Evidence-based reputation system for developers: automating the evaluation of source quality metrics

Modern software systems are predominantly assembled from third-party libraries and open-source modules, making their reliability and security dependent on the quality of every integrated component. Software integrators, particularly small and medium-sized enterprises, currently lack objective, verifiable mechanisms for evaluating the trustworthiness of the developers behind these components. Existing reputation signals, such as GitHub stars and download counts, reflect popularity rather than technical quality and offer no cryptographic guarantee that reported metrics correspond to actual code. This thesis investigates the feasibility of an evidence-based reputation system for software developers grounded in the automated evaluation of source code quality metrics. The core concept is a Technical Trust Chain in which source code is hashed by a content-derived SHA-256 digest, analysed by an automated static analysis engine, and recorded on a permissioned blockchain (Hyperledger Fabric) with cryptographic integrity guarantees. A central design challenge is the input data integrity problem: the system must ensure that the metrics recorded on the ledger were honestly computed from the code identified by the hash, not fabricated by a dishonest submitter. This is addressed through a multi-party ChainCode endorsement architecture in which each endorsing peer independently fetches, hashes, and analyses the submitted source code, and Fabric's Execute-Order-Validate cycle enforces consistency across peers. The contributions include: a curated selection of three source code quality metrics (Average Cyclomatic Complexity, Source Lines of Code, and Average Coupling Between Objects) evaluated for objectivity, automation feasibility, manipulation resistance, and empirical validity; a Technical Trust Chain implementation that cryptographically links source files to blockchain-anchored metric records through a triple recording scheme comprising a canonical content hash, a Git commit reference, and a SHA-256 hash of the analysis script itself; a three-layer proof-of-concept architecture (off-chain analysis module, Hyperledger Fabric network with CouchDB, REST query interface) deployed on Docker Compose; and a validated adversarial evaluation demonstrating that source file tampering, fabricated metric injection, repository substitution, and tool version mismatches are all detected or prevented by the system. The proof-of-concept is evaluated using real-world open-source Python libraries as test subjects, achieving sub-100-millisecond reputation query latency and 100 percent detection of all tested adversarial scenarios.