Search

The acceleration of software development and delivery requires rigorous continuous testing and deployment of software systems, which are being deployed in increasingly diverse, complex, and dynamic environments. In recent years, the popularization of DevOps and integrated software forges like GitLab and GitHub has largely democratized Continuous Integration (CI) practices for a growing number of software. However, this trend intersects significantly with global energy consumption concerns and the growing demand for frugality in the Information and Communication Technology (ICT) sector. CI pipelines typically run in data centers which contribute significantly to the environmental footprint of ICT, yet there is little information available regarding their environmental impact. This article aims to bridge this gap by conducting the first large-scale analysis of the energy footprint of CI pipelines implemented with GitHub Actions and to provide a first overview of the energy impact of CI. We collect, instrument, and reproduce 838 workflows from 396 Java repositories hosted on GitHub to measure their energy consumption. We observe that the average unitary energy cost of a pipeline is relatively low, at 10 Wh. However, due to repeated invocations of these pipelines in real settings, the aggregated energy consumption cost per project is high, averaging 22 kWh. When evaluating CO2 emissions based on regional Wh-to-CO2 estimates, we observe that the average aggregated CO2 emissions are significant, averaging 10.5 kg. To put this into perspective, this is akin to the emissions produced by driving approximately 100 kilometers in a typical European car (110 gCO2/km). In light of our results, we advocate that developers should have the means to better anticipate and reflect on the environmental consequences of their CI choices when implementing DevOps practices., Comment: This paper is currently under review by Communication of the ACM

Decomposing large systems into smaller components with limited privileges has long been recognized as an effective means to minimize the impact of exploits. Despite historical roots, demonstrated benefits, and a plethora of research efforts in academia and industry, the compartmentalization of software is still not a mainstream practice. This paper investigates why, and how this status quo can be improved. Noting that existing approaches are fraught with inconsistencies in terminology and analytical methods, we propose a unified model for the systematic analysis, comparison, and directing of compartmentalization approaches. We use this model to review 211 research efforts and analyze 61 mainstream compartmentalized systems, confronting them to understand the limitations of both research and production works. Among others, our findings reveal that mainstream efforts largely rely on manual methods, custom abstractions, and legacy mechanisms, poles apart from recent research. We conclude with recommendations: compartmentalization should be solved holistically; progress is needed towards simplifying the definition of compartmentalization policies; towards better challenging our threat models in the light of confused deputies and hardware limitations; as well as towards bridging the gaps we pinpoint between research and mainstream needs. This paper not only maps the historical and current landscape of compartmentalization, but also sets forth a framework to foster their evolution and adoption., Comment: Accepted to appear in the 46th IEEE Symposium on Security and Privacy (S&P'25)

Let $G$ be a compact Lie group. We introduce a semiclassical framework, called Borel-Weil calculus, to investigate $G$-equivariant (pseudo)differential operators acting on $G$-principal bundles over closed manifolds. In this calculus, the semiclassical parameters correspond to the highest roots in the Weyl chamber of the group $G$ that parametrize irreducible representations, and operators are pseudodifferential in the base variable, with values in Toeplitz operators on the flag manifold associated to the group. This monograph unfolds two main applications of our calculus. Firstly, in the realm of dynamical systems, we obtain explicit sufficient conditions for rapid mixing of volume-preserving partially hyperbolic flows obtained as extensions of an Anosov flow to a $G$-principal bundle (for an arbitrary $G$). In particular, when $G = \mathrm{U}(1)$, we prove that the flow on the extension is rapid mixing whenever the Anosov flow is not jointly integrable, and the circle bundle is not torsion. When $G$ is semisimple, we prove that ergodicity of the extension is equivalent to rapid mixing. Secondly, we study the spectral theory of sub-elliptic Laplacians obtained as horizontal Laplacians of a $G$-equivariant connection on a principal bundle. When $G$ is semisimple, we prove that the horizontal Laplacian is globally hypoelliptic as soon as the connection has a dense holonomy group in $G$. Notably, this result encompasses all flat bundles with a dense monodromy group in $G$. We also prove a quantum ergodicity result for flat (and in some situations non-flat) principal bundles under a suitable ergodicity assumption. We believe that this monograph will serve as a cornerstone for future investigations applying the Borel-Weil calculus across different fields., Comment: v1: 178 pages, 2 figures; v2: 186 pages, added Theorem 5.1.10

Supporting mainstream applications is fundamental for a new OS to have impact. It is generally achieved by developing a layer of compatibility allowing applications developed for a mainstream OS like Linux to run unmodified on the new OS. Building such a layer, as we show, results in large engineering inefficiencies due to the lack of efficient methods to precisely measure the OS features required by a set of applications. We propose Loupe, a novel method based on dynamic analysis that determines the OS features that need to be implemented in a prototype OS to bring support for a target set of applications and workloads. Loupe guides and boosts OS developers as they build compatibility layers, prioritizing which features to implement in order to quickly support many applications as early as possible. We apply our methodology to 100+ applications and several OSes currently under development, demonstrating high engineering effort savings vs. existing approaches: for example, for the 62 applications supported by the OSv kernel, we show that using Loupe, would have required implementing only 37 system calls vs. 92 for the non-systematic process followed by OSv developers. We study our measurements and extract novel key insights. Overall, we show that the burden of building compatibility layers is significantly less than what previous works suggest: in some cases, only as few as 20% of system calls reported by static analysis, and 50% of those reported by naive dynamic analysis need an implementation for an application to successfully run standard benchmarks., Comment: Accepted to appear at ASPLOS'24 (https://www.asplos-conference.org/asplos2024/)

Compartmentalization is a form of defensive software design in which an application is broken down into isolated but communicating components. Retrofitting compartmentalization into existing applications is often thought to be expensive from the engineering effort and performance overhead points of view. Still, recent years have seen proposals of compartmentalization methods with promises of low engineering efforts and reduced performance impact. ARM Morello combines a modern ARM processor with an implementation of Capability Hardware Enhanced RISC Instructions (CHERI) aiming to provide efficient and secure compartmentalization. Past works exploring CHERI-based compartmentalization were restricted to emulated/FPGA prototypes. In this paper, we explore possible compartmentalization schemes with CHERI on the Morello chip. We propose two approaches representing different trade-offs in terms of engineering effort, security, scalability, and performance impact. We describe and implement these approaches on a prototype OS running bare metal on the Morello chip, compartmentalize two popular applications, and investigate the performance overheads. Furthermore, we show that compartmentalization can be achieved with an engineering cost that can be quite low if one is willing to trade off on scalability and security, and that performance overheads are similar to other intra-address space isolation mechanisms., Comment: 12th Workshop on Programming Languages and Operating Systems (PLOS 2023)

Obtaining a relevant dataset is central to conducting empirical studies in software engineering. However, in the context of mining software repositories, the lack of appropriate tooling for large scale mining tasks hinders the creation of new datasets. Moreover, limitations related to data sources that change over time (e.g., code bases) and the lack of documentation of extraction processes make it difficult to reproduce datasets over time. This threatens the quality and reproducibility of empirical studies. In this paper, we propose a tool-supported approach facilitating the creation of large tailored datasets while ensuring their reproducibility. We leveraged all the sources feeding the Software Heritage append-only archive which are accessible through a unified programming interface to outline a reproducible and generic extraction process. We propose a way to define a unique fingerprint to characterize a dataset which, when provided to the extraction process, ensures that the same dataset will be extracted. We demonstrate the feasibility of our approach by implementing a prototype. We show how it can help reduce the limitations researchers face when creating or reproducing datasets.

Let $\Sigma$ be a smooth compact connected oriented surface with boundary. A metric on $\Sigma$ is said to be of Anosov type if it has strictly convex boundary, no conjugate points, and a hyperbolic trapped set. We prove that two metrics of Anosov type with the same marked boundary distance are isometric (via a boundary-preserving isometry isotopic to the identity). As a corollary, we retrieve the boundary distance rigidity result for simple disks of Pestov and Uhlmann [arXiv:math/0305280]. The proof rests on a new transfer principle showing that, in any dimension, the marked length spectrum rigidity conjecture implies the marked boundary distance rigidity conjecture under the existence of a suitable isometric embedding into a closed Anosov manifold. Such an isometric embedding result for open surfaces of Anosov type was proved by the first author with Chen and Gogolev in [arXiv:2009.13665] while the marked length spectrum rigidity for closed Anosov surfaces was established by the second author with Guillarmou and Paternain in [arXiv:2303.12007]., Comment: 22 pages, 2 figures. To appear in Mathematische Zeitschrift

The aim of this note is to establish the correspondence between the twisted localized Pestov identity on the unit tangent bundle of a Riemannian manifold and the Weitzenb\"ock identity for twisted symmetric tensors on the manifold., Comment: 22 pages. v2: added some references

Let $\Sigma$ be a smooth closed oriented surface of genus $\geq 2$. We prove that two metrics on $\Sigma$ with the same marked length spectrum and Anosov geodesic flow are isometric via an isometry isotopic to the identity. The proof combines microlocal tools with the geometry of complex curves., Comment: v2: We correct and simplify the proof of Lemma 3.11. v3: Added a corollary on the centralizer of Anosov geodesic flows. v4: Revision after referee process. To appear in Duke Mathematical Journal. 22 pages, 1 figure

On a Riemannian manifold $(M, g)$ with Anosov geodesic flow, the problem of recovering a connection from the knowledge of traces of its holonomies along primitive closed geodesics is known as the holonomy inverse problem. In this paper, we prove H\"older type stability estimates for this inverse problem: 1) locally, near generic connections; 2) globally, for line bundles, and for vector bundles satisfying a certain low-rank assumption over negatively curved base $(M, g)$. The proofs are based on a combination of microlocal analysis along with a new non-Abelian approximate Livsic Theorem in hyperbolic dynamics., Comment: 41 pages, 1 figure

The purpose of this paper is to study transport equations on the unit tangent bundle of closed oriented Riemannian surfaces and to connect these to the transport twistor space of the surface (a complex surface naturally tailored to the geodesic vector field). We show that fibrewise holomorphic distributions invariant under the geodesic flow - which play an important role in tensor tomography on surfaces - form a unital algebra, that is, multiplication of such distributions is well-defined and continuous. We also exhibit a natural bijective correspondence between fibrewise holomorphic invariant distributions and genuine holomorphic functions on twistor space with polynomial blowup on the boundary of the twistor space. Eventually, when the surface is Anosov, we classify holomorphic line bundles over twistor space which are smooth up to the boundary. As a byproduct of our analysis, we obtain a quantitative version of a result of Flaminio, asserting that invariant distributions of the geodesic flow of a positively-curved metric on the 2-sphere are determined by their zeroth and first Fourier modes., Comment: An error in Table 1 has been corrected. Some typos have been fixed. Examples have been added to the appendix

Let $(M,g,J)$ be a closed K\"ahler manifold with negative sectional curvature and complex dimension $m := \dim_{\mathbb{C}} M \geq 2$. In this article, we study the unitary frame flow, that is, the restriction of the frame flow to the principal $\mathrm{U}(m)$-bundle $F_{\mathbb{C}}M$ of unitary frames. We show that if $m \geq 6$ is even, and $m \neq 28$, there exists $\lambda(m) \in (0, 1)$ such that if $(M, g, J)$ has negative $\lambda(m)$-pinched holomorphic sectional curvature, then the unitary frame flow is ergodic and mixing. The constants $\lambda(m)$ satisfy $\lambda(6) = 0.9330...$, $\lim_{m \to +\infty} \lambda(m) = \tfrac{11}{12} = 0.9166...$, and $m \mapsto \lambda(m)$ is decreasing. This extends to the even-dimensional case the results of Brin-Gromov who proved ergodicity of the unitary frame flow on negatively-curved compact K\"ahler manifolds of odd complex dimension.

Least-privilege separation decomposes applications into compartments limited to accessing only what they need. When compartmentalizing existing software, many approaches neglect securing the new inter-compartment interfaces, although what used to be a function call from/to a trusted component is now potentially a targeted attack from a malicious compartment. This results in an entire class of security bugs: Compartment Interface Vulnerabilities (CIVs). This paper provides an in-depth study of CIVs. We taxonomize these issues and show that they affect all known compartmentalization approaches. We propose ConfFuzz, an in-memory fuzzer specialized to detect CIVs at possible compartment boundaries. We apply ConfFuzz to a set of 25 popular applications and 36 possible compartment APIs, to uncover a wide data-set of 629 vulnerabilities. We systematically study these issues, and extract numerous insights on the prevalence of CIVs, their causes, impact, and the complexity to address them. We stress the critical importance of CIVs in compartmentalization approaches, demonstrating an attack to extract isolated keys in OpenSSL and uncovering a decade-old vulnerability in sudo. We show, among others, that not all interfaces are affected in the same way, that API size is uncorrelated with CIV prevalence, and that addressing interface vulnerabilities goes beyond writing simple checks. We conclude the paper with guidelines for CIV-aware compartment interface design, and appeal for more research towards systematic CIV detection and mitigation., Comment: Accepted to appear in NDSS'23

We give an analytic description for the infinitesimal generator constructed by Applebaum-Estrade for L\'evy flights on a broad class of closed Riemannian manifolds including all negatively-curved manifolds, the flat torus and the sphere. Various properties of the associated semigroup and the asymptotics of the expected stopping time for L\'evy flight based random searches for small targets, also known as the narrow capture problem, are then obtained using our newfound understanding of the infinitesimal generator. Our study also relates to the L\'evy flight foraging hypothesis in the field of biology as we compute the expected time for finding a small target by using the L\'evy flight random search. A similar calculation for Brownian motion on surfaces was done in [arXiv:2209.12425]., Comment: 40 pages

We show that on closed negatively curved Riemannian manifolds with simple length spectrum, the spectrum of the Bochner Laplacian determines both the isomorphism class of the vector bundle and the connection up to gauge under a low-rank assumption. We also show that flows of frames on low-rank frame bundles extending the geodesic flow in negative curvature are ergodic whenever the bundle admits no holonomy reduction. This is achieved by exhibiting a link between these problems and the classification of polynomial maps between spheres in real algebraic geometry., Comment: 26 pages; incorporated reviewer comments in v3; accepted in Annales scientifiques de l'\'Ecole normale sup\'erieure

We report on some recent progress achieved in [arXiv:2111.14811] on the ergodicity of the frame flow of negatively-curved Riemannian manifolds. We explain the new ideas leading to ergodicity for nearly $0.25$-pinched manifolds and give perspectives for future work., Comment: 14 pages, 2 figures

The lens data of a Riemannian manifold with boundary is the collection of lengths of geodesics with endpoints on the boundary together with their incoming and outgoing vectors. We show that negatively-curved Riemannian manifolds with strictly convex boundary are locally lens rigid in the following sense: if $g_0$ is such a metric, then any metric $g$ sufficiently close to $g_0$ and with same lens data is isometric to $g_0$, up to a boundary-preserving diffeomorphism. More generally, we consider the same problem for a wider class of metrics with strictly convex boundary, called metrics of Anosov type. We prove that the same rigidity result holds within that class in dimension $2$ and in any dimension, further assuming that the curvature is non-positive., Comment: Last version after revision. Typos corrected and some proofs are more detailed

At design time, modern operating systems are locked in a specific safety and isolation strategy that mixes one or more hardware/software protection mechanisms (e.g. user/kernel separation); revisiting these choices after deployment requires a major refactoring effort. This rigid approach shows its limits given the wide variety of modern applications' safety/performance requirements, when new hardware isolation mechanisms are rolled out, or when existing ones break. We present FlexOS, a novel OS allowing users to easily specialize the safety and isolation strategy of an OS at compilation/deployment time instead of design time. This modular LibOS is composed of fine-grained components that can be isolated via a range of hardware protection mechanisms with various data sharing strategies and additional software hardening. The OS ships with an exploration technique helping the user navigate the vast safety/performance design space it unlocks. We implement a prototype of the system and demonstrate, for several applications (Redis/Nginx/SQLite), FlexOS' vast configuration space as well as the efficiency of the exploration technique: we evaluate 80 FlexOS configurations for Redis and show how that space can be probabilistically subset to the 5 safest ones under a given performance budget. We also show that, under equivalent configurations, FlexOS performs similarly or better than several baselines/competitors., Comment: Artifact Evaluation Repository: https://github.com/project-flexos/asplos22-ae

We revisit the classical framework developed by Brin, Pesin and others to study ergodicity and mixing properties of isometric extensions of volume-preserving Anosov flows, using the microlocal framework developed in the theory of Pollicott-Ruelle resonances. The approach developed in the present note is reinvested in the companion paper [arXiv:2111.14811] in order to show ergodicity of the frame flow on negatively-curved Riemannian manifolds under nearly $1/4$-pinched curvature assumption (resp. nearly $1/2$-pinched) in dimension $4$ and $4\ell+2, \ell > 0$ (resp. dimension $4\ell, \ell > 0$)., Comment: v2: Revision after referee process. 31 pages

It is known that the frame flow on a closed $n$-dimensional Riemannian manifold with negative sectional curvature is ergodic if $n$ is odd and $n \neq 7$. In this paper we study its ergodicity in the remaining cases. For $n$ even and $n \neq 8, 134$, we show that: if $n \equiv 2$ mod $4$ or $n=4$, the frame flow is ergodic if the manifold is $\sim 0.3$-pinched, if $n \equiv 0$ mod $4$, it is ergodic if the manifold is $\sim 0.6$-pinched. In the three dimensions $n=7,8,134$, the respective pinching bounds that we need in order to prove ergodicity are $0.4962...$, $0.6212...$, and $0.5788...$. This is a significant improvement over the previously known results and a step forward towards solving a long-standing conjecture of Brin asserting that $0.25$-pinched even-dimensional manifolds have an ergodic frame flow., Comment: 36 pages, 1 figure; new version containing an improvement of the pinching bound in dimension 134, using some general result about the Fourier degree of sections of vector bundles over the sphere; final version incorporating comments of the referees, accepted in Inventiones Mathematicae

Several recent studies on dyadic human-human interactions have been done on conversations without specific business objectives. However, many companies might benefit from studies dedicated to more precise environments such as after sales services or customer satisfaction surveys. In this work, we place ourselves in the scope of a live chat customer service in which we want to detect emotions and their evolution in the conversation flow. This context leads to multiple challenges that range from exploiting restricted, small and mostly unlabeled datasets to finding and adapting methods for such context.We tackle these challenges by using Few-Shot Learning while making the hypothesis it can serve conversational emotion classification for different languages and sparse labels. We contribute by proposing a variation of Prototypical Networks for sequence labeling in conversation that we name ProtoSeq. We test this method on two datasets with different languages: daily conversations in English and customer service chat conversations in French. When applied to emotion classification in conversations, our method proved to be competitive even when compared to other ones.

In dimensions $\geq 3$, we prove that the X-ray transform of symmetric tensors of arbitrary degree is generically injective with respect to the metric on closed Anosov manifolds and on manifolds with spherical strictly convex boundary, no conjugate points and a hyperbolic trapped set. This has two immediate corollaries: local spectral rigidity, and local marked length spectrum rigidity (building on earlier work by Guillarmou, Knieper and the second author [arXiv:1806.04218], [arXiv:1909.08666]), in a neighbourhood of a generic Anosov metric. In both cases, this is the first work going beyond the negatively curved assumption or dimension $2$. Our method, initiated in [arXiv:2008.09191] and fully developed in the present paper, is based on a perturbative argument of the $0$-eigenvalue of elliptic operators via microlocal analysis which turn the analytic problem of injectivity into an algebraic problem of representation theory. When the manifold is equipped with a Hermitian vector bundle together with a unitary connection, we also show that the twisted X-ray transform of symmetric tensors (with values in that bundle) is generically injective with respect to the connection. This property turns out to be crucial when solving the $\textit{holonomy inverse problem}$, as studied in a subsequent article [arXiv:2105.06376]., Comment: 63 pages, 1 figure; revised according to referee comments; accepted in Journal of Differential Geometry

Let $(M,g)$ be a smooth Anosov Riemannian manifold and $\mathcal{C}^\sharp$ the set of its primitive closed geodesics. Given a Hermitian vector bundle $\mathcal{E}$ equipped with a unitary connection $\nabla^{\mathcal{E}}$, we define $\mathcal{T}^\sharp(\mathcal{E}, \nabla^{\mathcal{E}})$ as the sequence of traces of holonomies of $\nabla^{\mathcal{E}}$ along elements of $\mathcal{C}^\sharp$. This descends to a homomorphism on the additive moduli space $\mathbb{A}$ of connections up to gauge $\mathcal{T}^\sharp: (\mathbb{A}, \oplus) \to \ell^\infty(\mathcal{C}^\sharp)$, which we call the $\textit{primitive trace map}$. It is the restriction of the well-known $\textit{Wilson loop}$ operator to primitive closed geodesics. The main theorem of this paper shows that the primitive trace map $\mathcal{T}^\sharp$ is locally injective near generic points of $\mathbb{A}$ when $\dim(M) \geq 3$. We obtain global results in some particular cases: flat bundles, direct sums of line bundles, and general bundles in negative curvature under a spectral assumption which is satisfied in particular for connections with small curvature. As a consequence of the main theorem, we also derive a spectral rigidity result for the connection Laplacian. The proofs are based on two new ingredients: a Liv\v{s}ic-type theorem in hyperbolic dynamical systems showing that the cohomology class of a unitary cocycle is determined by its trace along closed primitive orbits, and a theorem relating the local geometry of $\mathbb{A}$ with the Pollicott-Ruelle resonance near zero of a certain natural transport operator., Comment: 59 pages, 5 figures; implemented revision; to appear in JEMS

Unikernels are famous for providing excellent performance in terms of boot times, throughput and memory consumption, to name a few metrics. However, they are infamous for making it hard and extremely time consuming to extract such performance, and for needing significant engineering effort in order to port applications to them. We introduce Unikraft, a novel micro-library OS that (1) fully modularizes OS primitives so that it is easy to customize the unikernel and include only relevant components and (2) exposes a set of composable, performance-oriented APIs in order to make it easy for developers to obtain high performance. Our evaluation using off-the-shelf applications such as nginx, SQLite, and Redis shows that running them on Unikraft results in a 1.7x-2.7x performance improvement compared to Linux guests. In addition, Unikraft images for these apps are around 1MB, require less than 10MB of RAM to run, and boot in around 1ms on top of the VMM time (total boot time 3ms-40ms). Unikraft is a Linux Foundation open source project and can be found at www.unikraft.org., Comment: 19 pages, 22 figures, 7 tables, conference proceedings

The SNO+ experiment is located 2 km underground at SNOLAB in Sudbury, Canada. A low background search for neutrinoless double beta ($0\nu\beta\beta$) decay will be conducted using 780 tonnes of liquid scintillator loaded with 3.9 tonnes of natural tellurium, corresponding to 1.3 tonnes of $^{130}$Te. This paper provides a general overview of the SNO+ experiment, including detector design, construction of process plants, commissioning efforts, electronics upgrades, data acquisition systems, and calibration techniques. The SNO+ collaboration is reusing the acrylic vessel, PMT array, and electronics of the SNO detector, having made a number of experimental upgrades and essential adaptations for use with the liquid scintillator. With low backgrounds and a low energy threshold, the SNO+ collaboration will also pursue a rich physics program beyond the search for $0\nu\beta\beta$ decay, including studies of geo- and reactor antineutrinos, supernova and solar neutrinos, and exotic physics such as the search for invisible nucleon decay. The SNO+ approach to the search for $0\nu\beta\beta$ decay is scalable: a future phase with high $^{130}$Te-loading is envisioned to probe an effective Majorana mass in the inverted mass ordering region., Comment: 61 pages, 23 figures, 4 tables