A Systematic Approach to Evaluating Development Activity in Heterogeneous Package Management Systems for Overall System Health Assessment

Context: Modern open-source operating systems consist of numerous independent packages crafted by countless developers worldwide. To effectively manage this diverse array of software originating from various entities, Linux distributions have devised package management tools to streamline the process. Despite offering convenience in software installation, systems like Ubuntu's apt may obscure the freshness of its constituent packages when compared to the upstream projects. Objective: The focus of this research is to develop a method to systematically identify packages within a Linux distribution that show low development activity between versions of the OSS projects included in a release. The packages within a Linux distribution utilize a heterogeneous mix of versioning strategies in their upstream projects and these versions are passed through to the package manager, often with distribution specific version information appended, making this work both interesting and non-trivial. Method: We use regular expressions to extract the epoch and upstream project major, minor, and patch versions for more than 6000 packages in the Ubuntu distribution, documenting our process for assigning these values for projects that do not follow the semantic versioning standard. Using the libyears metric for the CHAOS project, we calculate the freshness of a subset of the packages within a distribution against the latest upstream project release. This led directly to the development of Package Version Activity Classifier (PVAC), a novel method for systematically assessing the staleness of packages across multiple distribution releases.