Scoring cloud packages for risk assessment automation

1. A method, comprising:

receiving, by a computer system from a developer, a request that specifies a software package to be distributed to an application exchange service of a cloud computer system;

calculating, by the computer system, a risk score for the software package based on package metadata of the software package and based on developer metadata relating to previous interactions of the developer with the application exchange service, wherein the package metadata specifies one of a plurality of package types supported by the application exchange service, wherein the specified package type is indicative of an amount of control of the developer on the software package after distribution; and

determining, by the computer system based on a comparison of the calculated risk score to a risk threshold, whether to permit distribution of the software package to users via the application exchange service.

2. The method of claim 1 , wherein the plurality of package types includes:

a first package type that allows a software package to be edited after distribution and does not permit a developer of the software package to retain control after distribution; and

a second package type that allows the developer of the software package to push upgrades after distribution.

3. The method of claim 1 , wherein the package metadata specifies namespace properties of the software package.

4. The method of claim 3 , wherein the namespace properties of the software package specify a region of security for one or more components of the software package, wherein the region of security prevents unauthorized access to the one or more components of the software package.

5. The method of claim 4 , wherein the region of security further prevents generation of duplicate custom names for the one or more components of the software package and one or more components of other software packages.

6. The method of claim 1 , wherein calculating the risk score is further based on one or more vulnerability assessments of code included in the software package.

7. The method of claim 6 , wherein the software package is executable to perform database queries, and wherein the one or more vulnerability assessments of code included in the software package include logic for verifying access rights for the database queries.

8. The method of claim 6 , wherein the determining whether to permit distribution of the software package further includes automatically approving the software package for distribution based on the calculated risk score.

9. The method of claim 1 , wherein the software package is developed in a platform as a service (PaaS) environment of the cloud computer system, and wherein, after distribution via the application exchange service, the software package is installable by organizations of the cloud computer system to extend functionality of software as a service (SaaS) programs of the cloud computer system.

10. A non-transitory computer-readable medium having instructions stored thereon that are capable of causing a computer system to implement operations comprising:

receiving, from a developer, a request that specifies a software package to be distributed to an application exchange service of a cloud computer system;

calculating a risk score for the software package based on package metadata of the software package and based on developer metadata relating to previous interactions of the developer with the application exchange service, wherein the package metadata specifies one of a plurality of package types supported by the application exchange service, wherein the specified package type is indicative of an amount of control of the developer on the software package after distribution; and

determining, based on a comparison of the calculated risk score to a risk threshold, whether to permit distribution of the software package to users via the application exchange service.

11. The non-transitory computer-readable medium of claim 10 , wherein the plurality of package types includes:

a first package type that allows a software package to be edited after distribution and does not permit a developer of the software package to retain control after distribution; and

a second package type that allows the developer of the software package to push upgrades after distribution.

12. The non-transitory computer-readable medium of claim 10 , wherein the package metadata specifies namespace properties of the software package.

13. The non-transitory computer-readable medium of claim 12 , wherein the namespace properties of the software package specify a region of security for one or more components of the software package, wherein the region of security prevents unauthorized access to the one or more components of the software package.

14. The non-transitory computer-readable medium of claim 13 , wherein the region of security further prevents generation of duplicate custom names for the one or more components of the software package and one or more components of other software packages.

15. The non-transitory computer-readable medium of claim 10 , wherein calculating the risk score is further based on one or more vulnerability assessments of code included in the software package.

16. The non-transitory computer-readable medium of claim 15 , wherein the software package is executable to perform database queries, and wherein the one or more vulnerability assessments of code included in the software package include logic for verifying access rights for the database queries.

17. The non-transitory computer-readable medium of claim 15 , wherein the determining whether to permit distribution of the software package further includes automatically approving the software package for distribution based on the calculated risk score.

18. A system, comprising:

at least one processor; and

a memory having instructions stored thereon that are executable by the at least one processor to cause the system to:

receive, from a developer, a request that specifies a software package to be distributed to an application exchange service of a cloud computer system;

calculate a risk score for the software package based on package metadata of the software package and based on developer metadata relating to previous interactions of the developer with the application exchange service, wherein the package metadata specifies one of a plurality of package types supported by the application exchange service, wherein the specified package type is indicative of an amount of control of the developer on the software package after distribution; and

determine, based on a comparison of the calculated risk score to a risk threshold, whether to permit distribution of the software package to users via the application exchange service.

19. The system of claim 18 , wherein the plurality of package types includes:

a first package type that allows a software package to be edited after distribution and does not permit a developer of the software package to retain control after distribution; and

a second package type that allows the developer of the software package to push upgrades after distribution.

20. The system of claim 19 , wherein the package metadata specifies namespace properties of the software package.