Problem: Creating, maintaining and sharing reproducible software is difficult

Problem/Opportunity Statement

Background: Researchers want to create and publish executable versions of their software - let's call these workflows. On CyVerse Atmosphere and Jetstream the most common way of doing this is to manually install and configure packages on a running virtual machine, and then submit an 'imaging request'. An administrator approves these requests. An automated process creates a virtual machine image from the running virtual machine. This image is not a simple snapshot; for privacy and security purposes it also involves 'sanitizing' the virtual machine of log files, SSH keys, and other artifacts.

These virtual machine images rapidly become out of date, and require ongoing security updates. Unless the original creators of the images (workflow packagers) are diligent this results in insecure and/or broken workflows. It also results in a large catalog of low-quality software which can be confusing for users who are looking for a working image containing a certain workflow.

What would success / a fix look like?

Easy for a workflow packager to create executable versions. It is possible to automatically create an up-to-date, executable version of a workflow from a declarative description. It is possible to ensure that a workflow is still functioning as intended. Ideally old snapshots are archived in such a way that it is possible to inspect the differences between versions, and possibly even run an older version (e.g. in case something breaks during an update of a workflow).