RiskMetrics provides risk management metrics for any given github repository. It utilizes nexB's scancode-toolkit to scan a repository's files for license information (i.e., how many files are licensed, what types of licenses are used, etc.). RiskMetrics also constructs and checks the repository's software package’s Common Platform Enumeration (CPE) against the National Vulnerability Database (NVD). Presence in this database indicates a documented security vulnerability within the software package.
- Title: Provide Risk Management Metrics on Software Package
- Primary Actor: Open Source Contemplator (someone interested in utilizing OSS)
- Goal in Context: Provide metrics for determination of risk in any given software package
- Stakeholders: Open Source Contemplator, Software Package Vendor
- Preconditions Software package is present in system
- Main Success Scenario: Software package is analyzed and results outputted
- Failed End Conditions: Software package fails to be analyzed
- Trigger: Executes ./start.sh and provides software package
- Python 2.7.x
- virtualenv 15.0.1+
- scancode-toolkit-1.6.0 (this will be automatically installed during usage)
- Python 2.7 ships with Ubuntu 16
- Install virtualenv 15.0.1+
sudo apt install virtualenv
- In a Terminal, set your working directory where you want to install RiskMetrics
- In that directory, run
git clone https://github.com/hacksmath/RiskMetrics.git- If git is not installed, intall git with
sudo apt install gitor manually download RiskMetrics
- If git is not installed, intall git with
- Change directories to the newly downloaded RiskMetrics
- Create a virtualenv to install python dependencies with
virtualenv env - Activate the virtualenv with
source env/bin/activate - Install python dependencies with pip
pip install -r requirements.txt
- In the RiskMetrics directory, run
python riskmetrics/riskmetrics.py <github-repo-url>- ScanCode and the NVD will be automatically downloaded and configured as necessary.
- The results will be displayed on the Terminal
Development is currently being performed on macOS Sierra and Windows 10 using Python 2.7.
Those interested in contributing should contact Micah (mswab@unomaha.edu) or Kiet (khtran@unomaha.edu).
To execute unit tests, run command pytest in the test directory.
This section is intentionally empty as no generated data is currently being cached.
RiskMetrics source code licensed under MIT.
Documents licensed under CC BY-SA 4.0.
All work copyright © Micah Swab, Kiet Tran 2017.