From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ben Woodcroft Subject: Re: ISO image available for testing! Date: Wed, 6 Dec 2017 11:17:30 +1000 Message-ID: References: <877f16z9eo.fsf@gnu.org> <87infv54m3.fsf@gnu.org> <87efqgnn7x.fsf@elephly.net> <878teo59tb.fsf@gnu.org> <20171201183042.GB2504@jasmine.lan> <87tvxadz11.fsf@elephly.net> <87lgiirhsf.fsf_-_@gnu.org> <874lp618iy.fsf@cbaines.net> <87shcoaj2w.fsf@gnu.org> <87bmjcvft3.fsf@netris.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:60267) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eMOLJ-0005vh-H1 for guix-devel@gnu.org; Tue, 05 Dec 2017 20:17:46 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eMOLE-0005FT-JZ for guix-devel@gnu.org; Tue, 05 Dec 2017 20:17:45 -0500 In-Reply-To: <87bmjcvft3.fsf@netris.org> Content-Language: en-US List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Mark H Weaver , =?UTF-8?Q?Ludovic_Court=c3=a8s?= Cc: guix-devel On 06/12/17 10:52, Mark H Weaver wrote: > Hi Ludovic, > > ludo@gnu.org (Ludovic Court=C3=A8s) writes: >> 91c9b5d01 * packages: 'package-grafts' trims native inputs. > [...] > >> Long story short: we were flagging native inputs as potential sources = of >> grafts even though, by definition, native inputs are not referred to a= t >> run time. > I agree that this *should* never happen, but I see little reason for > confidence that it never happens in actual fact. > > What would happen if a reference to a native-input *was* present in the > build outputs? The reason I ask is that, for security reasons, it's > obviously very important to reliably avoid using ungrafted software at > run time. > > I'm concerned that this recent change could cause minor > nearly-undetectable packaging mistakes to become major security holes. > > One solution would be to explicitly check build outputs for references > to native-inputs, and to force a build failure in that case. I believe there are a number of cases of this that happen when binaries=20 are wrapped with paths derived from getenv, e.g. this phase in bamm: =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (add-after 'install 'wr= ap-executable =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (lambda* (#= :key outputs #:allow-other-keys) =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (let*= ((out=C2=A0 (assoc-ref outputs "out")) =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (path (getenv "PATH"))) =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0 (wrap-program (string-append out "/bin/bamm") =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 `("PATH" ":" prefix (,path)))) =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 #t)) It would be good to stop using getenv for this, for the reasons=20 described here and others e.g. non-reproducibility, unnecessary=20 dependencies etc. Is there some easy way to "getenv" excluding unwanted components of an=20 environment variable? Thanks, ben