Securing Supply Chains in Open Source Ecosystems: Methodologies for Determining Version Numbers of Components Without Package Management Files

Abstract

In the case of supply chain security detection research, determining the component version number is a crucial task for the open source components of package-free management files. This paper aims to explore the new perspective of the determination of component version numbers based on various methods and to propose an effective method. First, by analyzing the source code of the component, you can try to determine the version number of the component by a specific mode, function, or variable in the code. This approach requires in-depth study and analysis of the source code to extract key code snippets that may contain version information. Second, the submission history of the component can be used to track the change of the version number. The modification content and update information for each version is obtained by viewing the submission records of the components in the version control system. Such an approach is relatively feasible for those components with a canonical versioning history. In addition, the metadata or metadata information of the component can be used to determine the version number. Some open-source components may contain version-related information in their code or documentation, such as release date, release instructions, version labels, etc. By parsing and extraction of these metadata, the version number of the components is obtained. In addition, the version number of the component can be obtained through communication with the community or the developer. Participate in the relevant open source community or contact component developers to consult them for information about the component version. This approach may require more time and resources, but is a viable option for those components that are difficult to determine the version number through other means. To sum up, the determination of the version number of open source components without package management files is an important link in supply chain security detection.