System and method for checking open source usage

1. A computer-implemented method comprising:

receiving a first characteristic of a first source code entity to be checked and a second characteristic of a second source code entity to be checked;

comparing the first characteristic to characteristics stored in a repository representing an open source library;

comparing the second characteristic to the characteristics stored in the repository;

based on comparing the first characteristic to the characteristics stored in the repository, determining a first probability indicating that the first source code entity contains code from the open source library;

based on comparing the second characteristic to the characteristics stored in the repository, determining a second probability lower than the first probability, wherein the second probability indicates that the second source code entity does not contain code from the open source library;

determining, due to the first probability indicating that the first source code entity contains code from the open source library, that the second source code entity also contains code from the open source library; and

providing an indication of the open source library,

wherein the first source code entity and the second source code entity are not received with the first characteristic or the second characteristic.

2. The method of claim 1 , further comprising:

determining a characteristic of an open source code entity associated with an open source project; and

storing the characteristic and an identifier of the open source code entity in the repository.

3. The method of claim 2 wherein the identifier comprises a name of the open source project.

4. The method of claim 2 wherein the identifier comprises an item selected from the group consisting of: a license associated with the open source project, a vulnerability, a bug, a quality issue, a trend report, a replacement, and information related to other users that use the open source project.

5. The method of claim 1 wherein the characteristic of the first source code entity or the second source code entity to be checked is a hash value assigned to the first source code or the second source code entity, respectively.

6. The method of claim 5 wherein the hash value is obtained by performing SHA-1 hash function upon the first source code entity or the second source code entity, respectively.

7. The method of claim 1 wherein the characteristic of the first source code entity or the second source code entity to be checked is a sequence of keywords or keyword symbols extracted from the first source code entity or the second source code entity, respectively.

8. The method of claim 1 wherein the characteristic of the first source code entity or the second source code entity to be checked is a value computed based on a sequence of keywords or keyword symbols extracted from the first source code entity or the second source code entity, respectively.

9. The method of claim 1 wherein the first source code entity or the second source code entity to be checked is a file.

10. The method of claim 1 wherein the first source code entity or the second source code entity to be checked is a portion of a file.

11. The method of claim 1 wherein the first source code entity or the second source code entity to be checked comprises two portions of a file.

12. The method of claim 1 wherein the first source code entity or the second source code entity to be checked is a predetermined number of code lines extracted from a file.

13. The method of claim 1 further comprising determining the characteristic of the first source code entity or the second source code entity to be checked.

14. The method of claim 13 further comprising removing non-functional parts of the first source code entity or the second source code entity prior to determining the characteristic.

15. A system for determining open source usage, comprising:

a processor;

a communication component for receiving a first characteristic of a first source code entity to be checked and a second characteristic of a second source code entity to be checked;

a repository comprising a multiplicity of source code entity characteristics and an identifier of an open source library associated with each source code entity characteristic;

a comparison component for:

comparing the first characteristic to characteristics stored in a repository representing an open source library;

comparing the second characteristic to the characteristics stored in the repository;

based on comparing the first characteristic to the characteristics stored in the repository, determining a first probability indicating that the first source code entity contains code from the open source library;

based on comparing the second characteristic to the characteristics stored in the repository, determining a second probability lower than the first probability, wherein the second probability indicates that the second source code entity does not contain code from the open source library; and

determining due to the first probability indicating that the first source code entity contains code from the open source library, that the second source code entity also contains code from the open source library; and

a user interface module or communication module for providing the identifier of the open source library,

wherein the first source code entity and the second source code entity are not received with the first characteristic or the second characteristic.

16. The system of claim 15 , further comprising a characteristic determination component for determining the characteristic of the first source code entity or the second source code entity.

17. The system of claim 15 wherein the characteristic of the first source code entity or the second source code entity to be checked is a hash value assigned to the first source code entity or the second source code entity, respectively.

18. The system of claim 15 wherein the characteristic of the first source code entity or the second source code entity to be checked is a sequence of keywords or keyword symbols extracted from the first source code entity or the second source code entity, respectively.

19. A computer program product comprising a computer readable storage medium retaining program instructions, which program instructions when read by a processor, cause the processor to perform a method comprising:

receiving a first characteristic of a first source code entity to be checked and a second characteristic of a second source code entity to be checked;

comparing the first characteristic to characteristics stored in a repository representing an open source library;

comparing the second characteristic to the characteristics stored in the repository; and

based on comparing the first characteristic to the characteristics stored in the repository, determining a first probability indicating that the first source code entity contains code from the open source library;

based on comparing the second characteristic to the characteristics stored in the repository, determining a second probability lower than the first probability, wherein the second probability indicates that the second source code entity does not contain code from the open source library;

determining due to the first probability indicating that the first source code entity contains code from the open source library, that the second source code entity also contains code from the open source library; and

providing an indication of the open source library,

wherein the first source code entity and the second source code entity are not received with the first characteristic or the second characteristic.

20. The method of claim 1 wherein an indication of the open source library being associated with the first characteristic is provided subject to the first probability exceeding a predetermined threshold.

21. The system of claim 15 wherein an indication of the open source library associated with the first characteristic is provided subject to the first probability exceeding a predetermined threshold.