Alexander Trautsch, Fabian Trautsch, Steffen Herbold, Benjamin Ledel, Jens Grabowski
Software repository mining is the foundation for many empirical software engineering studies. The collection and analysis of detailed data can be challenging, especially if data shall be shared to enable replicable research and open science practices. SmartSHARK is an ecosystem that supports replicable and reproducible research based on software repository mining.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
继续探索
The SmartSHARK repository mining data is a collection of rich and detailed information about the evolution of software projects. The data is unique in its diversity and contains detailed information about each change, issue tracking data, continuous integration data, as well as pull request and code review data. Moreover, the data does not contain only raw data scraped from repositories, but also annotations in form of labels determined through a combination of manual analysis and heuristics, as well as links between the different parts of the data set. The SmartSHARK data set provides a rich …
Maintenance and Support in Community-Driven Scientific Pipeline Ecosystems: A Cross-Platform Empirical Study of nf-core
研究社区驱动的科学管道生态系统nf-core中的维护与支持，通过分析大量GitHub问题、拉取请求及论坛讨论来研究相关问题、解决因素等，发现不同平台作用不同，解决结果与多种因素有关，跨平台分析揭示了内部可追溯性及联系有限的情况。
For Coding Agents, the Repository Matters
研究发现，AI智能体贡献的代码在仓库层面产生的集成摩擦比人类贡献高约两倍，表明风险源于生态系统而非单个智能体，建议从生态系统层面进行治理。
Revealing the value of Repository Centrality in lifespan prediction of Open Source Software Projects
本研究提出仓库中心性这一基于HITS权重的新度量，结合生存分析模型预测开源项目生命周期，验证其为预测弃用风险的核心特征，为开源生态健康监测提供新方法。
AROMA+: A Study of Factors Affecting Reproducible Builds in the Maven Ecosystem
本研究针对Maven生态系统可复现构建研究不足的问题，开发工具AROMA+自动获取相关信息，准确率达99.8%，实现32%软件包自动可复现，贡献部分软件包至Reproducible Central并公开数据集与工具。
Analyzing the Accessibility of GitHub Repositories for PyPI and NPM Libraries
本研究通过 PageRank 算法分析 PyPI 和 NPM 库的 GitHub 仓库可访问性，发现多数库（尤其重要库）可监控，但部分库缺少 URL，建议维护者更新信息。
Free and open source software package ecosystems have existed for a long time and are among the most sophisticated human-made systems. One of the oldest and most popular software package ecosystems is CRAN, the repository of packages of the statistical language R, which is also one of the most popular environments for statistical computing nowadays. CRAN stores a large number of packages that are updated regularly and depend on a number of other packages in a complex graph of relations; such graph is empirically studied from the perspective of complex network analysis (CNA) in the current arti…
Mining and storage of data from software repositories is typically done on a per-project basis, where each project uses a unique combination of data schema, extraction tools, and (intermediate) storage infrastructure. We introduce GraphRepo, a tool that enables a unified approach to extract data from Git repositories, store it, and share it across repository mining projects. GraphRepo usesNeo4j, an ACID-compliant graph database management system, and allows modular plug-in of components for repository extraction (drillers), analysis (miners), and export (mappers). The graph enables a natural w…
The software ecosystem is a trust-rich part of the world. Collaboratively, software engineers trust major hubs in the ecosystem, such as package managers, repository services, and programming language ecosystems. This trust, however, is often broken by vulnerabilities, ransomware, and abuse from malignant actors. But what is trust? In this paper we explore, through twelve in-depth interviews with software engineers, how they perceive trust in their daily work. From the interviews we conclude three things. First, software engineers make a distinction between an adoption factor and a trust facto…
Not Only for Developers: Exploring Plugin Maintenance for Knowledge-Centric Communities
研究探讨了非开发者主导社区中插件生态系统的维护，通过分析Obsidian平台的插件发现六个知识管理相关主题，并揭示了其工程结构和可持续性问题。
Sustainability of Open-Source Machine Learning Robustness Assessment Tools: A Repository Mining Study
本研究通过挖掘GitHub上的28个开源鲁棒性工具仓库，发现其参与度与维护活动分布不均，多数仓库不活跃，呼吁将鲁棒性工具视为演进中的软件系统。
Repositories, Contributors, and Continuity: An Empirical Study of Foundational Quantum Software
研究量子软件生态系统中概念和影响如何跨存储库边界持续存在，运用实证软件工程技术分析基础量子软件存储库，结合跨库活动与贡献者关系研究社区演变，发现多种发展路径并提供实证视角。
Lessons Learned from Mining the Hugging Face Repository
本文总结了在 Hugging Face 仓库挖掘中的经验，提出分层抽样策略和从仓库挖掘到队列研究的指南，以提高研究质量并建立因果关系。
The Software Heritage Open Science Ecosystem
本文介绍 Software Heritage 这一最大的公共源代码存档库，其通过 Merkle 图支持软件实证研究，并确保科研软件的可获取性与完整性，促进可复现研究。
The Maven Central Repository provides an extraordinary source of data to understand complex architecture and evolution phenomena among Java applications. As of September 6, 2018, this repository includes 2.8M artifacts (compiled piece of code implemented in a JVM-based language), each of which is characterized with metadata such as exact version, date of upload and list of dependencies towards other artifacts. Today, one who wants to analyze the complete ecosystem of Maven artifacts and their dependencies faces two key challenges: (i) this is a huge data set; and (ii) dependency relationships …
ATLAS: Agentic Taxonomy of Large-Scale Software Ecosystems
提出ATLAS框架，结合LLM全局知识与实际仓库分布，通过智能体协作和自修正循环自动构建软件仓库的层次化分类体系，在54,387个GitHub仓库上评估，分类质量F1达83.13%，优于基线15个百分点。
Open-Source Projects and Libraries are being used in software development while also bearing multiple security vulnerabilities. This use of third party ecosystem creates a new kind of attack surface for a product in development. An intelligent attacker can attack a product by exploiting one of the vulnerabilities present in linked projects and libraries. In this paper, we mine threat intelligence about open source projects and libraries from bugs and issues reported on public code repositories. We also track library and project dependencies for installed software on a client machine. We repres…
From Codebases to LLMs: Non-Inclusive Naming in Linux Foundation Repositories
研究利用 NISCAN 框架检测 Linux 基金会存储库中代码及相关工件的非包容性术语，对 461 个存储库进行生态系统规模研究，分析术语变化及影响因素，还通过案例研究评估大语言模型处理情况。
Wolves in the Repository: A Software Engineering Analysis of the XZ Utils Supply Chain Attack
本文分析XZ Utils供应链攻击（CVE-2024-3094），揭示攻击者操纵软件工程实践注入后门，提出保护开源生态的见解。
Mining the YARA Ecosystem: From Ad-Hoc Sharing to Data-Driven Threat Intelligence
研究通过分析840万条规则揭示YARA生态系统高度集中且存在运营问题，提出需从随意收集转向严格规则工程。
PonyEval: Evaluating LLM-Based Program Repair for Capability-Safe and Actor-Oriented Pony Software
针对Pony语言生态，构建了包含291个真实GitHub问题-拉取请求对的SWE-bench风格基准PonyEval，并通过严格审计与多模型评估，揭示生成补丁的条件解决率在10.21%至24.68%之间，为能力安全与actor导向软件的程序修复提供了可靠评测。
Debian in the Research Software Ecosystem: A Bibliometric Analysis
本研究通过Scopus数据库对含“Debian”的学术出版物开展文献计量分析，分类文章、绘制图谱、识别趋势并公开数据，揭示其知识结构，助力研究人员把握趋势与机遇。
Understanding npm Developers' Practices, Challenges, and Recommendations for Secure Package Development
本研究通过调查75名npm开发者，探讨其在安全包开发中的实践、挑战及改进建议，揭示了安全工具不足、依赖项弃用等问题。
PySynthea: A Python-Native Framework for Scalable Synthetic Healthcare Data Generation
针对Synthea部署复杂且与Python工作流集成困难的问题，提出Python原生框架PySynthea，通过模块化生成、可配置模拟管道和标准格式支持，提升可访问性和可扩展性。
Compliant Self Service Access to Secondary Use Clinical Data at Stanford Medicine
本文介绍斯坦福STARR临床研究生态及其自助数据访问工具的演进，并提出合规框架，保障研究人员二次使用详细临床数据时符合相关法规。
LLMs as Packagers of HPC Software
本文提出端到端框架 SpackIt，结合仓库分析、示例检索与诊断反馈迭代优化，将 HPC 软件 Spack 配方自动生成的安装成功率从 20% 提升至 80% 以上。
扫码添加微信好友，提出您的宝贵建议 👇
💡 备注请填写：网站反馈
发表机构由 AI 从论文文本抽取，如发现错误，欢迎反馈修正建议。