Re: backdoor injection via release tarballs combined with binary artifacts (was Re: Backdoor in upstream xz-utils)

[Attila Lendvai]

> Are really "configure scripts containing hundreds of thousands of lines
> of code not present in the upstream VCS" the norm?


pretty much for all C and C++ projects that use autoconf... which is numerous, 
especially among the core GNU components.


> If so, can we consider hundreds of thousand of lines of configure
> scripts and other (auto)generated files bundled in release tarballs
> "pragmatically impossible" to be peer reviewed?


yes.


> Can we consider that artifacts as sort-of-binary and "force" our
> build-systems to regenerate all them?


that would be a good practice.


> ...or is it better to completely avoid release tarballs as our sources
> uris?


yes, and this^ would guarantee the previous point, but it's not always trivial.

as an example see this: https://issues.guix.gnu.org/61750

in short: when building shepherd from git the man files need to be generated 
using the program help2man. this invokes the binary with --help and formats the 
output as a man page. the usefulness of this is questionable, but the point is 
that it breaks crosscompilation, because the host cannot execute the target 
binary.

but these generated man files are part of the release tarball, so cross 
compilation works fine using the tarball.

all in all, just by following my gut insctincts, i was advodating for building 
everything from git even before the exposure of this backdoor. in fact, i found 
it surprising as a guix newbie that not everything is built from git (or their 
VCS of choice).

-- 
• attila lendvai
• PGP: 963F 5D5F 45C7 DFCD 0A39
--
“For if you [the rulers] suffer your people to be ill-educated, and their 
manners to be corrupted from their infancy, and then punish them for those 
crimes to which their first education disposed them, what else is to be 
concluded from this, but that you first make thieves [and outlaws] and then 
punish them.”
        — Sir Thomas More (1478–1535), 'Utopia', Book 1