From mboxrd@z Thu Jan 1 00:00:00 1970 From: Chris Marusich Subject: Re: store reference detection (was Re: JARs and reference scanning) Date: Fri, 12 May 2017 01:19:14 -0700 Message-ID: <87o9uyv665.fsf@gmail.com> References: <87a876pwaq.fsf@gmail.com> <8760hr7mwl.fsf@gmail.com> <20170426.135333.1620868924745053745.post@thomasdanckaert.be> <87fugu6jzg.fsf@gnu.org> <59022E86.1020709@crazy-compilers.com> <8760hjig4r.fsf@gnu.org> <590F179B.4060306@crazy-compilers.com> <87shkafvhu.fsf@netris.org> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:38219) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1d95nF-0008Ib-CW for guix-devel@gnu.org; Fri, 12 May 2017 04:19:22 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1d95nC-0003oq-4j for guix-devel@gnu.org; Fri, 12 May 2017 04:19:21 -0400 Received: from mail-pf0-x243.google.com ([2607:f8b0:400e:c00::243]:33522) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1d95nB-0003o2-SR for guix-devel@gnu.org; Fri, 12 May 2017 04:19:18 -0400 Received: by mail-pf0-x243.google.com with SMTP id a23so6243591pfe.0 for ; Fri, 12 May 2017 01:19:17 -0700 (PDT) In-Reply-To: <87shkafvhu.fsf@netris.org> (Mark H. Weaver's message of "Fri, 12 May 2017 02:18:53 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Mark H Weaver Cc: guix-devel@gnu.org --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mark H Weaver writes: > Hartmut Goebel writes: > >> Am 02.05.2017 um 14:43 schrieb Ludovic Court=C3=A8s: >>> Hartmut Goebel skribis: >>> >>>> Am 27.04.2017 um 15:46 schrieb Ludovic Court=C3=A8s: >>>>> =E2=80=98propagated-inputs=E2=80=99 is one way to manually specify ru= n-time references. >>>>> It works at the package level and not at the store level=E2=80=94that= is, the >>>>> store item=E2=80=99s references are unaffected by what =E2=80=98propa= gated-inputs=E2=80=99 >>>>> contains. It=E2=80=99s usually enough for our purposes though. >>>> I'm not sure if 'propagated-inputs' are enough. For example >>>> "python-passlib" as propagated-input python-py-bcrypt, but the later >>>> does not show up as reference, requisite nor referrer: >>> Right, that=E2=80=99s what I meant by =E2=80=9Cnot at the store level= =E2=80=9D above. >>> >>> Ludo=E2=80=99. >> So I propose to add a small text file ".guix-dependencies' to all >> language's packages which do not add some kind of references themselves: >> Python, Perl, Java, etc. > > I have thought of doing this in the past, but there's another more > difficult problem that would also need to be solved: how to make > grafting work for these non-plaintext references. If grafting doesn't > work, there's a good chance that software with known security flaws will > continue to be executed. That's a good thing to keep in mind. I think that the references we're talking about putting into a ".guix-dependencies" file or into an uncompressed JAR file are in fact "plaintext" in the sense that these files are not using compression, encryption, esoteric encodings, or other obfuscations which might defeat the reference scanning or grafting mechanisms. I'm not convinced we need these things (a list of dependencies in ".guix-dependencies" or embedded classpaths in JAR files), but if we used them, I don't think it would interfere with reference scanning or grafting. Would it? =2D-=20 Chris --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEy/WXVcvn5+/vGD+x3UCaFdgiRp0FAlkVcAIACgkQ3UCaFdgi Rp0mRA//Sa1dSzjuYOWkeB5yKDOARE18YlKWWE27/D32Su/NpsyYBXV0+7G5+Itn 961VIDcVNWaIghp9VOczzYl7FIMMMAewrSx9MRLOsaf1anHNbSifNFeRFIKNp9i0 wP+/3HlkkJ5iM0tx8l4XSiKz6EoRLEFmA9QWRZKgckXedCxeb+QKKNMKwVPSh99A 7fHmZ0kjNze2tr9iSWBa4FSetd1BVdP1bEj6vYUh+zcsyqSnpWsHVO9LeiUfeObH AdOk+2KopLzq3nEffPo5QvYMBV9kgNzqgeKhva5PnfA5xkLPk/NvFW6OXkN6Tfi7 eXr7Qt79cpOecXr91Cw7nZq/piW0FKOO82bGq5NdBLGagiDfvqY3F04g7J5u72J/ mxRwd7UeS4wTi4PyFgnR8iKiZjU/yvGDoST0sViSgUl9dZpw2evg6JxwzexUEmIQ tKIbpU7gB3D2cno9jN0BljPCZGzEg1bJB7XYTRgpk6QdSbs4IepVrpbu3H0VWVCq +/4sCwO7Lqaf5pQoxHcHoiVIrTO1f2Fbv1hybZU2GnRtWxQ+tkJhzHtg82eXohcT y1Whxma5H1smen4z/0Zgw9tNLAX+6XnwyJF0TYS+ATu8YyVl6QwuOdr3Ckn4uTlt cLl6LKRhwylYcei6d8fG4DNYenjtiTpBPAlWl0i/6Kn6N2Nz0MQ= =+SYF -----END PGP SIGNATURE----- --=-=-=--