From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail From: Mark H Weaver Newsgroups: gmane.lisp.guile.devel Subject: Re: Distributed verification of release tarballs using Guix? (was Re: Releasing 2.2.5?) Date: Sun, 16 Jun 2019 18:17:46 -0400 Message-ID: <87v9x5tbsl.fsf@netris.org> References: <87d0jrp0g3.fsf@gnu.org> <87sgsa2co4.fsf@netris.org> <87a7eh6x8m.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226"; logging-data="117657"; mail-complaints-to="usenet@blaine.gmane.org" User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) Cc: Andy Wingo , guile-devel To: Ludovic =?utf-8?Q?Court=C3=A8s?= Original-X-From: guile-devel-bounces+guile-devel=m.gmane.org@gnu.org Mon Jun 17 00:22:44 2019 Return-path: Envelope-to: guile-devel@m.gmane.org Original-Received: from lists.gnu.org ([209.51.188.17]) by blaine.gmane.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1hcdXw-000ULX-83 for guile-devel@m.gmane.org; Mon, 17 Jun 2019 00:22:44 +0200 Original-Received: from localhost ([::1]:43210 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hcdXu-0001ge-S1 for guile-devel@m.gmane.org; Sun, 16 Jun 2019 18:22:42 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:49511) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hcdXk-0001gY-FV for guile-devel@gnu.org; Sun, 16 Jun 2019 18:22:33 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hcdXj-0001kK-CH for guile-devel@gnu.org; Sun, 16 Jun 2019 18:22:32 -0400 Original-Received: from world.peace.net ([64.112.178.59]:52088) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1hcdXj-0001jr-8w; Sun, 16 Jun 2019 18:22:31 -0400 Original-Received: from mhw by world.peace.net with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1hcdXi-00083A-4X; Sun, 16 Jun 2019 18:22:30 -0400 In-Reply-To: <87a7eh6x8m.fsf@gnu.org> ("Ludovic \=\?utf-8\?Q\?Court\=C3\=A8s\=22'\?\= \=\?utf-8\?Q\?s\?\= message of "Sun, 16 Jun 2019 23:23:05 +0200") X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 64.112.178.59 X-BeenThere: guile-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Developers list for Guile, the GNU extensibility library" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guile-devel-bounces+guile-devel=m.gmane.org@gnu.org Original-Sender: "guile-devel" Xref: news.gmane.org gmane.lisp.guile.devel:19972 Archived-At: Hi Ludovic, Ludovic Court=C3=A8s writes: > Mark H Weaver skribis: > >> Ludovic Court=C3=A8s writes: >>> What would you think of releasing =E2=80=98stable-2.2=E2=80=99 as 2.2.5? >> >> I think it's a fine idea. > > Awesome. We=E2=80=99ll have to update NEWS; I can give it a go, but if y= ou > could add bullet items for the things you=E2=80=99ve worked on, that=E2= =80=99d be great. Sure, I can take care of updating NEWS in the next day or two. >>> It=E2=80=99s great if you can do it, Mark, but otherwise I can do it. >> >> Regrettably, Guile 2.2 has become too heavy to build on the only machine >> in my possession that I have any trust in. I don't have a machine that >> I consider sufficiently trustworthy to produce build outputs for wider >> distribution. I'm not sure that any of us do. > > Note that =E2=80=9Cmake dist=E2=80=9D is rather inexpensive; I assume it builds the prebuilt .go files, no? That involves running Guile's compiler, which is too heavy to run on my Yeeloong. > =E2=80=9Cdistcheck=E2=80=9D is much more > expensive though, but maybe avoidable for a minor release tarball. > >> To mitigate the risk that a compromised development machine could be >> used to attack others, I propose that we adopt a practice of distributed >> verification of release tarballs. We would publish code that uses Guix >> to produce the release tarball deterministically, and put out a call for >> volunteers to generate the tarball and post signed declarations >> containing the hash of the resulting tarball. After we have received >> several such declarations, we can sign and publish the official tarball. > > I don=E2=80=99t think this should block 2.2.5, but I think it=E2=80=99s a= n idea we > should explore. If you'd like to produce the 2.2.5 release in the traditional way, that's fine with me. I'm not comfortable doing it myself, though. > One issue is that =E2=80=9Cmake dist=E2=80=9D is non-deterministic becaus= e the archive > contains timestamps; I=E2=80=99m sure there of other sources of non-deter= minism > though, because =E2=80=9Cmake dist=E2=80=9D was not designed with that in= mind. Right. I suppose the right approach is to start a conversation with the autotools developers. In the meantime, I wonder if we could implement our own deterministic version of "make dist" using Guix, and use that instead. Or perhaps it would be easier to use "make dist" and then canonicalize the timestamps in the resulting tarball in a later step? Thoughts? > The non-source byproducts in release tarballs are: the pre-built .go > files (which are optional), psyntax-pp.scm, and then Info files and all > the autotools machinery. Are these those you had in mind? Yes, all of the above are potential security risks, except possibly for the info files. Thanks! Mark