Re: backdoor injection via release tarballs combined with binary artifacts (was Re: Backdoor in upstream xz-utils)

[Attila Lendvai <attila@lendvai.name>]

> Are really "configure scripts containing hundreds of thousands of lines
> of code not present in the upstream VCS" the norm?


pretty much for all C and C++ projects that use autoconf... which is numerous, especially among the core GNU components.


> If so, can we consider hundreds of thousand of lines of configure
> scripts and other (auto)generated files bundled in release tarballs
> "pragmatically impossible" to be peer reviewed?


yes.


> Can we consider that artifacts as sort-of-binary and "force" our
> build-systems to regenerate all them?


that would be a good practice.


> ...or is it better to completely avoid release tarballs as our sources
> uris?


yes, and this^ would guarantee the previous point, but it's not always trivial.

as an example see this: https://issues.guix.gnu.org/61750

in short: when building shepherd from git the man files need to be generated using the program help2man. this invokes the binary with --help and formats the output as a man page. the usefulness of this is questionable, but the point is that it breaks crosscompilation, because the host cannot execute the target binary.

but these generated man files are part of the release tarball, so cross compilation works fine using the tarball.

all in all, just by following my gut insctincts, i was advodating for building everything from git even before the exposure of this backdoor. in fact, i found it surprising as a guix newbie that not everything is built from git (or their VCS of choice).

-- 
• attila lendvai
• PGP: 963F 5D5F 45C7 DFCD 0A39
--
“For if you [the rulers] suffer your people to be ill-educated, and their manners to be corrupted from their infancy, and then punish them for those crimes to which their first education disposed them, what else is to be concluded from this, but that you first make thieves [and outlaws] and then punish them.”
	— Sir Thomas More (1478–1535), 'Utopia', Book 1