Re: Sourceware mitigating and preventing the next xz-backdoor

2024-04-09 Thread Jonathon Anderson via Gcc
On Tue, 2024-04-09 at 14:50 -0700, Paul Eggert wrote: > On 4/9/24 14:40, Jeffrey Walton wrote: > > > Code provenance and code integrity was not enforced. Part of the > > problem is the Autotools design. It is from a bygone era. > > > No, Andreas is right. This isn't an Autotools-vs-Meson thing.

Re: Sourceware mitigating and preventing the next xz-backdoor

2024-04-09 Thread Jonathon Anderson via Gcc
On Tue, 2024-04-09 at 16:11 -0400, Paul Koning wrote: > > On Apr 9, 2024, at 3:59 PM, Jonathon Anderson via Gcc > <[gcc@gcc.gnu.org](mailto:gcc@gcc.gnu.org)> wrote: > > > CMake has its own sandbox and rules and escapes (granted, much more of > > them). But regard

Re: Sourceware mitigating and preventing the next xz-backdoor

2024-04-09 Thread Jonathon Anderson via Gcc
On Tue, Apr 9, 2024, 10:57 Andreas Schwab wrote: > On Apr 09 2024, anderson.jonath...@gmail.com wrote: > > > - This xz backdoor injection unpacked attacker-controlled files and ran > them during `configure`. Newer build systems implement a build abstraction > (aka DSL) that acts similar to a

Re: Sourceware mitigating and preventing the next xz-backdoor

2024-04-03 Thread Jonathon Anderson via Gcc
Hello all, On Wed, 2024-04-03 at 16:00 +0200, Michael Matz wrote: > > My take a way is that software needs to become less complex. Do  > > we really still need complex build systems such as autoconf? > > (And, FWIW, testing for features isn't "complex". And have you looked at > other build