System for and method of verifying packages
The system and method may include identifying manifest data associated with a package to be developed on a package development system, receiving the package from the package development system via a first network, comparing the manifest data to the package to determine whether a code injection exists in the package, and distributing the package to a plurality of user systems via a second network based on a determination that the code injection does not exist in the package.
1. A system comprising one or more network-enabled computers, said one or more network-enabled computers comprising:
a manifest repository computing processor that identifies manifest data associated with an executable software package to be developed on a package development system;
a package repository computing processor that receives the executable software package from the package development system via a first network;
a package verification computing processor that compares the manifest data to the executable software package to determine whether a code injection exists in the package, wherein the package verification computing processor selects a combination of a plurality of comparisons based on a level of risk associated with at least one of the importance of the executable software package, an amount of user systems subscribed to the executable software package, and a type of user systems subscribed to the executable software package; and
a package distribution computing processor that distributes the executable software package to a plurality of user systems via a second network based on a determination that the code injection does not exist in the executable software package.
2. The system of claim 1 , wherein the first network and the second network are different.
3. The system of claim 1 , wherein the package development system is not communicatively coupled to the second network.
4. The system of claim 1 , wherein the manifest data includes a set of requirements a developer needs to meet while developing the package.
5. The system of claim 1 , wherein the package verification computing processor also compares a first file size associated with the manifest data to a second file size associated with the package.
6. The system of claim 1 , wherein the package verification computing processor also compares a first list of files associated with the manifest data to a second list of files associated with the package.
7. The system of claim 1 , wherein the package verification computing processor also compares a first time stamp associated with the manifest data to a second time stamp associated with the package.
8. The system of claim 1 , wherein the code injection comprises a malicious code injection.
9. A method, comprising:
identifying manifest data associated with an executable software package to be developed on a package development system;
receiving the executable software package from the package development system via a first network;
comparing the manifest data to the executable software package to determine whether a code injection exists in the executable software package;
selecting a combination of a plurality of comparisons based on a level of risk associated with at least one of the importance of the executable software package, an amount of user systems subscribed to the executable software package, and a type of user systems subscribed to the executable software package; and
distributing the executable software package to a plurality of user systems via a second network based on a determination that the code injection does not exist in the executable software package.
10. The method of claim 9 , wherein the first network and the second network are different.
11. The method of claim 9 , wherein the package development system is not communicatively coupled to the second network.
12. The method of claim 9 , wherein the manifest data includes a set of requirements a developer needs to meet while developing the package.
13. The method of claim 9 , further comprising comparing a first file size associated with the manifest data to a second file size associated with the package.
14. The method of claim 9 , further comprising comparing a first list of files associated with the manifest data to a second list of files associated with the package.
15. The method of claim 9 , further comprising comparing a first time stamp associated with the manifest data to a second time stamp associated with the package.
16. The method of claim 9 , wherein the code injection comprises a malicious code injection.
17. A non-transitory computer readable media comprising code embodied in a tangible medium to perform the steps of:
identifying manifest data associated with an executable software package to be developed on a package development system;
receiving the executable software package from the package development system via a first network;
comparing the manifest data to the executable software package to determine whether a code injection exists in the executable software package;
selecting a combination of a plurality of comparisons based on a level of risk associated with at least one of the importance of the executable software package, an amount of user systems subscribed to the executable software package, and a type of user systems subscribed to the executable software package; and
distributing the executable software package to a plurality of user systems via a second network based on a determination that the code injection does not exist in the package.