Getting to Know the oepkgs Community ​

NOTE

Package layered release process

• Core packages + basic packages: Basic libraries and general basic software. They are initiated by the packaging management SIG, approved by the TC and the release SIG, assessed against the QA SIG quality exit criteria, and embedded into the ISO.
• Extended packages: Platform-level large software with fast version changes. They are initiated by community SIGs, approved by the TC and the release SIG, reviewed by the QA SIG based on test reports, and included in EPOL.
• Long-tail packages: Closed-source or innovative software packages. Third-party organizations, enterprises, or individuals establish a SIG at the Institute of Software. After approval by the TC of the Institute of Software and review of test reports by the QA SIG of the Institute of Software, the packages are released to the oepkgs repository (openEuler extended repository).

Quality requirements

• Images: Quality planning for version iterations, and the version issue resolution rate reaches 100%. In principle, issues with CVSS > 7 are not allowed to be released.
• EPOL: The package gating and build test pass rate reaches 100%. Packages cover installation, uninstallation, upgrade/rollback, commands, services, and random dependency combinations. In principle, issues with CVSS > 7 are not allowed to be released.
• oepkgs: The package gating and build test pass rate reaches 100%. Packages cover installation, uninstallation, upgrade/rollback, commands, and services. Binary vulnerability and virus scanning is also required.

NOTE

• oepkgs provides a mature CICD system that supports software package introduction traceability analysis, source code building, binary scanning, basic function verification, vulnerability and compliance risk awareness, and patch and version update awareness, ensuring reliable and continuously evolving software repository quality.

NOTE

• oepkgs currently includes 30,000 software packages from the official openEuler repository and the oepkgs openEuler extended repository.
• Binary package search for all openEuler versions is supported.
• RPM package search service: The oepkgs image source provides a powerful RPM package search service, including package name search and Command and Files search. Users can quickly find the software packages they need by searching, which greatly improves user efficiency.

NOTE

• Combined with the preceding RPM package search service, oepkgs provides metadata analysis on the details page of each software package, including advanced software package attribute analysis, status identification of source code repositories and upstream repositories, SBOM analysis, dependency visualization graphs, software package risk analysis, and information announcements on security, compliance, and maintainability.

NOTE

Open source software supply chain analysis capabilities are used to scan binary artifacts, analyze their bills of materials and license information, and draw dependency graphs.

• SBOM analysis: A software bill of materials (SBOM) is a standard format that describes which components software contains. The oepkgs image source provides SBOM analysis, which enables users to clearly understand the composition of a software package.
• Dependency visualization graph: To help users better understand the dependencies of software packages, the oepkgs image source provides a dependency visualization graph. This helps users understand the dependencies of software packages so that they can better manage and resolve dependency issues.

NOTE

• Security risk analysis: Using the open source software supply chain platform of the Chinese Academy of Sciences, the oepkgs image source performs in-depth security analysis on software packages and can identify potential security risks and vulnerabilities in the packages.
• Multi-data source analysis: Multiple authoritative data sources are combined, including Zhongke Weilan, Yuantu, OSS Index, and osv.dev, fully ensuring the accuracy and comprehensiveness of risk analysis results.
• Explicit risk announcements: The Security Risk Announcement section provides detailed risk data and data source links. You can click a link to go directly to the risk details for reference and analysis. We believe that transparency is the key to building user trust. All risk announcements provide their sources so that you can gain an in-depth understanding and make your own decisions.

NOTE

• Multi-requirement matching: Binary package download and source package download are supported, and source code repositories and upstream source repositories can be viewed.
• Installation instructions are provided for users.
• Feedback channels are provided for users: Platform issues can be conveniently reported to the oepkgs community Gitee repository, and binary package issues can be conveniently reported to the source code repository.