Methods and apparatus for safe and smart distribution of software patches
Systems, devices, and methods are disclosed to send a signal to deploy a software patch at a compute device, to identify, based on a dependency map, a set of system components on the compute device that are likely to be impacted by the software patch, to monitor a set of parameters for a set of applications on the compute device that interact with a set of system components, to compare values for the set of parameters to one or more predefined criteria and to determine a compatibility classification for the software patch. Systems, devices, and methods are disclosed to update the dependency map based on the compatibility classification to define an updated dependency map, and based on the updated dependency map send a signal to deploy the software patch at a set of compute devices.
1. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the instructions comprising code to cause the processor to:
receive information related to a first software patch that is configured for deployment on a subset of software applications installed on at a plurality of compute devices, the first software patch being untested and uninstalled in the plurality of compute devices;
generate first dependency maps for each of the plurality of compute devices relative to the first software patch, the first dependency maps indicating one or more relationships between the first software patch and system components of each of the plurality of compute devices as well as known effects on the system components due to installation of the first software patch;
build a prospective effects map based on the information and the first dependency maps;
predict, based on the prospective effects map, a group of the system components and of the software applications likely incompatible with deployment of the first software patch;
calculate a risk of deployment of the first software patch on each of the plurality of compute devices;
based on the risk, select test compute devices of the plurality of compute devices for safe software patch deployment;
send a first signal to deploy the first software patch at the test compute devices;
receive additional information from the test compute devices related to deployment of the first software patch;
based on the additional information, build additional dependency maps between the first software patch and one or more system components altered by the first software patch at the test compute devices;
build additional prospective effects maps based on the additional dependency maps to predict effects to be encountered when the first software patch is deployed in untested compute devices of the plurality of compute devices;
preemptively resolve an issue that arises from deployment of the first software patch at the untested compute devices, wherein the issue includes one of the predicted effects; and
send a second signal to deploy the first software patch at the untested compute devices.
2. The non-transitory processor-readable medium of claim 1 , wherein the system component includes one or more or a combination of:
a dynamic link library (DLL),
an executable system component file, and
a registry key.
3. The non-transitory processor-readable medium of claim 1 , wherein the additional prospective effects maps are configured to:
predict effects encountered on one or both of the system components and the software applications in specific compute devices of the untested compute devices; or
predict effects encountered on specific types of the untested compute devices upon deployment of the first software patch.
4. The non-transitory processor-readable medium of claim 1 , wherein the additional prospective effects maps are configured to indicate that although there is an unknown relationship between the first software patch and a system component, the system component is predicted to be effected or changes because the first software patch is installed.
5. The non-transitory processor-readable medium of claim 1 , wherein the instructions comprise code to cause the processor to monitor the untested compute devices for messages related to crashes, loss of functionality, or an unexpected termination of one or more installed software applications of the untested compute devices following deployment of the first software patch.
6. The non-transitory processor-readable medium of claim 1 , wherein the instructions comprise code to cause the processor to:
monitor the untested compute devices for messages that report successful installation of the first software patch; and
based on the messages, increase accuracy of the predicted effects made in the additional prospective effects maps.
7. The non-transitory processor-readable medium of claim 1 , wherein the instructions further comprise code to cause the processor to:
receive, from the untested compute devices, feedback associated with at least one of processor use, memory use, input/output use, or bandwidth use after deployment of the first software patch; and
identify a compatibility classification for the first software patch based on the feedback.
8. The non-transitory processor-readable medium of claim 1 , wherein the additional information is received from agents executing on the test compute devices.
9. A method of safe software patch deployment, the method comprising:
receiving information related to a first software patch that is configured for deployment on a subset of software applications installed on at a plurality of compute devices, the first software patch being untested and uninstalled in the plurality of compute devices;
generating first dependency maps for each of the plurality of compute devices relative to the first software patch, the first dependency maps indicating one or more relationships between the first software patch and system components of each of the plurality of compute devices as well as known effects on the system components due to installation of the first software patch;
building a prospective effects map based on the information and the first dependency maps;
predicting, based on the prospective effects map, a group of the system components and of the software applications likely incompatible with deployment of the first software patch;
calculating a risk of deployment of the first software patch on each of the plurality of compute devices;
based on the risk, selecting test compute devices of the plurality of compute devices for safe software patch deployment;
sending a first signal to deploy the first software patch at the test compute devices;
receiving additional information from the test compute devices related to deployment of the first software patch;
based on the additional information, building additional dependency maps between the first software patch and one or more system components altered by the first software patch at the test compute devices;
building additional prospective effects maps based on the additional dependency maps to predict effects to be encountered when the first software patch is deployed in untested compute devices of the plurality of compute devices;
preemptively resolving an issue that arises from deployment of the first software patch at the untested compute devices, wherein the issue includes one of the predicted effects; and
sending a second signal to deploy the first software patch at the untested compute devices.
10. The method of claim 9 , wherein the system component includes one or more or a combination of:
a dynamic link library (DLL),
an executable system component file, and
a registry key.
11. The method of claim 9 , wherein the additional prospective effects maps are configured to:
predict effects encountered on one or both of the system components and the software applications in specific compute devices of the untested compute devices; or
predict effects encountered on specific types of the untested compute devices upon deployment of the first software patch.
12. The method of claim 9 , wherein the additional prospective effects maps are configured to indicate that although there is an unknown relationship between the first software patch and a system component, the system component is predicted to be effected or changes because the first software patch is installed.
13. The method of claim 9 , further comprising monitoring the untested compute devices for messages related to crashes, loss of functionality, or an unexpected termination of one or more installed software applications of the untested compute devices following deployment of the first software patch.
14. The method of claim 9 , further comprising:
monitoring the untested compute devices for messages that report successful installation of the first software patch; and
based on the messages, increasing accuracy of the predicted effects made in the additional prospective effects maps.
15. The method of claim 9 , further comprising:
receiving, from the untested compute devices, feedback associated with at least one of processor use, memory use, input/output use, or bandwidth use after deployment of the first software patch; and
identifying a compatibility classification for the first software patch based on the feedback.
16. The method of claim 9 , wherein the additional information is received from agents executing on the test compute devices.