@proceedings {1908,
	title = {How Open Source Projects use Static Code Analysis Tools in Continuous Integration Pipelines},
	year = {2017},
	note = {Data: the paper studies the use of ASCATs (Automated Static Code Analysis Tools) within CI pipelines of 20 popular Java open source projects hosted on GitHub and using Travis CI to support CI activities},
	month = {05/2017},
	pages = {334-344},
	abstract = {Static analysis tools are often used by software developers
to entail early detection of potential faults, vulnerabilities,
code smells, or to assess the source code adherence to coding
standards and guidelines. Also, their adoption within Continuous
Integration (CI) pipelines has been advocated by researchers and
practitioners. This paper studies the usage of static analysis tools
in 20 Java open source projects hosted on GitHub and using
Travis CI as continuous integration infrastructure. Specifically,
we investigate (i) which tools are being used and how they are
configured for the CI, (ii) what types of issues make the build fail
or raise warnings, and (iii) whether, how, and after how long are
broken builds and warnings resolved. Results indicate that in the
analyzed projects build breakages due to static analysis tools are
mainly related to adherence to coding standards, and there is also
some attention to missing licenses. Build failures related to tools
identifying potential bugs or vulnerabilities occur less frequently,
and in some cases such tools are activated in a {\textquotedblleft}softer{\textquotedblright} mode,
without making the build fail. Also, the study reveals that build
breakages due to static analysis tools are quickly fixed by actually
solving the problem, rather than by disabling the warning, and
are often properly documented.},
	keywords = {continuous integration, empirical study, static analysis},
	doi = {10.1109/MSR.2017.2},
	author = {Zampetti, Fiorella and Scalabrino, Simone and Oliveto, Rocco and Canfora, Gerardo and Di Penta, Massimiliano}
}
@proceedings {1911,
	title = {Machine Learning-Based Detection of Open Source License Exceptions},
	year = {2017},
	note = {"We address these questions by first performing a large scale mining-based study... [W]e analyzed the  source code of 51,754 projects written in six different programming languages (Ruby, Javascript, Python, C, C++, and C$\#$) hosted on GitHub. },
	month = {05/2017},
	pages = {118-129},
	abstract = {From a legal perspective, software licenses govern the redistribution, reuse, and modification of software as both source and binary code. Free and Open Source Software (FOSS) licenses vary in the degree to which they are permissive or restrictive in allowing redistribution or modification under licenses different from the original one(s). In certain cases developers may modify the license by appending to it an exception to specifically allow reuse or modification under a particular condition. These exceptions are an important factor to consider for license compliance analysis since they modify the standard (and widely understood_ terms of the original license. In this work, we first perform a large-scale empirical study on the change history of over 51k FOSS systems aimed at quantitatively investigating the prevalence of known license exceptions and identifying new ones. Subsequently, we performed a study on the detection of license exceptions by relying on machine learning. We evaluated the license exception classification with four different supervised learners and sensitivity analysis. Finally we present a categorization of license exceptions and explain their implications.},
	keywords = {classifier, empirical studies, license, machine learning},
	doi = {10.1109/ICSE.2017.19},
	author = {Vendome, Christopher and Mario Linares-Vasquez and Bavota, Gabriele and Di Penta, Massimiliano and Daniel M. German and Poshyvanyk, Denys}
}
@conference {1308,
	title = {Social interactions around cross-system bug fixings},
	booktitle = {Proceedings of the 8th working conference on Mining software repositories - MSR {\textquoteright}11},
	year = {2011},
	note = {"We rely on information stored in versioning database and mailing lists of both systems and develop methods to reconstruct and integrate different historical database"},
	month = {05/2011},
	pages = {143-152},
	publisher = {ACM Press},
	organization = {ACM Press},
	address = {New York, New York, USA},
	abstract = {Cross-system bug fixing propagation is frequent among systems having similar characteristics, using a common framework, or, in general, systems with cloned source code fragments. While previous studies showed that clones tend to be properly maintained within a single system, very little is known about cross-system bug management.

This paper describes an approach to mine explicitly documented cross-system bug fixings, and to relate their occurrences to social characteristics of contributors discussing through the project mailing lists--e.g., degree, betweenness, and brokerage--as well as to the contributors{\textquoteright} activity on source code.

The paper reports results of an empirical study carried out on FreeBSD and OpenBSD kernels. The study shows that the phenomenon of cross-system bug fixing between these two projects occurs often, despite the limited overlap of contributors. The study also shows that cross-system bug fixings mainly involve contributors with the highest degree, betweenness and brokerage level, as well as contributors that change the source code more than others.},
	keywords = {bug fixing, bug tracking system, committers, email, email archives, freebsd, mailing list, openbsd},
	isbn = {9781450305747},
	doi = {10.1145/1985441.1985463},
	author = {Cerulo, Luigi and Cimitile, Marta and Di Penta, Massimiliano and Canfora, Gerardo}
}
@conference {965,
	title = {Identifying licensing of jar archives using a code-search approach},
	booktitle = {2010 7th IEEE Working Conference on Mining Software Repositories (MSR 2010)2010 7th IEEE Working Conference on Mining Software Repositories (MSR 2010)},
	year = {2010},
	pages = {151 - 160},
	publisher = {IEEE},
	organization = {IEEE},
	address = {Cape Town, South Africa},
	abstract = {Free and open source software strongly promotes the reuse of source code. Some open source Java components/libraries are distributed as jar archives only containing the bytecode and some additional information. For whoever wanting to integrate this jar in her own project, it is important to determine the license(s) of the code from which the jar archive was produced, as this affects the way that such component can be used. This paper proposes an automatic approach to determine the license of jar archives, combining the use of a code-search engine with the automatic classification of licenses contained in textual flies enclosed in the jar. Results of an empirical study performed on 37 jars - from 17 different systems - indicate that this approach is able to successfully infer the jar licenses in over 95\% of the cases, but that in many cases the license in textual flies may differ from the one of the classes contained in the jar.},
	keywords = {apache, bytecode, classification, eclipse, google code, jar, java, licenses, source code},
	isbn = {978-1-4244-6802-7},
	doi = {10.1109/MSR.2010.5463282},
	attachments = {https://flosshub.org/sites/flosshub.org/files/151msr2010.pdf},
	author = {Di Penta, Massimiliano and Daniel M. German and Antoniol, Giuliano}
}
