Software Supply Chain attacks are becoming more frequent. It is not enough to trust the source code of a project; the build process can insert malicious contents into build artefacts. This calls for the need of valid verification methods regarding the build process, and a good way of doing so is ensuring that the build process is deterministic. This means, that given two binaries built from the same source code and in the same environment, the resulting build artefacts should be bit-wise identical. There are existing tools that check this, but they are not integrated into build systems. This thesis resulted in an extension of GNU make which is called rmake, where diffoscope - a tool for detecting differences between a large number of file types - was integrated into the workflow of make. rmake was later used to answer the posed research questions for this thesis. We found that different build paths and offsets are a big problem as three out of three tested Free and Open Source Software projects all contained these variations. The results also showed that gcc’s optimisation levels did not affect reproducibility, but link-time optimisation embeds a lot of unreproducible information in build artefacts. Lastly, the results showed that build paths, build ID’s and randomness are the three most common groups of variations encountered in the wild and potential solutions for some variations were proposed.

Today there is a heavy integration of information technology in almost every aspect of our lives and there is an increase in computer security that goes with it. To ensure this security, and that policies and procedures within an organisations related to this security are enforced; security audits are conducted. At the same time, use of open source software is also becoming increasingly common, becoming more a fact of life rather than an option. With these two trends in mind, this study analyses a selection of scientific literature on the topic and identifies the unique challenges a security audit in an open source environment faces, and aims to contribute on how to help alleviate the challenges. The study was performed in the form of a literature review, where the comparison and analysis revealed interesting information regarding the open source specific challenges, including both technical issues as well as challenges stemming from people’s perception and handling of open source software today. The answer to the question “What are the challenges when conducting security audits for open source systems and how can they be alleviated?” shows the main challenges to be too much trust is put in unverified binaries. The report offers suggestions and ideas on how to implement solutions in order to help diminish this challenge through the use and integration of Reproducible Builds, answering the second part of the question.

No description available.

Submitted by Evaldo Araújo (1107795@mackenzie.br) on 2016-06-07T00:47:19Z No. of bitstreams: 1 Paulo Canguçu Fraga Burgo.pdf: 100367880 bytes, checksum: 53e6d8967ab1a3e86a3cee9355a301df (MD5) / Rejected by Paola Damato (repositorio@mackenzie.br), reason: Evaldo, favor verificar o e-mail com os itens para revisão e me enviar novamente. Obrigada !! on 2016-06-07T12:46:01Z (GMT) / Submitted by Evaldo Araújo (1107795@mackenzie.br) on 2016-06-07T22:17:11Z No. of bitstreams: 1 Paulo Canguçu Fraga Burgo.pdf: 26648876 bytes, checksum: fb8b54d59e728918d63403f293517b32 (MD5) / Approved for entry into archive by Paola Damato (repositorio@mackenzie.br) on 2016-06-08T13:32:38Z (GMT) No. of bitstreams: 1 Paulo Canguçu Fraga Burgo.pdf: 26648876 bytes, checksum: fb8b54d59e728918d63403f293517b32 (MD5) / Approved for entry into archive by Paola Damato (repositorio@mackenzie.br) on 2016-06-08T13:34:40Z (GMT) No. of bitstreams: 1 Paulo Canguçu Fraga Burgo.pdf: 26648876 bytes, checksum: fb8b54d59e728918d63403f293517b32 (MD5) / Made available in DSpace on 2016-06-08T13:35:01Z (GMT). No. of bitstreams: 1 Paulo Canguçu Fraga Burgo.pdf: 26648876 bytes, checksum: fb8b54d59e728918d63403f293517b32 (MD5) Previous issue date: 2015-08-06 / Instituto Presbiteriano Mackenzie / Day after day we have been surprised by the amount of images that we absorb, even though those images are not analyzed carefully. All means of communication bring to our eyes hundreds of photographs, not simply in the physical sense but also through the world wide web, and reveal us several points of view. Among all the environments designed by the human being, the architecture is shown as the main element, not just as a background but as a remarkable object in the scenery, supplementing significance around. Since the first industrial revolution, acting as principal method of displaying the area, the photograph brings to the viewer the interpretation of what is externally real, allowing a better visualization of the big picture that the author wants to show. One of the biggest landmarks of architectural photograph and for Latin architecture, the book Brazil Builds, published in 1942, presents itself as a milestone for the marketing of the Modern Brazilian Architecture, and, with this magnitude, affects the generations since then. This work presents a discussion about the importance of the images in the book Brazil Builds, historical and technical context. Bearing in mind the relevance of Ministry of education and health’s build for the context of the Modern Brazilian Architecture, among the works in the book , the photographs that presents their project becomes the main object in the study. With analysis based in historical concepts, technical characteristics of the machines, photograph proceedings in that time, and graphic analysis that follow the concept of Gestalt, our work highlight the visual organization of the images, your current matching to the proposed objectives in the publication. / Cada dia mais somos surpreendidos por uma quantidade de imagens as que consumimos, ainda que pouco analisadas. Os meios de comunicação trazem a nossos olhos centenas de fotografias através de publicações físicas ou de ambientes digitais que revelam inúmeras visões de mundo. Dos espaços concebidos pelo ser humano, a arquitetura se mostra como um dos principais elementos, não apenas aparecendo como “pano de fundo”, mas como objeto marcante na paisagem, produzindo significados junto a seu entorno. Desde a primeira Revolução Industrial, agindo como principal método de divulgação da visualização do espaço, a fotografia traz para o observador a leitura do que é aparentemente real, possibilitando um conteúdo mais coerente com toda a intencionalidade do autor. Um dos grandes marcos da fotografia de arquitetura e para arquitetura latina, o livro Brazil Builds, publicado em 1942, se apresenta como um marco da divulgação da arquitetura moderna brasileira, e, com esta significância, vem influenciando as gerações desde então. O presente trabalho apresenta uma discussão sobre a importância das imagens do livro Brazil Builds, seu contexto histórico e técnico. Tendo em vista a relevância do edifício do Ministério da Educação e Saúde para o contexto da arquitetura moderna brasileira, dentre as obras apresentadas no livro, as fotografias que apresentam seu projeto e se tornam o objeto principal da análise. Com investigações baseadas em conceitos históricos, nas características técnicas das máquinas e dos processos fotográficos da época, e nas análises gráficas que seguem os conceitos da Gestalt, nosso trabalho objetiva destacar a organização visual das imagens, sua manifesta adequação aos objetivos propostos pela publicação.

This thesis aims to uncover anomalies in the data describing the performance behavior of a "robot controller" as measured by software metrics. The purpose of analyzing data is mainly to identify the changes that have resulted in different performance behaviors which we refer to as performance anomalies. To address this issue, two separate pre-processing approaches have been developed: one that adds the principal component to the data after cleaning steps and another that does not regard the principal component. Next, Isolation Forest is employed, which uses an ensemble of isolation trees for data points to segregate anomalies and generate scores that can be used to discover anomalies. Further, in order to detect anomalies, the highest distances matching cluster centroids are employed in the clustering procedure. These two data preparation methods, along with two anomaly detection algorithms, identified software builds that are very likely to be anomalies. According to an industrial evaluation conducted based on engineers’ domain knowledge, around 70% of the detected software builds as anomalous builds were successfully identified, indicating system variable deviations or software bugs.

O trabalho analisa como a produção arquitetônica e a atuação política de quatro engenheiros contribuiu para o processo de modernização espacial da cidade de Campinas nas décadas de 1930 e 1940. O período estudado coincide com o momento de elaboração e implantação do Plano de Melhoramentos Urbanos, desenvolvido pelo urbanista Prestes Maia, sob encomenda do poder municipal. Entre o grupo restrito de atores envolvidos no projeto de modernização da cidade, destacou-se a participação dos engenheiros Eduardo Badaró, Hoche Néger Segurado, Lix da Cunha e Mário Penteado. O primeiro, funcionário da prefeitura, foi responsável pela implantação do plano, e os demais representavam os escritórios de engenharia mais operosos da cidade. Estuda a forma como a produção arquitetônica desses engenheiros foi realizada e investiga os fatores envolvidos no processo de sua constituição: referências artísticas e conceituais influenciadas pelos ecos tardios do embate teórico entre modernos e acadêmicos, travado nas primeiras décadas do século XX e que motivou engenheiros e arquitetos na busca por novos paradigmas inspirados nas vanguardas europeias; os meios materiais tendo no concreto armado um novo definidor do sistema construtivo; a herança das formações acadêmicas distintas; os jogos econômicos atrelados à industrialização da cidade; as estratégias políticas para a legitimação da implantação do plano de modernização urbana; as ações dos recém-fundados órgãos de classe no processo de afirmação da categoria profissional e, por fim, as demandas e aspirações de suas clientelas. Ao abordar as circunstâncias que envolveram a transformação do espaço urbano, tendo como corresponsáveis esses profissionais, a investigação dá ensejo a uma reflexão sobre ideias de modernidade que ultrapassam o campo das artes, que não obedecem a uma linha evolutiva homogênea e, sobretudo, que reconhecem a existência de várias categorias arquitetônicas, representantes das muitas correntes envolvidas em um processo de modernização mulltifacetado. / This paper analyses how the architectural production and political action of four engineers contributed to the spatial modernization process of the city of Campinas in the 1930s and 1940s. The studied period coincides with the time of the preparation and implementation of the Urban Improvement Plan, developed by the urban planner Prestes Maia and commissioned by the municipal power. Among the group of professionals involved in the modernization project of the city, the participation of the engineers Eduardo Badaró, Hoche Neger Segurado, Lix da Cunha and Mario Penteado stood out. The first engineer, who worked for the city hall, was responsible for implementing the plan, and the other engineers represented the most distinguished architecture offices in the city. It is of great interest to understand how the architectural production of these engineers was carried outand investigate the factors involved in its creation: conceptual and artistic references influenced by the late echoes of the clash between modern and academic in the early decades of the twentieth century that motivated engineers and architects in the search for new paradigms inspired by the European avant-gardes; the material resources having in the reinforced concrete a new determinant in the construction system; the inheritance of different academic backgrounds; the economic relations closely related to the industrialization of the city; the political strategies for the legitimation of the implementation of the urban modernization plan; the actions of the newly founded professional entities in the process of assertion of the professional category, and finally, the demands and aspirations of their clientele. By addressing the circumstances surrounding the transformation of the urban space, having these professionals as mutually responsible for all these changes, the investigation brings up a reflection on an idea of modernity that goes beyond the arts, does not follow a smooth evolutionary path and, above all, that recognizes the existence of various architectural categories, representing many streams of a multifaceted modernity.

O trabalho analisa como a produção arquitetônica e a atuação política de quatro engenheiros contribuiu para o processo de modernização espacial da cidade de Campinas nas décadas de 1930 e 1940. O período estudado coincide com o momento de elaboração e implantação do Plano de Melhoramentos Urbanos, desenvolvido pelo urbanista Prestes Maia, sob encomenda do poder municipal. Entre o grupo restrito de atores envolvidos no projeto de modernização da cidade, destacou-se a participação dos engenheiros Eduardo Badaró, Hoche Néger Segurado, Lix da Cunha e Mário Penteado. O primeiro, funcionário da prefeitura, foi responsável pela implantação do plano, e os demais representavam os escritórios de engenharia mais operosos da cidade. Estuda a forma como a produção arquitetônica desses engenheiros foi realizada e investiga os fatores envolvidos no processo de sua constituição: referências artísticas e conceituais influenciadas pelos ecos tardios do embate teórico entre modernos e acadêmicos, travado nas primeiras décadas do século XX e que motivou engenheiros e arquitetos na busca por novos paradigmas inspirados nas vanguardas europeias; os meios materiais tendo no concreto armado um novo definidor do sistema construtivo; a herança das formações acadêmicas distintas; os jogos econômicos atrelados à industrialização da cidade; as estratégias políticas para a legitimação da implantação do plano de modernização urbana; as ações dos recém-fundados órgãos de classe no processo de afirmação da categoria profissional e, por fim, as demandas e aspirações de suas clientelas. Ao abordar as circunstâncias que envolveram a transformação do espaço urbano, tendo como corresponsáveis esses profissionais, a investigação dá ensejo a uma reflexão sobre ideias de modernidade que ultrapassam o campo das artes, que não obedecem a uma linha evolutiva homogênea e, sobretudo, que reconhecem a existência de várias categorias arquitetônicas, representantes das muitas correntes envolvidas em um processo de modernização mulltifacetado. / This paper analyses how the architectural production and political action of four engineers contributed to the spatial modernization process of the city of Campinas in the 1930s and 1940s. The studied period coincides with the time of the preparation and implementation of the Urban Improvement Plan, developed by the urban planner Prestes Maia and commissioned by the municipal power. Among the group of professionals involved in the modernization project of the city, the participation of the engineers Eduardo Badaró, Hoche Neger Segurado, Lix da Cunha and Mario Penteado stood out. The first engineer, who worked for the city hall, was responsible for implementing the plan, and the other engineers represented the most distinguished architecture offices in the city. It is of great interest to understand how the architectural production of these engineers was carried outand investigate the factors involved in its creation: conceptual and artistic references influenced by the late echoes of the clash between modern and academic in the early decades of the twentieth century that motivated engineers and architects in the search for new paradigms inspired by the European avant-gardes; the material resources having in the reinforced concrete a new determinant in the construction system; the inheritance of different academic backgrounds; the economic relations closely related to the industrialization of the city; the political strategies for the legitimation of the implementation of the urban modernization plan; the actions of the newly founded professional entities in the process of assertion of the professional category, and finally, the demands and aspirations of their clientele. By addressing the circumstances surrounding the transformation of the urban space, having these professionals as mutually responsible for all these changes, the investigation brings up a reflection on an idea of modernity that goes beyond the arts, does not follow a smooth evolutionary path and, above all, that recognizes the existence of various architectural categories, representing many streams of a multifaceted modernity.

Submitted by Marlene Santos (marlene.bc.ufg@gmail.com) on 2016-06-02T18:51:04Z No. of bitstreams: 2 Dissertação - Manoel Bernardes de Jesus- 2016.pdf: 8498646 bytes, checksum: df9ec5bab5a7bc205f3b14b7ac2d5b70 (MD5) license_rdf: 19874 bytes, checksum: 38cb62ef53e6f513db2fb7e337df6485 (MD5) / Approved for entry into archive by Luciana Ferreira (lucgeral@gmail.com) on 2016-06-03T12:08:15Z (GMT) No. of bitstreams: 2 Dissertação - Manoel Bernardes de Jesus- 2016.pdf: 8498646 bytes, checksum: df9ec5bab5a7bc205f3b14b7ac2d5b70 (MD5) license_rdf: 19874 bytes, checksum: 38cb62ef53e6f513db2fb7e337df6485 (MD5) / Made available in DSpace on 2016-06-03T12:08:15Z (GMT). No. of bitstreams: 2 Dissertação - Manoel Bernardes de Jesus- 2016.pdf: 8498646 bytes, checksum: df9ec5bab5a7bc205f3b14b7ac2d5b70 (MD5) license_rdf: 19874 bytes, checksum: 38cb62ef53e6f513db2fb7e337df6485 (MD5) Previous issue date: 2016-03-31 / Coordenação de Aperfeiçoamento de Pessoal de Nível Superior - CAPES / The aim of this paper is to present a study about Triangles, to study their concepts and their properties, the relations between their forms, mesures and areas, relation of Triangle with the Trigonometric and the Geometrics Builds. Besides to present Pythagoras’ Theorem with many proof relates to Triangles. / O objetivo deste trabalho é apresentar um estudo sobre Triângulos, seus conceitos e suas propriedades, as relações entre suas formas, medidas e áreas. Além da relação do Triângulo com a Trigonometria e as Construções Geométricas. Apresentamos o Teorema de Pitágoras com várias demonstrações relacionadas aos Triângulos.

As the threat of supply-chain attacks grows, the need for techniques to protect software integrity likewise increases. The concept of reproducible builds is one such protection. By ensuring that a package can be rebuilt in the exact same way every time, reproducible builds allow users to notice when a package has changed even though its source code stays the same. Thus, the knowledge of which packages are reproducible and therefore easier to trust is a crucial part of this protection mechanism. Current strategies for validating and distributing this information rely on the work of a small number of individual entities with limited coordination in-between them, leading to user confusion because of the lack of a central authority. This work describes a protocol for decentralized coordination and validation of package reproducibility based on hidden votes to limit collusion and a reward scheme to ensure collaboration. The protocol uses the Hyperledger Fabric blockchain as supporting infrastructure, gaining the benefits of high availability, integrity of results and decision traceability from its decentralized nature. To test the protocol, a formal specification was written in TLA+ and validated through model checking. The results showed that, at least for the tested networks, the protocol produces valid results and enforces collaboration between users. Next steps for the project would be to build a functional prototype of the system to test its performance characteristics as well as studying the system actor assumptions made in the protocol design. / Likt hotet från leveranskedjeattacker har ökat, ökar även behoven av skyddstekniker för att säkerställa riktigheten hos mjukvara. Ett sådant typ av skydd ges av reproducerbara byggen. Om ett mjukvarupaket kan byggas exakt likadant varje gång så möjliggör det för användare att upptäcka om paketet har förändrats trots att dess källkod inte har gjort det. Att kunna veta vilka paket som är reproducerbara och därmed lättar att lita på är således en central del i denna skyddsmekanism. Nuvarande strategier för validering och distribution av sådan information bygger på arbete från ett fåtal individer och organisationer med begränsad koordinering däremellan. Detta leder till förvirring för användare på grund av bristen av en central tillitspunkt eller auktoritet. Detta arbete beskriver ett protokoll för decentralizerad koordinering och validering av paketreproducerbarhet baserat på hemliga röster för att begränsa otillåtet samarbete och ett belöningssystem för att motivera önskat samarbete. Protokollet använder blockkedjan Hyperledger Fabric som grund, med fördelarna av att få hög tillgänglighet, resultatsriktighet och spårbara beslut. En formel specifikation skrevs i TLA+ för att testa protokollet och validerades med modeltestning. Testresultatet för de testade nätverkskonfigurationerna visade att protokollet genererar valida resultat och garanterar samarbete mellan användare. De nästa stegen i projektet skulle vara att bygga en funktionell prototyp av systemet för att testa dess prestanda såväl som att studera de antaganden protokollet är designat runt.

Time-consuming code builds within the Continuous Integration pipeline is a common problem in today’s software industry. With fast-evolving trends and technologies, Machine Learning has become a more popular approach to tackle and solve real problems within the software industry. It has been shown to be successful to train Machine Learning models that can classify whether a code change is likely to be successful or fail during a code build. Reducing the time it takes to run code builds within the Continuous Integration pipeline can lead to higher productivity in software development, faster feedback for developers, and lower the cost of hardware resources used to run the builds. To answer the research question: How accurate can success or failure in code build be predicted by using Machine Learning techniques on the historical data collection? The important factor is the historical data available and understanding the data. Thorough data analysis was conducted on the historical data and a data cleaning process to create a dataset suitable for feeding the Machine Learning models. The dataset was imbalanced, favouring the successful builds, and to balance the dataset the SMOTE method was used to create synthetic samples. Binary classification and supervised learning comparison of four Machine Learning models were performed; Random Forest, Logistic Regression, Support Vector Machine, and Neural Network. The performance metrics used to measure the performance of the models were recall, precision, specificity, f1-score, ROC curve, and AUC score. To reduce the dimensionality of the features the PCA method was used. The outcome of the Machine Learning models revealed that historical data can be used to accurately predict if a code change will result in a code build success or failure. / Den tidskrävande koden bygger inom pipeline för kontinuerlig integration är en vanlig faktor i dagens mjukvaruindustri. Med trender och teknologier som utvecklas snabbt har maskininlärning blivit ett mer populärt tillvägagångssätt för att ta itu med och lösa verkliga problem inom programvaruindustrin. Det har visat sig vara framgångsrikt att träna maskininlärningsmodeller som kan klassificeras om en kodändring sannolikt kommer att lyckas eller misslyckas under en kodbyggnad. Genom att förbättra och minska den tid det tar att köra kodbyggnader i den kontinuerliga integrationsrörledningen kan det leda till högre produktivitet inom mjukvaruutveckling och snabbare feedback för utvecklare. För att svara på forskningsfrågan: Hur korrekt kan förutsäga framgång eller misslyckande i kodbyggnad med hjälp av Machine Learning-tekniker för historisk datainsamling? Den viktiga faktorn är den tillgängliga historiska informationen och förståelsen för data. Noggrann dataanalys utfördes på historiska data och en datarengöringsprocess för att skapa en datamängd lämplig för matning av maskininlärningsmodellerna. Datauppsättningen var obalanserad och för att balansera användes uppsättningen SMOTE-metoden. Med binär klassificering och övervakad inlärningsjämförelse gjordes fyra maskininlärningsmodeller, Random Forest, Logistic Regression, Support Vector Machine och Neural Network. Prestandamätvärdena som används för att mäta prestandan hos modellerna är återkallelse, precision, f1-poäng och genomsnittlig ROCAUC-poäng. För att minska dimensionaliteten hos funktionerna användes PCA-metoden. Resultatet av modellerna avslöjar att de med god noggrannhet kan klassificeras om en kodändring misslyckas eller lyckas baserat på den datamängd som skapats från historiska data som används för att träna modellerna.