Open Source Software (OSS) libraries form the backbone of modern software systems, yet their long-term sustainability often depends on maintainers being reachable for support, coordination, and security reporting. In this paper, we empirically analyze the availability of contact information - specifically e-mail addresses - across 686,034 Python libraries on the Python Package Index (PyPI) and their associated GitHub repositories. We examine how and where maintainers provide this information, assess its validity, and explore coverage across individual libraries and their dependency chains. Our findings show that 81.6% of libraries include at least one valid e-mail address, with PyPI serving as the primary source (79.5%). When analyzing dependency chains, we observe that up to 97.8% of direct and 97.7% of transitive dependencies provide valid contact information. At the same time, we identify over 698,000 invalid entries, primarily due to missing fields. These results demonstrate strong maintainer reachability across the ecosystem, while highlighting opportunities for improvement - such as offering clearer guidance to maintainers during the packaging process and introducing opt-in validation mechanisms for existing e-mail addresses.
翻译:开源软件(OSS)库构成了现代软件系统的支柱,但其长期可持续性往往依赖于维护者可被联系以获取支持、协调和安全报告。本文通过实证分析,研究了Python包索引(PyPI)上686,034个Python库及其关联GitHub仓库中联系信息(特别是电子邮件地址)的可用性。我们考察了维护者提供此类信息的方式和位置,评估其有效性,并探究了单个库及其依赖链中的覆盖情况。研究结果表明,81.6%的库至少包含一个有效电子邮件地址,其中PyPI为主要来源(79.5%)。在分析依赖链时,我们观察到高达97.8%的直接依赖和97.7%的传递依赖提供了有效联系信息。同时,我们识别出超过698,000条无效条目,主要原因为字段缺失。这些结果证明了整个生态系统中维护者可达性较强,同时也指出了改进空间——例如在打包过程中为维护者提供更清晰的指导,并为现有电子邮件地址引入选择性验证机制。