软件供应链的使用始终穿插在软件系统研发过程当中, 近年来关于软件供应链的安全事件频发, 软件供应链安全已然成为了一个全球性问题. 软件可维护性作为软件质量的重要属性之一, 反映了软件维护活动的难易程度. 软件供应链的开源趋势逐渐流行, 但对开源软件供应链的可维护性研究还处于起步阶段. 基于以上考虑, 本文结合传统软件维护性风险研究方法, 探究了开源软件维护性风险特有的分析视角, 并提出了一个开源软件供应链维护性质量模型. 该模型通过16种度量指标分别对团队健康、软件活跃度、依赖影响力、测试完整度、外部依赖度和可理解性等9种软件属性类进行度量以反映开源软件供应链的可维护性. 同时基于GitHub托管平台和npm (Node.js 标准的软件包管理器) 子生态数据 (包括软件信息、依赖关系、各个软件在开发过程中产生的行为数据等), 对同一时间内不同软件的可维护性指标进行对比计算, 验证了本文所提出方法的合理性. 因此, 使用本文所提出的可维护性质量模型可以有效地对开源软件供应链进行可维护性评估, 帮助和指导软件的设计与重构, 进而开发出更高质量的软件系统.

The use of the software supply chain has been continuously interspersed throughout the software system development process. In recent years, security incidents related to the software supply chain have frequently occurred, and its security has become a global issue. Software maintainability, as one of the important attributes of software quality, reflects the difficulty of software maintenance activities. Although the trend of an open source software supply chain has gradually become popular in recent years, research into its maintainability remains extremely limited. Based on the above considerations and combined with a traditional research approach to software maintainability risk, this paper explores a unique analysis perspective regarding the maintainability risk of open source software and proposes a quality model of open source supply chain software maintainability. The model measures nine software attributes, including team health, activity, dependency influence, test integrity, external dependency, and understandability, based on 16 metrics for reflecting the maintainability of the open source software supply chain. At the same time, based on the GitHub hosting platform and npm sub-ecological data (this includes software information, dependencies, behavioral data generated during the development of each software, and so on), the maintainability indicators of different projects at the same time and within different time periods for the same project are compared and calculated, confirming the rationality of the proposed method. Using the model proposed herein, the quality maintainability of the open source software supply chain can be effectively evaluated, thereby guiding software design and reconstruction and the development of a higher quality software system.