Les logiciels dépendent de bibliothèques tierces pour réduire les coûts liés à leur développement et à leur maintenance. Elles proposent un ensemble de fonctionnalités robustes dont les développeurs peuvent tirer parti depuis une interface de programmation. Cependant, cette forte dépendance entre un logiciel et ses bibliothèques oblige les développeurs à reconsidérer leur rôle lorsque le logiciel évolue. Dans cette thèse, nous identifions plusieurs problématiques impliquant les bibliothèques tierces dans un contexte de maintenance logicielle. Plus particulièrement, une bibliothèque peut ne plus répondre aux besoins d’un logiciel et doit être remplacée par une nouvelle.Nous nommons cette opération une migration de bibliothèque.Nous soulevons dans ce contexte trois points qui caractérisent les difficultés rencontrées par les développeurs. Vers quelle bibliothèque migrer ? Comment appliquer la migration ? Avec l’aide de quels développeurs ? Cette thèse discute de solutions et apporte des contributions autour de ces problèmes. Nous présentons plusieurs approches et les évaluons lors de différents cas d’étude. L’analyse de l’évolution logicielle sera notre support de travail, dont la méthodologie est basée sur l’observation des changements de logiciels. Nous décrivons les limites actuelles de nos contribu-tions et ouvrons des perspectives futures pour enrichir l’état de l’art dans ce domaine / Software depend on third-party libraries to reduce development and maintenance costs. Developers have access to robust functionalities through an application programming interface designed by these libraries. However, due to the strong relationship with these libraries, developers have to reconsider their position when the software evolves. In this thesis, we identify several re-search problems involving these third-party libraries in a context of software maintenance. More specifically, a library may not satisfy the software new requirements and has to be replaced by anew one. We call this operation a library migration.We leverage three points that characterize the impediments met by developers in this situation.To which library should they migrate ? How to migrate their software ? Who can help them in this case ? This thesis suggests answers and exposes several contributions to these problems. We define three approaches that are evaluated through several case studies. To achieve this work, weuse a methodology based on software evolution analysis to observe and understand how software change. We describe numerous perspectives to overcome the current limitations of our solutions.

Aspect-oriented middleware is a promising technology for the realisation of dynamic reconfiguration in heterogeneous distributed systems. However, like other dynamic reconfiguration approaches, AO-middleware-based reconfiguration requires that the consistency of the system is maintained across reconfigurations. AO-middleware-based reconfiguration is an ongoing research topic and several consistency approaches have been proposed. However, most of these approaches tend to be targeted at specific contexts, whereas for distributed systems it is crucial to cover a wide range of operating conditions. In this paper we propose an approach that offers distributed, dynamic reconfiguration in a consistent manner, and features a flexible framework-based consistency management approach to cover a wide range of operating conditions. We evaluate our approach by investigating the configurability and transparency of our approach and also quantify the performance overheads of the associated consistency mechanisms.

In a variety of text document editing and processing applications, it is necessary to keep track of the revision history of text documents by recording changes and the metadata of those changes (e.g., user names and modification timestamps). The recent Web 2.0 document editing and processing applications, such as real-time collaborative note taking and wikis, require fine-grained shared access to collaborative text documents as well as efficient retrieval of metadata associated with different parts of collaborative text documents. Current revision control techniques only support coarse-grained shared access and are inefficient to retrieve metadata of changes at the sub-document granularity. In this dissertation, we design and implement partial persistent sequences (PPSs) to support real-time collaborations and manage metadata of changes at fine granularities for collaborative text document editing and processing applications. As a persistent data structure, PPSs have two important features. First, items in the data structure are never removed. We maintain necessary timestamp information to keep track of both inserted and deleted items and use the timestamp information to reconstruct the state of a document at any point in time. Second, PPSs create unique, persistent, and ordered identifiers for items of a document at fine granularities (e.g., a word or a sentence). As a result, we are able to support consistent and fine-grained shared access to collaborative text documents by detecting and resolving editing conflicts based on the revision history as well as to efficiently index and retrieve metadata associated with different parts of collaborative text documents. We demonstrate the capabilities of PPSs through two important problems in collaborative text document editing and processing applications: data consistency control and fine-grained document provenance management. The first problem studies how to detect and resolve editing conflicts in collaborative text document editing systems. We approach this problem in two steps. In the first step, we use PPSs to capture data dependencies between different editing operations and define a consistency model more suitable for real-time collaborative editing systems. In the second step, we extend our work to the entire spectrum of collaborations and adapt transactional techniques to build a flexible framework for the development of various collaborative editing systems. The generality of this framework is demonstrated by its capabilities to specify three different types of collaborations as exemplified in the systems of RCS, MediaWiki, and Google Docs respectively. We precisely specify the programming interfaces of this framework and describe a prototype implementation over Oracle Berkeley DB High Availability, a replicated database management engine. The second problem of fine-grained document provenance management studies how to efficiently index and retrieve fine-grained metadata for different parts of collaborative text documents. We use PPSs to design both disk-economic and computation-efficient techniques to index provenance data for millions of Wikipedia articles. Our approach is disk economic because we only save a few full versions of a document and only keep delta changes between those full versions. Our approach is also computation-efficient because we avoid the necessity of parsing the revision history of collaborative documents to retrieve fine-grained metadata. Compared to MediaWiki, the revision control system for Wikipedia, our system uses less than 10% of disk space and achieves at least an order of magnitude speed-up to retrieve fine-grained metadata for documents with thousands of revisions.

Submitted by Irene Nascimento (irene.kessia@ufpe.br) on 2016-09-27T18:16:18Z No. of bitstreams: 2 license_rdf: 1232 bytes, checksum: 66e71c371cc565284e70f40736c94386 (MD5) dissertação_gjcc.pdf: 1929523 bytes, checksum: 59a910a15e3537942754d106de378d19 (MD5) / Made available in DSpace on 2016-09-27T18:16:18Z (GMT). No. of bitstreams: 2 license_rdf: 1232 bytes, checksum: 66e71c371cc565284e70f40736c94386 (MD5) dissertação_gjcc.pdf: 1929523 bytes, checksum: 59a910a15e3537942754d106de378d19 (MD5) Previous issue date: 16-02-29 / FACEPE / During the integration of code contributions resulting from development tasks, one likely has to deal with conflicting changes and dedicate substantial effort to resolve conflicts. While unstructured merge tools try to automatically resolve part of the conflicts via textual similarity, semistructured tools try to go further by exploiting the syntactic structure of part of the artefacts involved. To understand the impact of the unstructured and semistructured merge approaches on integration effort (Productivity) and correctness of the merging process (Quality), we conduct two empirical studies. In the first one, aiming at increasing the existing body of evidence and assessing results for systems developed under an alternative version control paradigm, we replicate an experiment to compare the unstructured and semistructured approaches with respect to the number of conflicts reported by both merge approaches. We used both semistructured and unstructured merge in a sample 2.5 times bigger than the original study regarding the number of projects and 18 times bigger regarding the number of performed merges, and we compared the occurrence of conflicts. Similar to the original study, we observed that semistructured merge reduces the number of conflicts in 55% of the performed merges of the new sample. Besides that, the observed average conflict reduction of 62% in these merges is far superior than what has been observed before. We also bring new evidence that the use of semistructured merge can reduce the occurrence of conflicting merges by half. In order to verify the frequency of false positives and false negatives arising from the use of these merge approaches, we move forward and we conduct a second empirical study. We compare the unstructured and semistructured merge approaches by reproducing more than 30,000 merges from 50 projects, and collecting evidence about reported conflicts that do not represent interferences between development tasks (false positives), and interferences not reported as conflicts (false negatives). In particular, our assumption is that false positives amount to unnecessary integration effort because developers have to resolve conflicts that actually do not represent interferences. Besides that, false negatives amount to build issues or bugs, negatively impacting software quality and correctness of the merging process. By analyzing such critical factors we hope to guide developers on deciding which approach should be used in practice. Finally, our results show that semistructured merge eliminates a significant part of the false positives reported by unstructured merge, but brings false positives of its own. The overall number of false positives is reduced with semistructured merge, and we argue that the conflicts associated to its false positives are easier to resolve when comparing to the false positives reported by unstructured merge. We also observe that more interferences were missed by unstructured merge and reported by semistructured merge, but we argue that the semistructured merge ones are harder to detect and resolve than the other way around. Finally, our study suggests how a semistructured merge tool could be improved to eliminate the extra false positives and negatives it has in relation to unstructured merge. / Durante a integração de contribuições de código resultantes das tarefas de desenvolvimento, frequentemente desenvolvedores têm que lidar com alterações conflitantes e dedicar considerável esforço para resolver conflitos. Enquanto as ferramentas de integração não-estruturadas tentam resolver automaticamente parte dos conflitos através de similaridade textual, ferramentas semiestruturadas tentam ir mais longe, explorando a estrutura sintática de parte dos artefatos envolvidos. Para entender o impacto das abordagens de integração não-estruturada e semiestruturada sobre esforço de integração (Produtividade) e corretude do processo de integração (Qualidade), nós realizamos dois estudos empíricos. No primeiro, com o objetivo de aumentar o atual corpo de evidência e avaliar resultados para sistemas desenvolvidos usando um paradigma de controle de versão alternativo, nós replicamos um experimento para comparar a abordagem não-estruturada e semiestruturada de acordo com o número de conflitos reportados por ambas as abordagens. Nós usamos tanto a integração semiestruturada quanto a não-estruturada em uma amostra 2,5 vezes maior do que a do estudo original em relação ao número de projetos e 18 vezes maior em relação ao número de integrações realizadas, e comparamos a ocorrência de conflitos. Semelhante ao estudo original, observamos que a integração semiestruturada reduz o número de conflitos em 55% das integrações da nova amostra. Além disso, a redução de conflitos média observada de 62% nestas integrações é muito superior à observada anteriormente. Nós também trazemos nova evidência de que o uso da abordagem semiestruturada pode reduzir a ocorrência de integrações com conflitos pela metade. Com o intuito de verificar a frequência de falsos positivos e falsos negativos originados do uso dessas abordagens, nós seguimos adiante e conduzimos um segundo estudo empírico. Nós comparamos as abordagens reproduzindo mais de 30.000 integrações de 50 projetos, coletando evidência sobre os conflitos reportados que não representam interferências entre as tarefas de desenvolvimento (falsos positivos), e interferências não reportadas como conflitos (falsos negativos). Em particular, a nossa suposição é de que falsos positivos denotam esforço desnecessário de integração porque os desenvolvedores têm que resolver conflitos que, na realidade, não representam interferências. Além disso, falsos negativos denotam problemas de build ou bugs, impactando negativamente a qualidade do software e corretude do processo de integração. Ao analisar esses fatores críticos, esperamos orientar os desenvolvedores em decidir qual abordagem deve ser usada na prática. Finalmente, nossos resultados mostram que a abordagem semiestruturada elimina uma parte significativa dos falsos positivos reportados pela abordagem não-estruturada, mas traz falsos positivos próprios. O número global de falsos positivos é reduzido com a integração semiestruturada, e nós argumentamos que os conflitos associados aos seus falsos positivos são mais fáceis de resolver quando comparados aos falsos positivos reportados pela abordagem não-estruturada. Observamos, também, que mais interferências deixaram de ser detectadas pela abordagem não-estruturada, mas foram detectadas pela semiestruturada. No entanto, nós acreditamos que as interferências não detectadas pela abordagem semiestruturada são mais difíceis de detectar e resolver. Por fim, nosso estudo sugere como uma ferramenta de integração semiestruturada poderia ser melhorada para eliminar os falsos positivos e falsos negativos adicionados que possui em relação à não-estruturada.

When performing an analysis of the evolution of software quality and software metrics,there is a need to get access to as many versions of the source code as possible. There isa lack of research on how data or source code can be extracted from the source controlmanagement system Git. This thesis explores different possibilities to resolve thisproblem. Lately, there has been a boom in usage of the version control system Git. Githubalone hosts about 6,100,000 projects. Some well known projects and organizations thatuse Git are Linux, WordPress, and Facebook. Even with these figures and clients, thereare very few tools able to perform data extraction from Git repositories. A pre-studyshowed that there is a lack of standardization on how to share mining results, and themethods used to obtain them. There are several tools available for older version control systems, such as concurrentversions system (CVS), but few for Git. The examined repository mining applicationsfor Git are either poorly documented; or were built to be very purpose-specific to theproject for which they were designed. This thesis compiles a list of general issues encountered when using repositorymining as a tool for data gathering. A selection of existing repository mining tools wereevaluated towards a set of prerequisite criteria. The end result of this evaluation is thecreation of a new repository mining tool called Doris. This tool also includes a smallcode metrics analysis library to show how it can be extended.

Text describes some of the most common tools used for project management and bug/issue tracking. Describes advantages and possibilities of connecting them to more complex systems of administration and version control. It also describe analysis and design of new FITkit specific system, and ways to catch errors in QDevKit application. The rest of text describes whole implementation including examples of applied constructions and logical layout.

Artifact-based research provides a mechanism whereby researchers may study the creation of software yet avoid many of the difficulties of direct observation and experimentation. Open source software forges are of great value to the software researcher, because they expose many of the artifacts of software development. However, many challenges affect the quality of artifact-based studies, especially those studies examining software evolution. This thesis addresses one of these threats: the presence of very large commits, which we refer to as "Cliff Walls." Cliff walls are a threat to studies of software evolution because they do not appear to represent incremental development. In this thesis we demonstrate the existence of cliff walls in open source software projects and discuss the threats they present. We also seek to identify key causes of these monolithic commits, and begin to explore ways that researchers can mitigate the threats of cliff walls.

Version Control Systems are a staple of modern software development and its usage is rapidly growing in education. Students often use Version Control Systems such as Git and GitHub during their education, though newly examined students are often found to lack mastery of industry standard practices. Manually monitoring and giving feedback to students is time consuming and requires a large amount of labor. Therefore, this paper proposes and evaluates an automated feedback system which analyses student assignment repositories an publishes feedback based on a set of data points. After the study, we attempt to measure any impact of the feedback on student performance. The study is unable to underline a significant impact. Students are also asked to reflect over the feedback and the reception was positive, further promoting future studies on the subject. / Versionshantering används idag flytigt inom mjukvaruutveckling och dess popularitet växer stadigt inom högre utbildning. Studenter får ofta lära sig att använda versionshanteringssystem såsom Git och GitHub under deras utbildning, trots detta saknar nyexaminerade studenter ofta tillräcklig kunskap om relevanta industristandarder. Att manuellt övervaka studenter och tillförse dem med respons på deras inlämningar är tidskrävande och kräver mycket arbetskraft. Mot bakgrund av detta föreslår och utvärderar vi i denna studie ett automatiskt responssystem med syftet att analysera studenters inlämningar samt återkoppla med relevant respons på ett antal datapunkter. Efter studiens slut görs en mätning av skillnader i studenternas resultat men ingen konkret slutsats kan sammanställas. Studenterna tillfrågades också att reflektera över responsen de tog del av. Deras svar samt studiens resultat pekar mot att ytterligare studier inom ämnet är väl motiverade.

In today’s digital landscape, maintaining the integrity of source code is crucial for delivering reliable and trustworthy software solutions. However, the increasing prevalence of attacks targeting source code repositories and version control systems (VCSs) poses significant challenges to source code integrity. Unauthorized access to source code repositories can lead to various security risks, including the introduction of malicious code or unauthorized approvals for pull requests. Security measures implemented on the remote server hosting the repository are typically insufficient to detect these types of attacks, resulting in changes potentially remaining undetected and becoming part of the deployed artifact. To address those issues, this study proposes GitBark, a framework that employs cryptographic methods to verify the integrity of a source code repository. GitBark achieves this by enforcing rules and policies on the commits made to the repository. Specifically, the study demonstrates that by formulating rules that utilize digital signatures, GitBark can effectively identify unauthorized changes and approvals. Moreover, GitBark prioritizes maintaining the local repository in a consistent and trustworthy state, reducing reliance on the remote server. Even if changes violating established rules are introduced to the remote repository, GitBark prevents their integration into the local repository. Consequently, users of GitBark can have confidence that their local repository remains a consistent and trustworthy version of the source code, without needing to place full trust on a remote server. An evaluation of GitBark, along with the devised rules, demonstrates its effectiveness in mitigating the threats identified in this study. Additionally, in terms of performance, GitBark incurs a modest overhead, both in time and storage. / I dagens digital värld, så är det viktigare än någonsin att källkodens integritet upprätthålls. Detta är kritiskt för att kunna leverera tillförlitlig och kvalitativ mjukvara. Den ständigt ökade förekomsten av attacker som riktar sig mot källkodsrepon och versionshanteringssystem gör dock upprätthållandet av källkodens integritet svårt. Obehörig åtkomst till källkodsrepo ger upphov till flera säkerhetsrisker såsom inkluderandet av skadlig kod eller obehöriga godkännanden av nya ändringar. De säkerhetsåtgärder som finns implementerade på värdserven där källkodsrepot lagras kan generellt sätt inte detektera dessa typer av attacker, vilket resulterar i att dessa typer av ändringar oftast förblir oupptäckta. För att adressera dessa problem, så presenterar denna studie GitBark, ett verktyg som utnyttjar kryptografiska medel för att verifiera integriteten av ett källkodsrepo. GitBark gör detta genom att kräva regler för commits som görs till källkodsrepot och validera att de upprätthålls. Mer specifikt, så visar att studien att genom att formulera regler som uttnyttjar digitala signaturer så kan GitBark effektivt identifiera oauktoriserade ändringar och godkännanden. Dessutom, prioriterar GitBark att alltid bibehålla det lokala källkodsrepot i ett konsekvent och trovärdigt tillstånd, för att minska beroendet på en remoteserver. Även ifall ändringar som inte uppfyller reglerna introduceras på remote-källkodsrepot så ser GitBark till att dessa ändringar aldrig integreras i det lokala repot. Följaktligen så kan användare av GitBark känna sig säkra i att det lokala källkodsrepot alltid förblir i ett konsekvent och trovärdigt tillstånd i relation till dem etablerade reglerna, utan att behöva förlita sig på en remoteserver. En evaluering av GitBark, tillsammans med de skapade reglerna påvisar dess effektivitet i att adressera de identifierade hoten i denna studie. Dessutom, vad gäller prestanda så har GitBark en liten påverkan både i tid och utrymme.

Having the skill to work with Version Control Systems (VCS) is an important aspect of most software development projects in the industry. But students may lack the knowledge on how to use it. By applying requirements on first year students of the Computer Science programme at KTH, this thesis aims to examine if that is enough to improve their VCS behaviour. This can be examined by applying requirements and then examining the metadata from GitHub. The results from this thesis show that the students committed a bit more when requirements were applied, but that the best way to get the students to commit more is to give them the knowledge on how to have a good commit behaviour. This is in line with previous research in the same area. / Versionshanteringssystem är ett viktigt verktyg i de flesta mjukvaruprojekt. Därför är det också en nödvändig kunskap att kunna arbeta med dem. Trots det så kan många datateknikstudenter sakna dessa kunskaper i hur man använder versionshantering optimalt. Därför ämnar detta arbete att undersöka om det är möjligt att förbättra förstaårsstudenterna på civilingenjörsprogrammet med inriktning datateknik på KTHs commitvanor genom att ställa krav på dem om ett minst antal commits per vecka. Krav kan ställas och sen är det möjligt att använda metadatan från GitHub för att besvara frågeställningen. Resultaten från detta arbete visar att även om studenterna committade lite mer med bara kraven, så var det framförallt efter att de fått kunskaper om bra commitbeteenden som de också förbättrade sitt eget beteende. Detta stämmer väl överens med tidigare forskning på området.