Open Source Package Rebuilding for Added Functionality Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Open source software packages may be compromised during the build process or transmission, introducing additional functionality that is not described by the source code, posing a risk to developers and organizations using them.
Innovation Solution
Rebuild the open source software package from its source code and compare the rebuilt package with the original to detect any additional functionality, raising an alert if the functionalities do not match, and validate the package as safe or unsafe based on the comparison.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If open source software packages are published and distributed through package managers, then developers can efficiently consume and execute software independently or combine packages to create products, but the packages may be compromised during build process or transmission, introducing additional functionality not described by source code
Solution Approach 1:
The patent performs preliminary actions by rebuilding the software package from source code before distribution, and conducting functional comparison between the rebuilt package and the published package. This preliminary verification detects any unauthorized modifications or additional functionality introduced during the build process or transmission, ensuring package integrity before the package is consumed by developers.
2Productivity
If developers use multiple open source software packages in their codebase, then work advancement is accelerated through leveraging others' work, but the complexity of verifying package functionality and detecting unauthorized modifications increases
Solution Approach 1:
The patent creates a copy of the published software package by rebuilding it from the original source code. This rebuilt copy serves as a reference for comparison, allowing automated detection of any differences between the expected functionality (from source code) and the actual published package. This copying approach simplifies verification complexity by providing a direct可比基准 for functional comparison.
3Reliability
If functional comparison is performed between rebuilt package and original package, then additional functionality can be detected and developers can manage risks, but the build time and computational resources required increase
Solution Approach 1:
The patent extracts only the essential functionality information from the source code and compares it with the published package's functionality. Rather than performing a complete rebuild and full-functional testing, the method extracts key functional characteristics and performs targeted comparison, reducing build time and computational resources while maintaining effective detection of unauthorized modifications.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Detecting whether or not an open source software package has functionality which is not described by the source code used to build the open source software package. To do so, in one embodiment, this is done by accessing source code used to build the open source software package. The open source software package is built from the source code. After the open source software package has been rebuilt, then it is computed whether or not the rebuilt package accomplishes the same functions as the open source software package. Finally, if the rebuilt package does not accomplish the same functions as the open source software package, an alert is raised.