Patent ID: 8838964

Claim:
A method comprising: receiving, by a processing device, user input that identifies a software package to be included in a software product release, wherein the software package comprises a plurality of files; importing the identified package into a package audit tool executed by the processing device; validating that the imported package complies with a requirement specifying a type of external source used for the software product release using the package audit tool; tracking, by the package audit tool, information about the software package after being imported in a package database; and determining, by the package audit tool, subsequent changes to the software package after being imported using the tracked information stored in the package database, wherein said determining the subsequent changes comprises: unpacking a source tree of each of the software packages; checking the files in the source tree to determine if at least one of the files is in a certification list; comparing a version of a file from the plurality of files with a file in the source tree to detect a difference between versions; flagging a first error indicating the difference in response to a file in the certification list; and flagging a second error indicating that the file is not on the certification list in response to a file not in the certification list.