From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp1 ([2001:41d0:8:6d80::]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id SK09CcSibWAnywAAgWs5BA (envelope-from ) for ; Wed, 07 Apr 2021 14:17:08 +0200 Received: from aspmx1.migadu.com ([2001:41d0:8:6d80::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp1 with LMTPS id 4DgQBMSibWDiAgAAbx9fmQ (envelope-from ) for ; Wed, 07 Apr 2021 12:17:08 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id BD3591CC8E for ; Wed, 7 Apr 2021 14:17:07 +0200 (CEST) Received: from localhost ([::1]:59090 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lU77J-0007aZ-Sm for larch@yhetil.org; Wed, 07 Apr 2021 08:17:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:44430) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lTx9q-000312-Sm for guix-devel@gnu.org; Tue, 06 Apr 2021 21:39:02 -0400 Received: from mail-qk1-x734.google.com ([2607:f8b0:4864:20::734]:45625) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1lTx9p-0001lR-5r for guix-devel@gnu.org; Tue, 06 Apr 2021 21:39:02 -0400 Received: by mail-qk1-x734.google.com with SMTP id q3so17103675qkq.12 for ; Tue, 06 Apr 2021 18:39:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=philipmcgrath.com; s=google; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=9XFUofhQeFNovD4aW6gBGSpSOzYprBtHyjcsvzFqUuI=; b=iIg8wVwoDIW8LAcH/ooPep8QDvyi0liidFGnwm8al/yb7TXF2zICjq769MBYO1s/1y 4791QHQ834hDQKRq6aYIyZoJtbdGHTSAT78Lka+0IAyoOSapEqgkS7v1+iQshSa0BA59 tSquJlRVxHkwC1C6tBhWlZ0rpbSWNkCpkF97sb+eGWvkHFr4qfsAsn2IW1SZZWs3SNSq fSL2QVoCGpe76r3mBGphn6TgcLm8wQKsPhZlvKUvTPQUXZaxHxCqGHnKPdTtqEEFsXkr ZYTxcwJtpYPsF7FW+cKLQv05RqIMmlWzUW/R7rVVX1Y1AcPq4k8fs6RTYb7qK9/HtvOT Yy1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=9XFUofhQeFNovD4aW6gBGSpSOzYprBtHyjcsvzFqUuI=; b=TtcQJFdCl9QsQes4HnMii0kCn0Fy44jXUSjIqqWCU1egejZreU0NKJ9IWodhj9U4F5 Um63+HT5R5i/KnymWxx7wN6tpRoktwD5eLg+KwYUT3RBr/yzrzxgmK1yGEVxJ84OwFTb zszkgDmWuJGW7KuYyt4GePe1xhmka9fbPXcDAPp5DVjteh8/2e0EkYp+1dEW5IdnI35w v+qCIcF6B3Y41jYkSI8Hz0hsF8GMytfPa5AlYwD/zRJ3X0fy1hXU0RPMP/1evIomTCgG hOm29oT78OJimrOaY5tE3wTkBF8MG31zGlE6Eb5bSkBqXPbhJy8tm7E1Kg5gpHiPIznp Al6g== X-Gm-Message-State: AOAM533KcEPni8BtwN4OdX8zG6EFeIie54bgYf+/GbxGZkt7QL6Egon4 1rsiZU9NK4MT2bSEmALi8kMDt1Iho4cdpY5FDTo= X-Google-Smtp-Source: ABdhPJwGu0zo/Szw64UwEqBBGAKm+/0RIiLDBQyt7dryVcaaZmUPx5jsPRdBPLictWoC2jDvs7KntA== X-Received: by 2002:a37:7985:: with SMTP id u127mr825156qkc.333.1617759539054; Tue, 06 Apr 2021 18:38:59 -0700 (PDT) Received: from Sapientia.local (c-73-125-89-242.hsd1.fl.comcast.net. [73.125.89.242]) by smtp.gmail.com with ESMTPSA id b1sm17823546qkk.117.2021.04.06.18.38.58 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 06 Apr 2021 18:38:58 -0700 (PDT) Subject: Re: Racket 8 and store references (was [security] Chunked store references in .zo files in Racket 8 #47614) To: Jack Hill , Mark H Weaver References: From: Philip McGrath Message-ID: <7eaf8b95-5550-66e1-fda2-d691255b49d7@philipmcgrath.com> Date: Tue, 6 Apr 2021 21:38:57 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:78.0) Gecko/20100101 Thunderbird/78.9.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Received-SPF: neutral client-ip=2607:f8b0:4864:20::734; envelope-from=philip@philipmcgrath.com; helo=mail-qk1-x734.google.com X-Spam_score_int: -12 X-Spam_score: -1.3 X-Spam_bar: - X-Spam_report: (-1.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NEUTRAL=0.779 autolearn=no autolearn_force=no X-Spam_action: no action X-Mailman-Approved-At: Wed, 07 Apr 2021 08:16:46 -0400 X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: guix-devel@gnu.org Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: "Guix-devel" X-Migadu-Flow: FLOW_IN ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1617797827; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post:dkim-signature; bh=9XFUofhQeFNovD4aW6gBGSpSOzYprBtHyjcsvzFqUuI=; b=RQF9TGr9+wZbLEJvkBgO2aqEdu8wRRQA967TLlfbtEP0EIV3PwTdY+ggWGjMf/G/82wTJH jIdESPBCr5SsFyARLfv4R+v0WYOhiqVbJFIOq9FTqEYz1hZQGqdVGgHn06m+CTqWR7WEv3 hF1rqrBULXsPqCEIgqiUUamCNnpD5ncYv3WtEqlBb0sXB0R8SLSJGZCX1FoIKnWDAm9sSR me+Hbu/uQvwyA23Dl2M+xoRRGNB/VoBQp/caSw+uSBglZyuZPJA2+z2LcFmGI6wKqRDyHY YQx+rxmWOkIerAeUK5k5/ngU3Ugsvf3gMvK3hx4ZUfEUEXadlHq7zpbk9gsoMw== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1617797827; a=rsa-sha256; cv=none; b=gVMLGv1QbSyG2ZyKIRQRcYD+6tMhzars3FFgkJ3k2W/7W4eaCTu3MNHEckz+0rl4MU6Ln+ J4y+vhwMPcSVQYO6vBqoLvt1qGnNSoyG/wXs6bWdCZug6pf+GOLvXJxmCZ8eI+GJ9Lc+vH hicEvFIC0ikQFAK5OF+DW0G1+1LYWL4tZcfZzDbUnV5lkBSCIUcu7/UpM+gQ3OkZXH/cMs yx/TH+dI0BPH9dQnWF1IWnfs0FExKJp5SG7/XH1aBJP5Smxq8zvnA036to78YfHUls43cr 034m4jEwWFE0bVuO7K0hsp9CniOigy5eTb9VHKWM8cEuABp//JSsVrkrcaM+hg== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=pass header.d=philipmcgrath.com header.s=google header.b=iIg8wVwo; dmarc=none; spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Migadu-Spam-Score: -2.64 Authentication-Results: aspmx1.migadu.com; dkim=pass header.d=philipmcgrath.com header.s=google header.b=iIg8wVwo; dmarc=none; spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Migadu-Queue-Id: BD3591CC8E X-Spam-Score: -2.64 X-Migadu-Scanner: scn0.migadu.com X-TUID: +P+pgqObVTEk Indeed, I expect this is a more precise diagnosis of the same problem. My patch in https://issues.guix.gnu.org/47180 solves it by putting the store references (search paths for foreign libraries) in a configuration data file that isn't compiled, so they don't end up in .zo files in the first place. The .zo format is intentionally undocumented and subject to breaking change, including from different compilation options. At a minimum, a change to the Racket version number signals a breaking change to compiled code (e.g. Git is now at 8.0.0.13, so 13 breaking changes since the release). Internally, I don't know all the details, but the normal 8.0 .zo format has a Racket layer around the Chez Scheme object format, which seems to be very complex: it looks like it supports user-configurable compression at the granularity of the individual object within an object file. So it seems much better to avoid rewriting .zo files altogether. -Philip On 4/6/21 9:20 PM, Jack Hill wrote: > On Tue, 6 Apr 2021, Mark H Weaver wrote: > >> Anyway, I doubt that imposing such a limitation would adequately solve >> the problem here of chunked references in Racket 8, because I suspect >> that Racket 8 could split store references at arbitrary points in the >> string.  I doubt that we can safely assume that the hash component of >> store references will be stored contiguously in *.zo files. > > Mark and everyone, > > I wanted to spin off a subthread on guix-devel, to make you aware of > another problem that we've run into with reference in .zo getting > mangled: https://issues.guix.gnu.org/47180 > > Best, > Jack >