检索结果-内蒙古大学图书馆

4th ACM/IEEE International Workshop on Rapid Continuous Software Engineering (RCoSE)

作者： Rahman, Akond Partho, Asif Morrison, Patrick Williams, Laurie North Carolina State Univ Raleigh NC 27695 USA Nested Apps Dhaka Bangladesh

ISBN: (纸本)9781450357456

configuration as code (CaC) tools, such as Ansible and Puppet, help software teams to implement continuous deployment and deploy software changes rapidly. CaC tools are growing in popularity, yet what challenges programmers encounter about CaC tools, have not been characterized. A systematic investigation on what questions are asked by programmers, can help us identify potential technical challenges about CaC, and can aid in successful use of CaC tools. The goal of this paper is to help current and potential configuration as code (CaC) adoptees in identifying the challenges related to CaC through an analysis of questions asked by programmers on a major question and answer website. We extract 2,758 Puppet-related questions asked by programmers from January 2010 to December 2016, posted on Stack Overflow. We apply qualitative analysis to identify the questions programmers ask about Puppet. We also investigate the trends in questions with unsatisfactory answers, and changes in question categories over time. From our empirical study, we synthesize 16 major categories of questions. The three most common question categories are: (i) syntax errors, (ii) provisioning instances;and (iii) assessing Puppet's feasibility to accomplish certain tasks. Three categories of questions that yield the most unsatisfactory answers are (i) installation, (ii) security, and (iii) data separation.

关键词： challenge configuration as code continuous deployment devops infrastructure as code programming puppet question stack over-flow

来源：评论

学校读者我要写书评

暂无评论

Source code properties of defective infrastructure as code scripts

引用

INFORMATION AND SOFTWARE TECHNOLOGY 2019年 112卷 148-163页

作者： Rahman, Akond Williams, Laurie North Carolina State Univ 890 Oval Dr Raleigh NC 27606 USA

Context: In continuous deployment, software and services are rapidly deployed to end-users using an automated deployment pipeline. Defects in infrastructure as code (IaC) scripts can hinder the reliability of the automated deployment pipeline. We hypothesize that certain properties of IaC source code such as lines of code and hard-coded strings used as configuration values, show correlation with defective IaC scripts. Objective: The objective of this paper is to help practitioners in increasing the quality of infrastructure as code (IaC) scripts through an empirical study that identifies source code properties of defective IaC scripts. Methodology: We apply qualitative analysis on defect-related commits mined from open source software repositories to identify source code properties that correlate with defective IaC scripts. Next, we survey practitioners to assess the practitioner's agreement level with the identified properties. We also construct defect prediction models using the identified properties for 2439 scripts collected from four datasets. Results: We identify 10 source code properties that correlate with defective IaC scripts. Of the identified 10 properties we observe lines of code and hard-coded string i.e. putting strings as configuration values, to show the strongest correlation with defective IaC scripts. According to our survey analysis, majority of the practitioners show agreement for two properties: include, the property of executing external modules or scripts, and hard-coded string. Using the identified properties, our constructed defect prediction models show a precision of 0.70 similar to 0.78, and a recall of 0.54 similar to 0.67. Conclusion: Based on our findings, we recommend practitioners to allocate sufficient inspection and testing efforts on IaC scripts that include any of the identified 10 source code properties of IaC scripts.

关键词： configuration as code Continuous deployment Defect prediction Devops Empirical study Infrastructure as code Puppet

来源：评论

学校读者我要写书评

暂无评论

Detecting and Characterizing Propagation of Security Weaknesses in Puppet-Based Infrastructure Management

引用

IEEE TRANSACTIONS ON SOFTWARE ENGINEERING 2023年第6期49卷 3536-3553页

作者： Rahman, Akond Parnin, Chris Auburn Univ Comp Sci & Software Engn Auburn AL 36849 USA Microsoft Corp Microsoft Res Redmond WA 98052 USA

Despite being beneficial for managing computing infrastructure automatically, Puppet manifests are susceptible to security weaknesses, e.g., hard-coded secrets and use of weak cryptography algorithms. Adequate mitigation of security weaknesses in Puppet manifests is thus necessary to secure computing infrastructure that are managed with Puppet manifests. A characterization of how security weaknesses propagate and affect Puppet-based infrastructure management, can inform practitioners on the relevance of the detected security weaknesses, as well as help them take necessary actions for mitigation. We conduct an empirical study with 17,629 Puppet manifests with Taint Tracker for Puppet Manifests (TaintPup). We observe 2.4 times more precision, and 1.8 times more F-measure for TaintPup, compared to that of a state-of-the-art security static analysis tool. From our empirical study, we observe security weaknesses to propagate into 4,457 resources, i.e, Puppet-specific code elements used to manage infrastructure. A single instance of a security weakness can propagate into as many as 35 distinct resources. We observe security weaknesses to propagate into 7 categories of resources, which include resources used to manage continuous integration servers and network controllers. According to our survey with 24 practitioners, propagation of security weaknesses into data storage-related resources is rated to have the most severe impact for Puppet-based infrastructure management.

关键词： configuration as code devops devsecops empirical study infrastructure as code puppet static analysis

来源：评论

学校读者我要写书评

暂无评论

A systematic mapping study of infrastructure as code research

引用

INFORMATION AND SOFTWARE TECHNOLOGY 2019年 108卷 65-77页

作者： Rahman, Akond Mandavi-Hezaveh, Rezvan Williams, Laurie North Carolina State Univ Raleigh NC 27695 USA

Context: Infrastructure as code (IaC) is the practice to automatically configure system dependencies and to provision local and remote instances. Practitioners consider IaC as a fundamental pillar to implement DevOps practices, which helps them to rapidly deliver software and services to end-users. Information technology (IT) organizations, such as GitHub, Mozilla, Facebook, Google and Netflix have adopted IaC. A systematic mapping study on existing IaC research can help researchers to identify potential research areas related to IaC, for example defects and security flaws that may occur in IaC scripts. Objective: The objective of this paper is to help researchers identify research areas related to infrastructure as code (IaC) by conducting a systematic mapping study of IaC-related research. Method We conduct our research study by searching five scholar databases. We collect a set of 31,498 publications by using seven search strings. By systematically applying inclusion and exclusion criteria, which includes removing duplicates and removing non-English and non peer-reviewed publications, we identify 32 publications related to IaC. We identify topics addressed in these publications by applying qualitative analysis. Results: We identify four topics studied in IaC-related publications: (i) framework/tool for infrastructure as code;(ii) adoption of infrastructure as code;(iii) empirical study related to infrastructure as code;and (iv) testing in infrastructure as code. According to our analysis, 50.0% of the studied 32 publications propose a framework or tool to implement the practice of IaC or extend the functionality of an existing IaC tool. Conclusion: Our findings suggest that framework or tools is a well-studied topic in IaC research. As defects and security flaws can have serious consequences for the deployment and development environments in DevOps, we observe the need for research studies that will study defects and security flaws for IaC.

关键词： Devops configuration as code configuration script Continuous deployment Infrastructure as code Software engineering Systematic mapping study

来源：评论

学校读者我要写书评

暂无评论

Security Smells in Ansible and Chef Scripts: A Replication Study

引用

ACM TRANSACTIONS ON SOFTWARE ENGINEERING AND METHODOLOGY 2021年第1期30卷 1–31页

作者： Rahman, Akond Rahman, Md Rayhanur Parnin, Chris Williams, Laurie Tennessee Technol Univ 1 William Jones Dr Cookeville TN 38505 USA NC State Univ 890 Oval Dr Raleigh NC USA

Context: Security smells are recurring coding patterns that are indicative of security weakness and require further inspection. As infrastructure as code (IaC) scripts, such as Ansible and Chef scripts, are used to provision cloud-based servers and systems at scale, security smells in IaC scripts could be used to enable malicious users to exploit vulnerabilities in the provisioned systems. Goal: The goal of this article is to help practitioners avoid insecure coding practices while developing infrastructure as code scripts through an empirical study of security smells in Ansible and Chef scripts. Methodology: We conduct a replication study where we apply qualitative analysis with 1,956 IaC scripts to identify security smells for IaC scripts written in two languages: Ansible and Chef. We construct a static analysis tool called Security Linter for Ansible and Chef scripts (SLAC) to automatically identify security smells in 50,323 scripts collected from 813 open source software repositories. We also submit bug reports for 1,000 randomly selected smell occurrences. Results: We identify two security smells not reported in prior work: missing default in case statement and no integrity check. By applying SLAC we identify 46,600 occurrences of security smells that include 7,849 hard-coded passwords. We observe agreement for 65 of the responded 94 bug reports, which suggests the relevance of security smells for Ansible and Chef scripts amongst practitioners. Conclusion: We observe security smells to be prevalent in Ansible and Chef scripts, similarly to that of the Puppet scripts. We recommend practitioners to rigorously inspect the presence of the identified security smells in Ansible and Chef scripts using (i) code review, and (ii) static analysis tools.

关键词： Ansible chef configuration as code configuration scripts devops devsecops empirical study infrastructure as code insecure coding security smell static analysis

来源：评论

学校读者我要写书评

暂无评论

Puppet: Introduction, Implementation, & the Inevitable Refactoring 16

Puppet: Introduction, Implementation, & the Inevitable Refac...

引用

44th SIGUCCS Annual Conference

作者： Plummer, Shawn Warden, David SUNY Coll Geneseo 1 Coll Circle Geneseo NY 14454 USA

ISBN: (纸本)9781450340953

Puppet is configuration management software that lets you define the desired state for a computer and enforce that state on scheduled periodic executions of the Puppet agent on that computer. About a year and a half after implementing Puppet on our campus, we had a functional but inflexible and poorly organized Puppet configuration code base. We refactored it multiple times before settling on our current layout based on the roles/profiles strategy and Hiera. We will share a brief introduction to Puppet, how it is useful to us and, most importantly, what we learned over 3 years of implementing it on our campus.

关键词： Puppet configuration Management Sysadmin Automation configuration as code

来源：评论

学校读者我要写书评

暂无评论

As code Testing: Characterizing Test Quality in Open Source Ansible Development 15

As Code Testing: Characterizing Test Quality in Open Source ...

引用

15th IEEE International Conference on Software Testing, Verification and Validation (ICST)

作者： Hassan, Mohammad Mehedi Rahman, Akond Independent Univ Dhaka Bangladesh Tennessee Technol Univ Dept Comp Sci Cookeville TN USA

ISBN: (纸本)9781665466790

Infrastructure as code (IaC) scripts, such as Ansible scripts, are used to provision computing infrastructure at scale. Existence of bugs in laC test scripts, such as, configuration and security bugs, can be consequential for the provisioned computing infrastructure. A characterization study of bugs in IaC test scripts is the first step to understand the quality concerns that arise during testing of laC scripts, and also provide recommendations for practitioners on quality assurance. We conduct an empirical study with 4,831 Ansible test scripts mined from 104 open source software (OSS) repositories where we quantify bug frequency, and categorize bugs in test scripts. We further categorize testing patterns, i.e., recurring coding patterns in test scripts, which also correlate with appearance of bugs. From our empirical study, we observe 1.8% of 4,831 Ansible test scripts to include a bug, and 45.2% of the 104 repositories to contain at least one test script that includes bugs. We identify 7 categories of bugs, which includes security bugs and performance bugs that are related with metadata extraction. We also identify 3 testing patterns that correlate with appearance of bugs: 'assertion roulette', 'local only testing', and 'remote mystery guest'. Based on our findings, we advocate for detection and mitigation of the 3 testing patterns as these patterns can have negative implications for troubleshooting failures, reproducible deployments of software, and provisioning of computing infrastructure.

关键词： ansible bug configuration as code empirical study infrastructure as code quality test

来源：评论

学校读者我要写书评

暂无评论

Characterizing Static Analysis Alerts for Terraform Manifests: An Experience Report

Characterizing Static Analysis Alerts for Terraform Manifest...

引用

IEEE Secure Development Conference (SecDev)

作者： Hu, Hanyang Bu, Yani Wong, Kristen Sood, Gaurav Smiley, Karen Rahman, Akond Company A Ventura CA 93036 USA Auburn Univ Dept Comp Sci & Software Engn Auburn AL 36849 USA

ISBN: (纸本)9798350331325

While Terraform has gained popularity to implement the practice of infrastructure as code (IaC), there is a lack of characterization of static analysis for Terraform manifests. Such lack of characterization hinders practitioners to assess how to use static analysis for their Terraform development process, as it happened for Company A, an organization who uses Terraform to create automated software deployment pipelines. In this experience report, we have investigated 491 static analysis alerts that occur for 10 open source and one proprietary Terraform repositories. From our analysis we observe: (i) 10 categories of static analysis alerts to appear for Terraform manifests, of which five are related to security, (ii) Terraform resources with dependencies to have more static analysis alerts than that of resources with no dependencies, and (iii) practitioner perceptions to vary from one alert category to another while deciding on taking actions for reported alerts. We conclude our paper by providing a list of lessons for practitioners and toolsmiths on how to improve static analysis for Terraform manifests.

关键词： configuration as code empirical study experience report infrastructure as code static analysis terraform

来源：评论

学校读者我要写书评

暂无评论

Anti-Patterns in Infrastructure as code 11

Anti-Patterns in Infrastructure as Code

引用

11th IEEE International Conference on Software Testing, Verification and Validation (ICST)

作者： Rahman, Akond North Carolina State Univ Dept Comp Sci Raleigh NC 27695 USA

ISBN: (纸本)9781538650127

In DevOps, infrastructure as code (IaC) scripts are used by practitioners to create and manage an automated deployment pipeline that enables IT organizations to release their software changes rapidly at scale. Low quality IaC scripts can have serious consequences, potentially leading to wide-spread system outages and service discrepancies. The goal of this research is to help practitioners increase the quality of infrastructure as code (IaC) scripts by identifying anti-patterns in IaC scripts and development of IaC scripts. Using open source repositories, we conduct three initial studies to (i) quantify the frequency and categorize the defects in IaC scripts;and (ii) identify operations that characterize defective IaC scripts. Based on our empirical analysis we observe (i) the dominant defect defect categories to be related to syntax and configuration assignments, and (ii) three operations that characterize defective IaC scripts. The above-mentioned findings motivate us to identify anti-patterns in IaC scripts and IaC development. To this end, we propose three studies that identify (i) process anti-patterns;and (ii) security-related anti-patterns in IaC.

关键词： anti pattern configuration as code continuous deployment defect devops infrastructure as code puppet

来源：评论

学校读者我要写书评

暂无评论

Gang of Eight: A Defect Taxonomy for Infrastructure as code Scripts 20

Gang of Eight: A Defect Taxonomy for Infrastructure as Code ...

引用

42nd ACM/IEEE International Conference on Software Engineering - Companion Proceedings (ICSE-Companion) / 42nd ACM/IEEE International Conference on Software Engineering - Software Engineering in Practice (ICSE-SEIP)

作者： Rahman, Akond Farhana, Effat Parnin, Chris Williams, Laurie Tennessee Technol Univ Cookeville TN 38505 USA NC State Univ Raleigh NC USA

ISBN: (纸本)9781450371216

Defects in infrastructure as code (IaC) scripts can have serious consequences, for example, creating large-scale system outages. A taxonomy of IaC defects can be useful for understanding the nature of defects, and identifying activities needed to fix and prevent defects in IaC scripts. The goal of this paper is to help practitioners improve the quality of infrastructure as code (IaC) scripts by developing a defect taxonomy for IaC scripts through qualitative analysis. We develop a taxonomy of IaC defects by applying qualitative analysis on 1,448 defect-related commits collected from open source software (OSS) repositories of the Openstack organization. We conduct a survey with 66 practitioners to assess if they agree with the identified defect categories included in our taxonomy. We quantify the frequency of identified defect categories by analyzing 80,425 commits collected from 291 OSS repositories spanning across 2005 to 2019. Our defect taxonomy for IaC consists of eight categories, including a category specific to IaC called idempotency (i.e., defects that lead to incorrect system provisioning when the same IaC script is executed multiple times). We observe the surveyed 66 practitioners to agree most with idempotency. The most frequent defect category is configuration data i.e., providing erroneous configuration data in IaC scripts. Our taxonomy and the quantified frequency of the defect categories may help in advancing the science of IaC script quality.

关键词： bug category configuration as code configuration scripts defect devops infrastructure as code puppet software quality taxonomy

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：