From: Attila Lendvai <attila@lendvai.name>
To: Giovanni Biscuolo <g@xelera.eu>
Cc: Guix Devel <guix-devel@gnu.org>,
guix-security@gnu.org, Felix Lechner <felix.lechner@lease-up.com>,
Ryan Prior <rprior@protonmail.com>
Subject: Re: backdoor injection via release tarballs combined with binary artifacts (was Re: Backdoor in upstream xz-utils)
Date: Thu, 04 Apr 2024 15:12:47 +0000 [thread overview]
Message-ID: <ej6CddUWvoIGMJk3OdIqqGjerMbMLxwoMTbXbVwgwK2Ifu4P2tch-P6d0JcsKknTNQ48CQdzvnD5Ro7PlENE8tts7rmQ9DikSfVxY5lmX1U=@lendvai.name> (raw)
In-Reply-To: <8734s1mn5p.fsf@xelera.eu>
> Also, in (info "(guix) origin Reference") I see that Guix packages can have a
> list of uri(s) for the origin of source code, see xz as an example [7]:
> are they intended to be multiple independent sources to be compared in
> order to prevent possible tampering or are they "just" alternatives to
> be used if the first listed uri is unavailable?
a source origin is identified by its cryptographic hash (stored in its sha256 field); i.e. it doesn't matter *where* the source archive was acquired from. if the hash matches the one in the package definition, then it's the same archive that the guix packager has seen while packaging.
--
• attila lendvai
• PGP: 963F 5D5F 45C7 DFCD 0A39
--
“We’ll know our disinformation program is complete when everything the American public believes is false.”
— William Casey (1913–1987), the director of CIA 1981-1987
next prev parent reply other threads:[~2024-04-04 15:13 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-29 20:57 Backdoor in upstream xz-utils John Kehayias
2024-03-29 17:51 ` Ryan Prior
2024-03-29 20:39 ` Felix Lechner via Development of GNU Guix and the GNU System distribution.
2024-03-29 20:55 ` Tomas Volf
2024-03-30 21:02 ` Ricardo Wurmus
2024-04-04 10:34 ` backdoor injection via release tarballs combined with binary artifacts (was Re: Backdoor in upstream xz-utils) Giovanni Biscuolo
2024-04-04 15:12 ` Attila Lendvai [this message]
2024-04-04 16:47 ` Giovanni Biscuolo
2024-04-04 15:47 ` Giovanni Biscuolo
2024-04-04 19:48 ` Attila Lendvai
2024-04-04 20:32 ` Ekaitz Zarraga
2024-04-10 13:57 ` Ludovic Courtès
2024-04-11 12:43 ` Andreas Enge
2024-04-11 12:56 ` Ekaitz Zarraga
2024-04-11 13:49 ` Andreas Enge
2024-04-11 14:05 ` Ekaitz Zarraga
2024-04-13 0:14 ` Skyler Ferris
2024-04-19 14:31 ` Ludovic Courtès
2024-04-13 6:50 ` Giovanni Biscuolo
2024-04-13 10:26 ` Skyler Ferris
2024-04-13 12:47 ` Giovanni Biscuolo
2024-04-14 16:22 ` Skyler Ferris
2024-04-12 13:09 ` Attila Lendvai
2024-04-12 20:42 ` Ludovic Courtès
2024-04-13 6:13 ` Giovanni Biscuolo
2024-05-07 18:22 ` 3 kinds of bootstrap (was Re: backdoor injection via release tarballs combined with binary artifacts) Simon Tournier
2024-04-05 10:13 ` backdoor injection via release tarballs combined with binary artifacts (was Re: Backdoor in upstream xz-utils) Giovanni Biscuolo
2024-04-05 14:51 ` Attila Lendvai
2024-04-13 7:42 ` Giovanni Biscuolo
2024-04-04 23:03 ` Ricardo Wurmus
2024-04-05 7:06 ` Giovanni Biscuolo
2024-04-05 7:39 ` Ricardo Wurmus
2024-04-05 16:52 ` Jan Wielkiewicz
2024-03-31 15:04 ` Backdoor in upstream xz-utils Rostislav Svoboda
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='ej6CddUWvoIGMJk3OdIqqGjerMbMLxwoMTbXbVwgwK2Ifu4P2tch-P6d0JcsKknTNQ48CQdzvnD5Ro7PlENE8tts7rmQ9DikSfVxY5lmX1U=@lendvai.name' \
--to=attila@lendvai.name \
--cc=felix.lechner@lease-up.com \
--cc=g@xelera.eu \
--cc=guix-devel@gnu.org \
--cc=guix-security@gnu.org \
--cc=rprior@protonmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.