unofficial mirror of guix-patches@gnu.org 
 help / color / mirror / code / Atom feed
From: Mark H Weaver <mhw@netris.org>
To: leo@famulari.name, 43173@debbugs.gnu.org
Cc: Maxim Cournoyer <maxim.cournoyer@gmail.com>
Subject: [bug#43173] Ensure that the correct linux-libre deblobbing scripts are used
Date: Wed, 02 Sep 2020 17:07:56 -0400	[thread overview]
Message-ID: <87363z28fs.fsf@netris.org> (raw)
In-Reply-To: <20200902182922.GA26301@jasmine.lan>

Leo Famulari <leo@famulari.name> writes:

> In recent discussions [0], people raised the possibility that we might
> accidentally leave non-free firmware blobs in our linux-libre packages.
>
> If I understand correctly, the root of the issue is that, currently, we
> manually specify the versions of the deblobbing scripts. They are not
> changed with every linux-libre release, so it is usually okay to use an
> older version number — the scripts themselves will be identical.
> However, sometimes the scripts do change, and we might not notice, and
> thus we would fail to remove every blob from the kernel sources.
>
> These two patches should make that failure mode impossible, by 1) making
> sure that the file names of the deblobbing scripts' store items include
> the full version number of the kernel and 2) only defining the version
> in one place. The hashes of the deblob scripts will be checked
> automatically when Guix downloads them for each new kernel release.
[...]
> [0] https://lists.gnu.org/archive/html/guix-devel/2020-08/msg00040.html

In the aforementioned discussion, I agreed to either:

(1) Wait until the linux-libre project publishes a new release, or
(2) Check for new blobs myself in the upstream release.

Since then, I've actually chosen option (2) a couple of times.  I did so
by reviewing each of the upstream commits looking for new blobs.
I found that it took on the order of 10-15 minutes per release.

With this proposed change, we will lose an easy way to exercise option
(2), and will effectively be constrained to always wait until
linux-libre produces a new release.

I'll leave it to the maintainers to decide what to do here, but I wanted
to make it clear what's at stake.  Personally, I do not find Jason and
Alexandre's arguments compelling, and would be in favor of retaining the
option to push these security updates more quickly by checking for new
blobs manually.

     Thanks,
       Mark




  parent reply	other threads:[~2020-09-02 21:10 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-02 18:29 [bug#43173] Ensure that the correct linux-libre deblobbing scripts are used Leo Famulari
2020-09-02 18:30 ` [bug#43173] [PATCH 1/2] gnu: Do not truncate the version of the linux-libre deblobbing script file names Leo Famulari
2020-09-02 18:30   ` [bug#43173] [PATCH 2/2] gnu: linux-libre: Enforce the use of the correct deblobbing scripts Leo Famulari
2020-09-02 21:07 ` Mark H Weaver [this message]
2020-09-02 22:15   ` [bug#43173] Ensure that the correct linux-libre deblobbing scripts are used Leo Famulari
2020-09-02 23:53     ` Mark H Weaver
     [not found]       ` <87h7sedz0w.fsf_-_@gmail.com>
2020-09-04 15:21         ` [bug#43160] Validate the result of our linux-libre sources clean up Mark H Weaver
2020-09-07 19:25           ` Maxim Cournoyer
2020-09-07 23:38             ` Mark H Weaver
2020-09-01 20:38               ` [bug#43160] [PATCH] gnu: linux-libre: Use Python 3 in make-linux-libre-source Maxim Cournoyer
2020-09-01 20:41                 ` [bug#43160] [PATCH 1/2] gnu: make-linux-libre-source: Set output port buffering to line mode Maxim Cournoyer
2020-09-01 20:41                   ` [bug#43160] [PATCH 2/2] gnu: linux-libre: Validate that the cleaned up tarball is free of blobs Maxim Cournoyer
2020-09-02 12:56                 ` [bug#43160] [PATCH v2 1/4] gnu: linux-libre: Use Python 3 in make-linux-libre-source Maxim Cournoyer
2020-09-02 12:56                   ` [bug#43160] [PATCH v2 2/4] gnu: make-linux-libre-source: Set output port buffering to line mode Maxim Cournoyer
2020-09-02 12:56                   ` [bug#43160] [PATCH v2 3/4] gnu: linux-libre: Validate that the cleaned up tarball is free of blobs Maxim Cournoyer
2020-09-02 12:56                   ` [bug#43160] [PATCH v2 4/4] gnu: linux-libre: Compare generated sources against Linux-libre releases Maxim Cournoyer
2020-09-03  5:50                   ` [bug#43160] [PATCH v2 1/4] gnu: linux-libre: Use Python 3 in make-linux-libre-source Mathieu Othacehe
2020-09-03 13:08                     ` Maxim Cournoyer
2020-09-04  6:15                       ` Mathieu Othacehe
2020-09-04 14:45                         ` Mike Rosset
2020-09-05  1:51                         ` Maxim Cournoyer
2020-09-11  1:53                 ` [bug#43160] Validate the result of our linux-libre sources clean up Maxim Cournoyer
2020-09-11 14:44               ` [bug#43160] [PATCH v3 1/2] gnu: linux-libre: Compare generated sources against Linux-libre releases Maxim Cournoyer
2020-09-11 14:44                 ` [bug#43160] [PATCH v3 2/2] linux-libre: Enable multi-core xz compression during tarball generation Maxim Cournoyer
2020-09-12 17:07                 ` [bug#43160] [PATCH v3 1/2] gnu: linux-libre: Compare generated sources against Linux-libre releases Mark H Weaver
2020-09-13 23:50                   ` Maxim Cournoyer
2020-09-15 10:33                     ` Mark H Weaver
2021-04-22  6:35                     ` Mark H Weaver
2023-07-27 16:18                       ` bug#43160: linux-libre: compare guix-generated sources against upstream releases Maxim Cournoyer
2020-09-05 19:04       ` [bug#43173] Ensure that the correct linux-libre deblobbing scripts are used Leo Famulari
2020-09-05 23:07         ` Mark H Weaver
2020-09-06 20:01           ` bug#43173: " Leo Famulari

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://guix.gnu.org/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87363z28fs.fsf@netris.org \
    --to=mhw@netris.org \
    --cc=43173@debbugs.gnu.org \
    --cc=leo@famulari.name \
    --cc=maxim.cournoyer@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).