一句话：提出 py2src，自动识别 PyPI 包对应的 GitHub 源码仓库，并为识别结果提供可靠性指标。
在软件开发中，选择采用哪些库（业界称为依赖或包）是关键任务，而对应源代码的质量（如安全性和时效性）是选择的重要依据。然而，找到 PyPI 包的“实际”源码并不容易，且该信息是否可靠也值得质疑。针对此问题，作者提出 py2src 方法，能够自动识别 PyPI 包对应的 GitHub 源代码仓库，并自动给出关于该识别信息可靠性的指标。论文还报告了在热门 PyPI 包上的初步实证评估。摘要未披露具体的识别准确率或可靠性指标数值。
Selecting which libraries (‘dependencies’ or ‘packages’ in the industry’s jargon) to adopt in a project is an essential task in software development. The quality of the corresponding source code is a key factor behind this selection (from security to timeliness). Yet, how easy is it to find the ‘actual’ source? How reliable is this information? To address this problem, we developed an approach called py2src to automatically identify GitHub source code repositories corresponding to packages in PyPI and automatically provide an indicator of the reliability of such information. We also report a preliminary empirical evaluation of the approach on the top PyPI packages.
DOI 原文 ·
@inproceedings{paperbot6513,
title = {py2src: Towards the Automatic (and Reliable) Identification of Sources for PyPI Package},
author = {Duc-Ly Vu},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678526}
}