; If the user category is the administrator, then the user is granted permission to maintain all the dependent packages in the intranet server.

2. The dependency package privatization management method according to claim 1, characterized in that: The download command includes uploading a single JSON file or uploading a batch of JSON files.

3. The dependency package privatization management method according to claim 2, characterized in that: The uploading of batch JSON files includes either sequential uploading of batch JSON files or parallel uploading of batch JSON files.

4. The dependency package privatization management method according to claim 1, characterized in that: The process of downloading dependency packages from the external server based on the JSON file specifically includes: Send the JSON file to the external network server; The external network server reads the JSON file, obtains the identification information of all dependent packages, forms a first set of the identification information of all dependent packages, queries dependent packages according to the first set, generates a JSON sub-file according to the identification information of each dependent package, packages and returns all the queried dependent packages and the JSON sub-files associated with each dependent package.

5. The dependency package privatization management method according to claim 4, characterized in that: Iterate through all downloaded JSON subfiles; All the JSON sub-files are packaged and sent to the external network server; The external network server reads all the JSON sub-files, obtains the identification information of all dependent packages, assembles the identification information of all dependent packages into a second set, queries dependent packages according to the second set, and packages and returns all the queried dependent packages.

6. The dependency package privatization management method according to claim 4 or 5, characterized in that: The identification information includes the package name and version number.

7. The dependency package privatization management method according to claim 4 or 5, characterized in that: The dependency packages include development environment dependency packages and project runtime dependency packages.

8. The dependency package privatization management method according to claim 1, characterized in that: The security check of the dependency package specifically includes: The system reads the storage path of the downloaded dependency package, performs a security scan on the dependency package, and displays a warning on the page if the dependency package contains vulnerabilities.

9. The dependency package privatization management method according to claim 7, characterized in that: Fix the vulnerability and re-scan the dependency packages for security.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a computer program that, when run on a computer, causes the computer to perform the method as described in any one of claims 1-9.

Images