PVAC: Package Version Activity Categorizer, Leveraging Semantic Versioning in a Heterogeneous System

<b>Context: </b>Modern open-source software ecosystems, such as those managed by GNU/Linux distributions, are composed of numerous packages developed independently by diverse communities. These ecosystems employ package management tools to facilitate software installation and dependency resolution. However, these tools lack robust mechanisms for systematically evaluating the development activity and versioning dynamics within their heterogeneous software environments.<br><b>Objective:</b> This research aims to introduce a systematic method and a prototype tool for assessing version activity within heterogeneous package manager ecosystems, enabling quantitative analysis of software package updates.<br><b>Method:</b> We developed PVAC,a <b>P</b>ackage <b>V</b>ersion<b> </b><b>A</b>ctivity <b>C</b>ategorizer, a novel approach<br>that leverages semantic versioning to surface the activity of software packages at both the system level using the Version Number Delta (VND) metric and at the package level using the Activity Categorizer. PVAC utilizes tailored regular expressions to parse semantic versioning details (epoch, major, minor, and patch versions) from diverse package version strings, thereby enabling consistent categorization and quantitative scoring of version changes.<br><b>Results</b>: PVAC was empirically evaluated using a dataset of 22,535 packages drawn from<br>recent releases of Debian and Ubuntu GNU/Linux distributions. Our findings<br>demonstrate PVAC's effectiveness for accurately categorizing versioning schemes and quantitatively measuring version activity across releases. We provide empirical evidence confirming that semantic versioning, including adapted variations, is predominantly employed across these ecosystems.<br><b>Conclusions</b>: PVAC represents an effective solution for systematically assessing and<br>monitoring the software package version activity within heterogeneous ecosystems. By providing clear metrics for software activity, PVAC aids practitioners and researchers in identifying packages requiring attention, thereby reducing security risks and technical debt.<b>上下文：</b>现代开源软件生态系统（如由GNU/Linux发行版管理的生态系统）由众多由不同社区独立开发的软件包构成。此类生态系统借助软件包管理工具实现软件安装与依赖项解析。然而，此类工具缺乏能够系统性评估其异构软件环境内开发活跃度与版本迭代动态的可靠机制。<br><b>目标：</b>本研究旨在提出一种可用于评估异构软件包管理生态系统内版本活跃度的系统性方法与原型工具，以实现软件包更新的量化分析。<br><b>方法：</b>本研究开发了PVAC，即<b>P</b>ackage <b>V</b>ersion<b> </b><b>A</b>ctivity <b>C</b>ategorizer（包版本活跃度分类器，Package Version Activity Categorizer），这是一种全新的研究方法。该方案依托语义化版本控制（semantic versioning），通过版本号差值（Version Number Delta, VND）指标在系统层面、结合活跃度分类器在软件包层面，呈现软件包的开发活跃度。PVAC通过定制化正则表达式从各类软件包版本字符串中解析语义化版本的细节信息（纪元、主版本、次版本、修订版本），从而实现版本变更的标准化分类与量化评分。<br><b>结果：</b>本研究使用取自近期发布的Debian与Ubuntu GNU/Linux发行版的22535个软件包数据集，对PVAC进行了实证评估。研究结果证实，PVAC能够准确分类版本方案，并量化跨版本发布的软件包活跃度。本研究提供的实证数据表明，包括适配变体在内的语义化版本控制方案，在上述生态系统中占据主导地位。<br><b>结论：</b>PVAC为异构生态系统内软件包版本活跃度的系统性评估与监控提供了高效解决方案。通过为软件活跃度提供清晰的量化指标，PVAC可帮助从业者与研究人员快速定位需要关注的软件包，从而降低安全风险与技术债务。