#runtime

Code Signing and Notarization

§1 Provenance Apple developer doc, "Notarizing macOS software before distribution": https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution Apple Developer ID program: https://developer.apple.com/developer-id/ Microsoft Trusted Signing (formerly Azure Code Signing): https://learn.microsoft.com/en-us/azure/trusted-signing/ Microsoft Authenticode Signing PE files: https://learn.microsoft.com/en-us/windows-hardware/drivers/install/authenticode Moonbase, "Code signing audio plugins in 2025": https://moonbase.sh/articles/code-signing-audio-plugins-in-2025-a-round-up/ Reverse Society, "Complete Guide to Notarizing macOS Apps with notarytool": https://tonygo.tech/blog/2023/notarization-for-macos-app-with-notarytool §2 Mechanism / function Three OS-level gatekeeping systems shape what users see when they double-click a downloaded binary: macOS Gatekeeper checks...

Static-PIE

§1 Provenance glibc design discussion (initial GCC patch by H.J. Lu): https://patchwork.ozlabs.org/project/gcc/patch/20170824200227.GA14790@gmail.com/ musl rcrt1 patch (Szabolcs Nagy, 2020): https://www.openwall.com/lists/musl/2020/04/27/2 Eklitzke, "The Curious Case of Position Independent Executables": https://eklitzke.org/position-independent-executables Gaultier, "Build PIE executables in Go: I got nerd-sniped": https://gaultier.github.io/blog/build-pie-executables-with-pie.html ASLR for statically linked binaries (Leviathan Security): https://www.leviathansecurity.com/blog/aslr-protection-for-statically-linked-executables §2 Mechanism / function A traditional static executable has ELF type ET_EXEC and is hard-loaded at a fixed virtual address (historically 0x400000 on Linux...

Apple Universal Binaries

§1 Provenance Apple developer doc, "Building a universal macOS binary": https://developer.apple.com/documentation/apple-silicon/building-a-universal-macos-binary WWDC 2020 introduction (transition keynote, session 102): https://developer.apple.com/videos/play/wwdc2020/102/ Universal binary background: https://en.wikipedia.org/wiki/Universal_binary lipo(1) man page: shipped with Xcode command-line tools (no canonical web URL; check man lipo on a Mac). The Future of Intel Macs (Eclectic Light, July 2025): https://eclecticlight.co/2025/07/04/whats-the-future-for-your-intel-mac/ §2 Mechanism / function A Mach-O "fat" or "universal" binary is a wrapper that contains multiple independent Mach-O images,...

Freestanding / no-libc

§1 Provenance Linux syscall ABI man page: https://man7.org/linux/man-pages/man2/syscall.2.html Linux vDSO man page: https://man7.org/linux/man-pages/man7/vdso.7.html Darling docs on macOS syscalls: https://docs.darlinghq.org/internals/basics/system-call-emulation.html Cosmopolitan source (a real freestanding-style implementation): https://github.com/jart/cosmopolitan Zig freestanding target docs: https://ziglang.org/learn/overview/#small-self-contained-builds "UNIX Syscalls" (John Millikin): https://john-millikin.com/unix-syscalls §2 Mechanism / function A "freestanding" or "no-libc" binary makes its own system calls directly to the kernel without going through any C library. The mechanism varies sharply per OS: Linux: stable syscall ABI....

The Go Runtime as a Library

§1 Provenance cgo package docs: https://pkg.go.dev/cmd/cgo runtime/cgo: https://pkg.go.dev/runtime/cgo and https://go.dev/src/runtime/cgo/ Build mode docs: https://pkg.go.dev/cmd/go#hdr-Build_modes Cgo cost analysis (Cockroach Labs): https://www.cockroachlabs.com/blog/the-cost-and-complexity-of-cgo/ Go 1.22 release notes: https://go.dev/doc/go1.22 License: BSD 3-clause (Go itself). Maintained by the Go team at Google plus a large community. §2 Mechanism / function Go supports three relevant cross-language build modes: -buildmode=c-archive produces a static library ( .a on Unix, .lib on Windows) that exposes Go-defined functions as C-callable...

Cosmopolitan Libc

§1 Provenance Project home: https://justine.lol/cosmopolitan/ Source: https://github.com/jart/cosmopolitan Cosmopolitan "Third Edition" essay (Justine Tunney): https://justine.lol/cosmo3/ cosmocc README: https://github.com/jart/cosmopolitan/blob/master/tool/cosmocc/README.md Prebuilt apps: https://cosmo.zip/ Discussion: https://groups.google.com/g/cosmopolitan-libc License: ISC (a permissive 1-clause BSD variant). Author: Justine Tunney, with Mozilla MIECO sponsorship for 3.x. §2 Mechanism / function Cosmopolitan Libc produces a single binary, called an "Actually Portable Executable" (APE), that is simultaneously: A Linux ELF (you can ./prog on Linux and it runs). A FreeBSD...

glibc

§1 Provenance Project home: https://www.gnu.org/software/libc/ Git: https://sourceware.org/git/glibc.git Manual: https://sourceware.org/glibc/manual/ License: LGPLv2.1+ (with some headers under more permissive terms; some test files under GPL). Maintainers: a steering committee under the GNU project. Notable contributors include Florian Weimer (Red Hat), Adhemerval Zanella (Linaro), Carlos O'Donell (Red Hat), Siddhesh Poyarekar. §2 Mechanism / function glibc is the C library that ships with every mainstream Linux distribution that is not Alpine-shaped. It implements ISO...

musl libc

§1 Provenance Project home: https://musl.libc.org/ Git: https://git.musl-libc.org/cgit/musl/ Wiki: https://wiki.musl-libc.org/ Release history: https://musl.libc.org/releases.html Author: Rich Felker (single principal maintainer since 2011). License: MIT (with a handful of files under various BSD-style and public-domain licenses; see the COPYRIGHT file). musl was started in 2011 with the explicit goal of providing a small, correct, MIT-licensed libc that is fully usable as a static library. It is the libc used by Alpine Linux (...

Runtime and libc

JavaScriptCore — Riptide

§1 Provenance Riptide. Filip Pizlo and the JavaScriptCore team at Apple. Introduced in WebKit r209827, blog post Jan 30 2017: https://webkit.org/blog/7122/introducing-riptide-webkits-retreating-wavefront-concurrent-garbage-collector/ . Companion blog from 2022: "Understanding Garbage Collection in JavaScriptCore From Scratch," https://webkit.org/blog/12967/understanding-gc-in-jsc-from-scratch/ . Related deep dive: "Concurrent JavaScript: It can work!" https://webkit.org/blog/7846/concurrent-javascript-it-can-work/ . Source: Source/JavaScriptCore/heap/ in https://github.com/WebKit/WebKit . §2 Mechanism Riptide is a concurrent, parallel, non-compacting, generational mark-sweep collector for JS objects in JSC. Key pieces: Marking concurrently...

W^X Enforcement in Modern JITs

§1 Provenance Apple Silicon model. Apple Platform Security guide and: https://developer.apple.com/documentation/apple-silicon/porting-just-in-time-compilers-to-apple-silicon . Apple Silicon enforces per-thread W^X via the M-series memory permissions extension. Hardened Runtime entitlements. com.apple.security.cs.allow-jit , com.apple.security.cs.allow-unsigned-executable-memory , the newer jit-write-allowlist . https://developer.apple.com/documentation/BundleResources/Entitlements/com.apple.security.cs.allow-jit . JSC pioneered the MAP_JIT + pthread_jit_write_protect_np pattern in 2015; Firefox, V8, .NET, asmjit followed. Intel CET. https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/speculative-execution-side-channel-mitigations.html , kernel docs https://www.kernel.org/doc/html/next/x86/shstk.html . Default-enabled on Windows since W10 19H1 and Linux since 6.4 (2023). ARM...

WasmGC

§1 Provenance WasmGC. Proposal repo: https://github.com/WebAssembly/gc . Champions: Andreas Rossberg (Mozilla, retd.), Francis McCabe (Google). Standardised as part of WebAssembly 3.0 , W3C Recommendation, September 24, 2025. Earlier: Wasm 2.0 (Dec 2024, W3C REC); WasmGC was post-2.0 work that landed in 3.0. Browser support: Chrome 119 (Oct 2023) Firefox 120 (Nov 2023) Safari 18.2 (Dec 2024) — last to ship, unblocking GC-language deployment. §2 Mechanism WasmGC adds typed managed references...

Roc — Perceus in production-ish

§1 Provenance Roc language. Designed by Richard Feldman et al., compiler in Rust, runtime in Zig. The reference-counting + reuse pass is a direct port of Perceus (Reinking, Xie, de Moura, Leijen, PLDI 2021). Alias analysis: Morphic , a Rust library developed at UC Berkeley (Sullivan et al.). The thesis "Reference Counting with Reuse in Roc" (Utrecht student thesis, https://studenttheses.uu.nl/bitstream/handle/20.500.12932/44634/Reference_Counting_with_Reuse_in_Roc.pdf ) documents Roc-specific tweaks. Repo: https://github.com/roc-lang/roc — latest tag in...

Runtime Techniques and Sandboxed Memory

Spectre Mitigations in Hosted JITs

§1 Provenance Spectre v1 (Bounds Check Bypass) and Spectre v2 (Branch Target Injection) disclosed Jan 2018, Kocher et al. WebKit's response: https://webkit.org/blog/8048/what-spectre-and-meltdown-mean-for-webkit/ (2018), still architecturally accurate. Chrome's response: Site Isolation (out-of-process iframes); Spectre-aware codegen in V8. Intel guidance: https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/runtime-speculative-side-channel-mitigations.html , https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/branch-history-injection.html . Linux kernel mitigations: https://docs.kernel.org/admin-guide/hw-vuln/spectre.html . Recent attacks: PB-Inception (2025), BHI variants (2024-2025), CVE-2024-28956, CVE-2025-24495. §2 Mechanism Spectre attacks induce the CPU to speculatively execute instructions that wouldn't run...

V8 — Orinoco + Oilpan

§1 Provenance Orinoco. V8's collector family — concurrent and parallel marking, parallel Scavenger young-gen. Blog posts: https://v8.dev/blog/orinoco-parallel-scavenger , https://v8.dev/blog/trash-talk , https://v8.dev/blog/concurrent-marking . Oilpan. Blink's traced C++ GC, originally in third_party/WebKit/Source/platform/heap/ , migrated to V8 as a library since V8 v9.4 (2021): https://v8.dev/blog/oilpan-library . Design doc: https://chromium.googlesource.com/chromium/src.git/+/65.0.3283.0/third_party/WebKit/Source/platform/heap/BlinkGCDesign.md . May 2026 status overview: Andy Wingo, "The last couple years in v8's garbage collector," https://wingolog.org/archives/2025/11/13/the-last-couple-years-in-v8s-garbage-collector/ . §2 Mechanism V8 manages two heaps that...

ZGC — Generational, Colored-Pointer GC (OpenJDK)

§1 Provenance OpenJDK Z Garbage Collector. Engineering lead: Per Liden (originally), Stefan Karlsson, Erik Österlund at Oracle. Key JEPs: JEP 333 (2018) — original experimental ZGC. JEP 377 (JDK 15, 2020) — production-ready. JEP 439 (JDK 21, Sep 2023) — Generational ZGC, opt-in. JEP 474 (JDK 23, 2024) — Generational mode by default; non-generational mode deprecated. JDK 25 (Sep 2025, LTS) — generational-only ZGC. Project home: https://openjdk.org/projects/zgc/ , wiki https://wiki.openjdk.org/spaces/zgc/pages/34668579/Main...

MMTk and LXR

§1 Provenance MMTk (Memory Management Toolkit). Stephen M. Blackburn et al., ANU. Originally a Java framework (Blackburn, Cheng, McKinley, 2004), rewritten in Rust as mmtk-core (~2018-present). https://www.mmtk.io/ , https://github.com/mmtk/mmtk-core . LXR — "Low-Latency, High-Throughput Garbage Collection." Wenyu Zhao, Stephen M. Blackburn, Kathryn S. McKinley. PLDI 2022 , San Diego, June 2022, pp. 76-91. https://www.steveblackburn.org/pubs/papers/lxr-pldi-2022.pdf . Recent follow-up: Zhao, Blackburn, McKinley, "Work Packets: A New Abstraction for GC Software Engineering, Optimization,...

Android Scudo + MTE inside ART

§1 Provenance Scudo. Originally LLVM's hardened allocator (sub-project of compiler-rt's sanitizer family). Maintainer: Kostya Kortchinsky and others. Brought to Android by Google. AOSP doc: https://source.android.com/docs/security/test/scudo . Android Developers blog: https://android-developers.googleblog.com/2020/06/system-hardening-in-android-11.html (Scudo default from Android 11). Arm MTE. Armv8.5-A feature, mainline in Armv9. AOSP: https://source.android.com/docs/security/test/memory-safety/arm-mte . Android Developers: https://developer.android.com/ndk/guides/arm-mte . LLVM review for MTE in Scudo: https://reviews.llvm.org/D70762 . Security analyses: WOOT 2024 — "Exploiting Android's Hardened Memory Allocator" (Mao et al.);...

MSWasm — Memory-Safe WebAssembly

§1 Provenance Michael, Gollamudi, Bosamiya, Johnson, Denlinger, Disselkoen, Watt, Parno, Patrignani, Vassena, Stefan. "MSWasm: Soundly Enforcing Memory-Safe Execution of Unsafe Code." POPL 2023 , PACMPL Vol. 7, Article 15 (not OOPSLA 2023; the prompt is in error). Earlier position paper: Disselkoen et al., "Progressive Memory Safety for WebAssembly," 2019. Follow-up: Iris-MSWasm , OOPSLA 2024 — Legoupil, Watt, Patrignani, Stefan, et al. — a fully mechanised foundation in Iris. https://dl.acm.org/doi/10.1145/3689722 ....

V8 Pointer Compression Cage

§1 Provenance V8 team at Google. Igor Sheludko, Toon Verwaest, Tobias Tebbi et al. Blog post (canonical): https://v8.dev/blog/pointer-compression . Oilpan companion: https://v8.dev/blog/oilpan-pointer-compression . Shipped initially in V8 v8.0; default-on V8 v9.2 (shared-cage mode). Multi-cage / IsolateGroups: Dmitry Bezhetskov, https://dbezhetskov.dev/multi-sandboxes/ . Related: Node.js issue tracker #55735 on multi-cage isolate groups. §2 Mechanism V8's heap pointers used to be raw 64-bit Object* . Pointer compression replaces them with 32-bit "compressed pointers" (...

WebAssembly Segmented Memory (and friends)

§1 Provenance WebAssembly Community Group (CG) and Working Group (WG). W3C process. Wasm 3.0 specification — W3C Recommendation, September 24, 2025. Bundles 9 features: WasmGC, exception handling, tail calls, memory64 , multiple memories , 128-bit SIMD, relaxed-SIMD, extended-const, JS Promise integration. Proposal repos: https://github.com/WebAssembly/memory64 (phase 4 → merged) https://github.com/WebAssembly/multi-memory (phase 4 → merged) https://github.com/WebAssembly/proposals (master proposal list and status) Discussion on integration: https://github.com/WebAssembly/design/issues/1036 . Status overview: https://webassembly.org/features/ . §2 Mechanism...

Perceus (Koka)

§1 Provenance Alex Reinking, Ningning Xie, Leonardo de Moura, Daan Leijen. "Perceus: Garbage Free Reference Counting with Reuse." PLDI 2021 , ACM SIGPLAN Conf. on Programming Language Design and Implementation, June 2021. Distinguished Paper. Extended TR: Microsoft Research MSR-TR-2020-42, Nov 2020 (v4 2021-06-07). Follow-up: Lorenzen, Leijen. "Reference Counting with Frame Limited Reuse" (ICFP 2022 / TR 2021). Most recent: Leijen, Lorenzen. "Tail recursion modulo context: an equational approach (extended version),"...

V8 Sandbox

§1 Provenance Designer: Samuel Groß (formerly Google Project Zero, now leads V8 Security at Google). Talk: "The V8 Heap Sandbox," OffensiveCon 2024 — https://saelo.github.io/presentations/offensivecon_24_the_v8_heap_sandbox.pdf . Workshop paper: Groß, "The V8 Sandbox," MoreVMs 2025 (Programming 2025). Official blog: https://v8.dev/blog/sandbox . README: https://chromium.googlesource.com/v8/v8.git/+/refs/heads/main/src/sandbox/README.md . Rollout: enabled by default Chrome 123 (April 2024) on Linux/Windows/macOS/ChromeOS/Android, 64-bit only. Inclusion in Chrome's Vulnerability Reward Program (VRP): announced 2025; sandbox no longer "experimental." §2 Mechanism The...

Lobster — Compile-Time Reference Counting

§1 Provenance Lobster language. Wouter van Oortmerssen (the same author as Amiga-E, CryEngine's FlatBuffers, and several earlier ownership-RC experiments). Talk: "Compile-time reference counting & Lifetime analysis in Lobster," r/ProgrammingLanguages Meetup, Nov 22 2020, https://www.youtube.com/watch?v=WUkYIdv9B8c . Reference manual: https://aardappel.github.io/lobster/language_reference.html . Project site: https://strlen.com/lobster/ . Prior art the author cites: his own "ownership reference counting" (June 2004) and the academic Reference Escape Analysis paper (Park & Goldberg, SIGPLAN Notices 26-9, 1991, https://dl.acm.org/doi/10.1145/115866.115883)...

42. The Import Lock

42. The Import Lock The import lock is the synchronization machinery that prevents unsafe concurrent imports. In CPython, imports are not only name lookups. They may create module objects, mutate sys.modules , execute arbitrary Python code, initialize extension modules, update package attributes, compile source files, read bytecode caches, and run package initialization code. Without locking, two threads could import the same module at the same time and observe inconsistent module...

46. The GIL

46. The GIL The Global Interpreter Lock, usually called the GIL, is CPython’s process-level execution lock for Python bytecode in the traditional build. It ensures that only one thread at a time executes Python code in a given interpreter. The GIL is not the same as Python’s threading API. Python can create many operating system threads. The restriction is that, in the normal CPython runtime, those threads do not run...

44. Classes and Metaclasses

44. Classes and Metaclasses A class is a runtime object that creates instances, stores attributes, participates in inheritance, and defines behavior through the Python object model. In CPython, a class is an object whose type is usually type . A metaclass is the class of a class. It controls how class objects are created, initialized, represented, and called. For normal classes: class User: pass print(type(User)) Output: <class 'type'> This means...

41. Packages

41. Packages A package is a module that can contain other modules. In CPython, a package is not a separate object category. It is still a module object, but it has import metadata that tells the import system where to look for submodules. At the Python level, this directory can be a package: app/ __init__.py config.py server.py You can import it as: import app import app.config from app.server import run...

40. Modules and Imports

40. Modules and Imports A module is Python’s basic unit of code loading, namespace isolation, and reuse. In CPython, a module is both a language-level object and a runtime record in the import system. At the Python level, a module is what you get after executing: import math import os import json Each imported name is bound to a module object, package object, function, class, or other exported object. At...

47. Threads

47. Threads A thread is an operating system execution context inside a process. CPython exposes threads through the threading module and implements lower-level support through _thread , platform thread APIs, interpreter thread state, locks, condition variables, and GIL coordination. Threads let a Python program perform multiple activities concurrently inside one process. In traditional CPython, threads do not usually execute Python bytecode in parallel because of the GIL. They are still...

43. Descriptors

43. Descriptors A descriptor is an object that controls attribute access on another object. Descriptors are one of the main mechanisms behind Python’s object model. They explain how methods bind to instances, how property works, how staticmethod and classmethod work, how slots work, and how many CPython-level type operations connect to Python-level syntax. At the language level, a descriptor is any object that defines one or more of these methods:...

48. Subinterpreters

48. Subinterpreters A subinterpreter is an interpreter instance inside the same CPython process. It has its own interpreter state, module table, builtins, import state, and execution context. It shares the same operating system process with other interpreters, but it is logically separated from them at the Python runtime level. A normal Python program usually runs with one main interpreter: process main interpreter modules builtins sys thread states frames With subinterpreters,...

49. Signals

49. Signals Signals are operating system notifications delivered to a process. CPython exposes them through the signal module and integrates them with the interpreter’s evaluation loop, thread model, pending-call machinery, and exception system. A signal is not a normal Python function call. It can arrive asynchronously from outside the program. Common examples: SIGINT interrupt from Ctrl-C SIGTERM termination request SIGALRM timer alarm on Unix SIGHUP terminal hangup or reload request...

51. Audit Hooks

51. Audit Hooks Audit hooks are CPython’s runtime mechanism for observing security-sensitive and operationally important events. They let embedders, security tools, test harnesses, and monitoring systems receive notifications when Python code performs actions such as importing modules, opening files, starting subprocesses, compiling code, executing dynamic code, loading native extensions, or changing tracing state. Audit hooks do not replace operating system sandboxing. They are an observability and policy-enforcement mechanism inside the...

45. The MRO

45. The MRO The method resolution order, usually called the MRO, is the ordered list of classes CPython searches when resolving attributes through a class hierarchy. For a simple class: class A: pass class B(A): pass the MRO of B is: print(B.__mro__) Output shape: (<class '__main__.B'>, <class '__main__.A'>, <class 'object'>) This means CPython searches B , then A , then object . The MRO is central to inheritance, method lookup,...

50. Context Variables

50. Context Variables Context variables provide task-local state for concurrent Python programs. They are implemented by the contextvars module and are designed mainly for asynchronous code, where many logical tasks can run on the same operating system thread. A context variable looks like a global variable from the caller’s point of view, but its value belongs to the current logical execution context. This solves a problem that thread-local storage cannot...