Re: Building from git

[wolf <wolf@wolfsden.cz>]

[-- Attachment #1: Type: text/plain, Size: 2101 bytes --]

On 2023-09-07 14:06:05 +0200, Simon Tournier wrote:
> Hi,
> 
> On Sat, 02 Sep 2023 at 11:03, Nicolas Débonnaire <n.debonnaire@gmail.com> wrote:
> 
> > guix shell -D guix --pure
> > ./bootstrap
> > ./configure --localstatedir=/var --syscondir=/etc
> > make
> 
> [...]
> 
> > Error: fontconfig:Didn't find expected font family. Perhaps URW Type 1
> > fonts need installing?
> 
> Hum, weird.  That’s because the documentation seems failing, I guess.
> 
> Could you share which Git commit you are building?  And using which Guix
> revision, before guix shell, what is the output of “guix describe“?
> 
> 
> 
> 
> > Then if I run make authenticate as stated in the documentation it
> > fails with the error: guix: command not found.
> 
> Yeah, I think that’s expected because ’make’ failed.  Quoting:
> 
>         If anything fails, take a look at installation instructions (*note
>         Installation::) or send a message to the mailing list
>         <guix-devel@gnu.org>.
> 
>            From there on, you can authenticate all the commits included in your
>         checkout by running:
> 
>              make authenticate
> 
> However, hum maybe there is bug with that command on pure environment.
> The manual is maybe inaccurate.
> 
> The Makefile does not run ‘guix git authenticate’ using ./pre-inst-env.
> And that’s probably to ensure the source of trust.  If one corrupt the
> commit that is built, then ’make authenticate’ would authenticate the
> corruption because it would run the corrupted newly built guix command.
> Currently, ’make authenticate’ run one guix command that had already
> been authenticated.  Well, that’s my understanding.

Hmm, but the recipe for the authenticate rule comes from the (possibly)
compromised source, no?  So the attacker can just modify the recipe instead of
the command going the authentication.  Am I missing something?

> 
> 
> Cheers,
> simon
> 

-- 
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]