Re: RFC: Add public macros AC_LOG_CMD and AC_LOG_FILE.

2024-06-26 Thread Zack Weinberg
On Sun, Jun 23, 2024, at 10:23 PM, Zack Weinberg wrote: > I'm thinking of making AC_RUN_LOG, which has existed forever but is > undocumented, an official documented macro under the new name > AC_LOG_CMD. I'm renaming it because I also want to add AC_LOG_FILE, a > generalization of _AC_MSG_LOG_CONF

Re: RFC: Add public macros AC_LOG_CMD and AC_LOG_FILE.

2024-06-26 Thread Karl Berry
Subject: RFC: Add public macros AC_LOG_CMD and AC_LOG_FILE. FWIW, it sounds good to me. To my mind, logging is one of the most important features of autoconf, so I'm all for macros to support it further. --thanks, karl.

Re: RFC: Add public macros AC_LOG_CMD and AC_LOG_FILE.

2024-06-24 Thread Nick Bowler
On 2024-06-24 10:04, Zack Weinberg wrote: > On Mon, Jun 24, 2024, at 2:56 AM, Nick Bowler wrote: >> I think at the same time it would be worth documenting the AS_LINENO >> functionality, which is the main internal functionality of these >> macros that (unless you just

Re: RFC: Add public macros AC_LOG_CMD and AC_LOG_FILE.

2024-06-24 Thread Zack Weinberg
On Mon, Jun 24, 2024, at 2:56 AM, Nick Bowler wrote: > On 2024-06-23 22:23, Zack Weinberg wrote: >> I'm thinking of making AC_RUN_LOG, which has existed forever but is >> undocumented, an official documented macro ... > > Yes, please! > > I will note that Auto

Re: RFC: Add public macros AC_LOG_CMD and AC_LOG_FILE.

2024-06-23 Thread Nick Bowler
On 2024-06-23 22:23, Zack Weinberg wrote: > I'm thinking of making AC_RUN_LOG, which has existed forever but is > undocumented, an official documented macro ... Yes, please! I will note that Autoconf has a lot of "run and log a command" internal macros with various comments

RFC: Add public macros AC_LOG_CMD and AC_LOG_FILE.

2024-06-23 Thread Zack Weinberg
details of why some test got the result it did in config.log; AC_COMPILE_IFELSE and friends have been able to do this forever, but hand-written tests of the shell environment or of interpreters can't without reaching into autoconf's guts. Automake has been carrying around its own copy of A

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-08 Thread Richard Stallman
[[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > I'm currently looking at adding support for this to > https://

Re: GCC reporting piped input as a security feature (was: GNU Coding Standards, automake, and the recent xz-utils backdoor)

2024-04-08 Thread Richard Stallman
[[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > While it does not /prevent/ cracks, there is something we can ensure

Re: GCC reporting piped input as a security feature (was: GNU Coding Standards, automake, and the recent xz-utils backdoor)

2024-04-08 Thread Richard Stallman
[[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > To avoid false positives if this test is used, we might want to add a

Re: detecting modified m4 files (was: GNU Coding Standards, automake, and the recent xz-utils backdoor)

2024-04-07 Thread Jacob Bachmeyer
age. This is something distribution > > maintainers could do without cooperation from upstream. If > > m4/build-to-host.m4 had been recognized as coming from gnulib and > > compared to the copy in gnulib, the nonempty diff would have been > > suspicious. I hav

Re: GCC reporting piped input as a security feature (was: GNU Coding Standards, automake, and the recent xz-utils backdoor)

2024-04-05 Thread Jacob Bachmeyer
Richard Stallman wrote: [[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] [...] When considering any such change, we still s

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-05 Thread Richard Stallman
[[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > > Can anyone think of a feasible way to prevent this sort of at

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-05 Thread Sam James
; > sources before building a package. This is something distribution >> > > maintainers could do without cooperation from upstream. If >> > > m4/build-to-host.m4 had been recognized as coming from gnulib and >> > > compared to the copy in gnulib, t

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-04 Thread Bruno Haible
ge. This is something distribution > > > maintainers could do without cooperation from upstream. If > > > m4/build-to-host.m4 had been recognized as coming from gnulib and > > > compared to the copy in gnulib, the nonempty diff would have been > > >

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-04 Thread Richard Stallman
[[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > > Now for a bit of speculation. I speculate that a cracker w

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-04 Thread Richard Stallman
[[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > I would like to clarify that my purpose in starting this thread wasn&

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-04 Thread Richard Stallman
[[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > > Another related check that /would/ have caught this attem

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-02 Thread Alfred M. Szmidt
[[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > My first thought was that Autoconf is a relatively trivia

Re: compressed release distribution formats (was: GNU Coding Standards, automake, and the recent xz-utils backdoor)

2024-04-02 Thread Jacob Bachmeyer
lzip maintainer might be interested? It is also obvious that having GNU distributions available through only a SINGLE compression format, when that format may be vulnerable, The xz format is not vulnerable, or at least has not been shown to be so in the sense of security risks, and only xz-utils

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-02 Thread Jacob Bachmeyer
Richard Stallman wrote: [[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > My first thought was that Autoconf is a re

Re: checking aclocal m4 files (was: GNU Coding Standards, automake, and the recent xz-utils backdoor)

2024-04-02 Thread Jacob Bachmeyer
cooperation from upstream. If m4/build-to-host.m4 had been recognized as coming from gnulib and compared to the copy in gnulib, the nonempty diff would have been suspicious. True. Note, however, that there would be some false positives: True; all of these are Free Software, so a non-empty diff

Re: binary data in source trees (was: GNU Coding Standards, automake, and the recent xz-utils backdoor)

2024-04-02 Thread Jacob Bachmeyer
Richard Stallman wrote: [[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > The issue seems to be releases containing bin

Re: reproducible dists and builds (was: GNU Coding Standards, automake, and the recent xz-utils backdoor)

2024-04-02 Thread Jacob Bachmeyer
Richard Stallman wrote: [[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > What would be helpful is if `make dis

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-02 Thread Jeffrey Walton
On Tue, Apr 2, 2024 at 6:05 PM Karl Berry wrote: > > I'm also wondering whether the GNU system should recommend using zstd > instead of or in addition to xz for compression purposes. > > I'm not sure GNU explicitly recommends anything. Although the tarball > ex

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-02 Thread Bob Friesenhahn
On 4/2/24 16:42, Richard Stallman wrote: [[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > My first thought was that

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-02 Thread Karl Berry
I'm also wondering whether the GNU system should recommend using zstd instead of or in addition to xz for compression purposes. I'm not sure GNU explicitly recommends anything. Although the tarball examples in standards.texi and maintain.texi all use gz, I don't t

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-02 Thread Bob Friesenhahn
ich has the benefit of a very small implementation and more compact coding than xz uses. I stopped distributing anything but xz format since that is what almost everyone was choosing to download. Bob -- Bob Friesenhahn bfrie...@simple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-02 Thread Richard Stallman
[[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > The issue seems to be releases containing binary data for un

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-02 Thread Richard Stallman
[[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > My first thought was that Autoconf is a relatively trivial attac

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-02 Thread Richard Stallman
[[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > There is not much one can do when a maintainer with signing/release

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-02 Thread Richard Stallman
[[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > There is not much one can do when a maintainer with signing/release

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-02 Thread Richard Stallman
[[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > What would be helpful is if `make dist' would guarantee to pro

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-02 Thread Eric Blake
[adding in coreutils, for some history] On Sat, Mar 30, 2024 at 12:55:35PM -0400, Eric Gallager wrote: > I was recently reading about the backdoor announced in xz-utils the > other day, and one of the things that caught my attention was how > (ab)use of the GNU build system played

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-02 Thread Bruno Haible
rom upstream. If > m4/build-to-host.m4 had been recognized as coming from gnulib and > compared to the copy in gnulib, the nonempty diff would have been > suspicious. True. Note, however, that there would be some false positives: libtool.m4 is often shipped modified, a) if the main

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-02 Thread Jose E. Marchesi
> Jose E. Marchesi wrote: >>> Jose E. Marchesi wrote: >>> >>>>> [...] >>>>> >>>>>> I agree that distcheck is good but not a cure all. Any static >>>>>> system can be attacked when there is

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-01 Thread Jacob Bachmeyer
t caught by such a check, but I want to ensure that we do not end up thinking that we have a solution and the problem is solved and everyone is happy ... and then we get caught out when it happens again. I should clarify also that I think that this proposal *is* a good idea, but we should remai

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-01 Thread Jacob Bachmeyer
Richard Stallman wrote: [[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > `distcheck` target's prominence to re

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-01 Thread Eric Gallager
t; > emerged that doesn't disrupt the world *too* much is that the release > > tarball should differ from the Git tag only in the form of added files. > > > > From what I understand, the xz backdoor would have passed this check. > The backdoor dropper was hidden in t

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-01 Thread Russ Allbery
Jacob Bachmeyer writes: > The m4 files were not checked into the repository, instead being added > (presumably by running autogen.sh with a rigged local m4 file > collection) while preparing the release. Ah, yes, I think you are correct. For some reason I thought the legitimate build-to-host.m4

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-01 Thread Jacob Bachmeyer
Zack Weinberg wrote: On Mon, Apr 1, 2024, at 2:04 PM, Russ Allbery wrote: "Zack Weinberg" writes: It might indeed be worth thinking about ways to minimize the difference between the tarball "make dist" produces and the tarball "git archive" produces, st

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-01 Thread Jacob Bachmeyer
Git tag only in the form of added files. From what I understand, the xz backdoor would have passed this check. The backdoor dropper was hidden in test data files that /were/ in the repository, and required code in the modified build-to-host.m4 to activate it. The m4 files were not c

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-01 Thread Jacob Bachmeyer
the three (and counting) malicious patches that they barefacedly submitted to *other* software and got accepted because the malice was subtle enough to pass through code review.) Exactly. :-/ That said, the whole thing looks to me like the attackers were trying to /not/ hit the more (what i

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-01 Thread Jacob Bachmeyer
Jose E. Marchesi wrote: Jose E. Marchesi wrote: [...] I agree that distcheck is good but not a cure all. Any static system can be attacked when there is motive, and unit tests are easily gamed. The issue seems to be releases containing binary data for

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-01 Thread Richard Stallman
[[[ To any NSA and FBI agents reading my email: please consider]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > `distcheck` target's prominence to recommend it in

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-01 Thread Bruno Haible
Eric Gallager wrote: > What about a 3rd one of these prefixes: "novcs", to teach automake > about which files belong in VCS or not? i.e. then you might have a > variable name like: > dist_novcs_DATA = foo bar baz > ...which would indicate that foo, bar, and baz are data

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-01 Thread Eric Gallager
On Mon, Apr 1, 2024 at 2:26 PM Zack Weinberg wrote: > > On Mon, Apr 1, 2024, at 2:04 PM, Russ Allbery wrote: > > "Zack Weinberg" writes: > >> It might indeed be worth thinking about ways to minimize the > >> difference between the tarball "make dis

Should the GNU Coding Standards make a recommendation about aclocal's `--install` flag? (was: "Re: GNU Coding Standards, automake, and the recent xz-utils backdoor")

2024-04-01 Thread Eric Gallager
nario is that the embedded M4 files are not the latest version > and that the code in configure.ac is not compatible with newer versions that > might be installed. Setting the --install flag and make every developer > bootstrap with 'aclocal --install' or anyone trying to bootst

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-01 Thread Zack Weinberg
On Mon, Apr 1, 2024, at 2:04 PM, Russ Allbery wrote: > "Zack Weinberg" writes: >> It might indeed be worth thinking about ways to minimize the >> difference between the tarball "make dist" produces and the tarball >> "git archive" produces, sta

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-01 Thread Russ Allbery
"Zack Weinberg" writes: > I have been thinking about this incident and this thread all weekend and > have seen a lot of people saying things like "this is more proof that > tarballs are a thing of the past and everyone should just build straight > from git". Ther

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-01 Thread Zack Weinberg
bout automake's `distcheck` >> target, whose entire purpose is to make it easier to verify that a >> distribution tarball can be rebuilt from itself and contains all the >> things it ought to contain. > > The problem is that a release tarball is a freestanding object, with no &g

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-04-01 Thread Jose E. Marchesi
> Jose E. Marchesi wrote: >>> [...] >>> >>>> I agree that distcheck is good but not a cure all. Any static >>>> system can be attacked when there is motive, and unit tests are >>>> easily gamed. >>>> >

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-31 Thread Jacob Bachmeyer
Tomas Volf wrote: On 2024-03-31 14:50:47 -0400, Eric Gallager wrote: With a reproducible build system, multiple maintainers can "make dist" and compare the output to cross-check for erroneous / malicious dist environments. Multiple signatures should be harder to compromise, assumi

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-31 Thread Jacob Bachmeyer
something else, instead of packaging it in the release. The xz-utils backdoor was smuggled into the repository wrapped in compressed test data. With a reproducible build system, multiple maintainers can "make dist" and compare the output to cross-check for erroneous / malicious dist en

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-31 Thread Jacob Bachmeyer
Jose E. Marchesi wrote: [...] I agree that distcheck is good but not a cure all. Any static system can be attacked when there is motive, and unit tests are easily gamed. The issue seems to be releases containing binary data for unit tests, instead of source or scripts to generate

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-31 Thread Peter Johansson
ter to put `--install` in `ACLOCAL_AMFLAGS` or not? Or would such a recommendation be a better fit for the `automake` manual (since that's where `aclocal` comes from)? A common scenario is that the embedded M4 files are not the latest version and that the code in configure.ac is not compatible with

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-31 Thread Tomas Volf
On 2024-03-31 14:50:47 -0400, Eric Gallager wrote: > > > With a reproducible build system, multiple maintainers can "make dist" > > > and compare the output to cross-check for erroneous / malicious dist > > > environments. Multiple signatures should be hard

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-31 Thread Eric Gallager
On Sun, Mar 31, 2024 at 3:54 PM Russ Allbery wrote: > > Eric Gallager writes: > > > Well, other people besides the maintainers can also run `make dist` and > > `make distcheck`. My idea was to get end-users in the habit of running > > `make distcheck` themselves befo

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-31 Thread Russ Allbery
Eric Gallager writes: > Well, other people besides the maintainers can also run `make dist` and > `make distcheck`. My idea was to get end-users in the habit of running > `make distcheck` themselves before installing stuff. And if that's too > much to ask of end users, I'

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-31 Thread Eric Gallager
; >>> these checks as well, then? > >> > >> The first mentioned check can not be automated. ... > >> > >> The second mentioned check could be done by the maintainer, ... > > > > > > I agree that distcheck is good but not a cure all. An

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-31 Thread Jose E. Marchesi
> [...] >> I agree that distcheck is good but not a cure all. Any static >> system can be attacked when there is motive, and unit tests are >> easily gamed. > > The issue seems to be releases containing binary data for unit tests, > instead of source or scripts t

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-31 Thread Alfred M. Szmidt
tered, automake or not, would not have mattered. The individual could have sneaked in code changes into the release tar-ball just as well -- Github presented two sets of files one could download (direct from git, and "release"). The deviousness of this backdoor should not be understated, it was

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-31 Thread Alfred M. Szmidt
> It is not yet clear if the > maintainer intentionally did this, or if the changes were introduced via > a compromise of his computer. I think it is pretty clear by now. [1][2][3] There is a bit more to it all than just this -- the maintainer wasn't responsible (Lasse Collin), the

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-31 Thread Bob Friesenhahn
something intentionally wrong. My GraphicsMagick oss-fuzz builds include xz and are still working (but with a few security issues open due to problems in xz). The URL used is https://github.com/xz-mirror/xz. When I visit that URL, I see this message "This repository has been archived by the

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-31 Thread Bruno Haible
Bob Friesenhahn wrote: > It is not yet clear if the > maintainer intentionally did this, or if the changes were introduced via > a compromise of his computer. I think it is pretty clear by now. [1][2][3] [1] https://boehs.org/node/everything-i-know-about-the-xz-backdoor [2] https://news.ycombin

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-31 Thread Bob Friesenhahn
oot off secure media and then use the tools in it to look for the rootkit in the potentially-compromised system, *without* handing control over to it. I am on the oss-security mailing list where this issue was perhaps first publicly reported, and has been discussed/analyzed furiously. My fi

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-31 Thread Jacob Bachmeyer
y the maintainer, ... I agree that distcheck is good but not a cure all. Any static system can be attacked when there is motive, and unit tests are easily gamed. The issue seems to be releases containing binary data for unit tests, instead of source or scripts to generate that data. In this case,

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-31 Thread Jacob Bachmeyer
ify that a distribution tarball can be rebuilt from itself and contains all the things it ought to contain. The problem is that a release tarball is a freestanding object, with no dependency on the repository from which it was produced. In this case, the attacker added a bogus "update" of b

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-30 Thread Alexandre Oliva
On Mar 30, 2024, Eric Gallager wrote: > automake's `distcheck` target, whose entire purpose is to make it > easier to verify that a distribution tarball can be rebuilt from > itself and contains all the things it ought to contain. > Recommending the `distcheck` target to a

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-30 Thread dherring
that distcheck is good but not a cure all. Any static system can be attacked when there is motive, and unit tests are easily gamed. With a reproducible build system, multiple maintainers can "make dist" and compare the output to cross-check for erroneous / malicious dist environm

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-30 Thread Bruno Haible
` target be updated to perform > these checks as well, then? The first mentioned check can not be automated. It can only be done by the maintainer / release manager, reviewing the list of added files and matching them against the list of added features or tests since the last release. The s

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-30 Thread Eric Gallager
On Sat, Mar 30, 2024 at 5:41 PM Bruno Haible wrote: > > Eric Gallager wrote: > > Recommending the `distcheck` target to a wider variety of users would > > help more projects catch mismatches between things a distribution > > tarball is supposed to contain, and things

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-30 Thread Bruno Haible
Eric Gallager wrote: > Recommending the `distcheck` target to a wider variety of users would > help more projects catch mismatches between things a distribution > tarball is supposed to contain, and things that it isn't. While 'make distcheck' detects some of these mismat

Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-30 Thread Karl Berry
hat's still rms (for anything substantive) FWIW, I expect that few users would actually run make distcheck, regardless of anything in the GCS. And of those that do, I suspect there would be many failures because make distcheck is a complex target that is not, so far as I understand it, intended to

GNU Coding Standards, automake, and the recent xz-utils backdoor

2024-03-30 Thread Eric Gallager
I was recently reading about the backdoor announced in xz-utils the other day, and one of the things that caught my attention was how (ab)use of the GNU build system played a role in allowing the backdoor to go unnoticed: https://openwall.com/lists/oss-security/2024/03/29/4 Specifically, what

Re: Typo in NEWS section "New in 1.17" and "New in 1.15"

2023-12-26 Thread Karl Berry
x27;s ok. I have not systematically looked for typos in any of the "New in ..." sections older than 1.17. I ran a spell checker and nothing obvious showed up. Not that that's conclusive, but it will have to do :). --thanks, karl.

Typo in NEWS section "New in 1.17" and "New in 1.15"

2023-12-25 Thread Hans Ulrich Niedermann
upported, a new line `Features: subsecond-mtime' is printed by -automake --version (and autom4mte --version). (bug#64756, bug#67670) +automake --version (and autom4te --version). (bug#64756, bug#67670) - The default value of $ARFLAGS is now "cr" instead of "cru",

Re: Setting libXXX_la_CPPFLAGS and libXXX_la_CFLAGS erases AM_CPPFLAGS and AM_CFLAGS

2022-11-19 Thread Jan Engelhardt
On Saturday 2022-11-19 09:11, madmurphy wrote: >I guess it does make sense. But then what might be missing to Automake are >libXXX_la_AM_CFLAGS, libXXX_la_AM_CPPFLAGS and libXXX_la_AM_LDFLAGS >variables, in which the global AM_CFLAGS, AM_CPPFLAGS and AM_LDFLAGS are >automatically pas

Re: Setting libXXX_la_CPPFLAGS and libXXX_la_CFLAGS erases AM_CPPFLAGS and AM_CFLAGS

2022-11-19 Thread madmurphy
I guess it does make sense. But then what might be missing to Automake are libXXX_la_AM_CFLAGS, libXXX_la_AM_CPPFLAGS and libXXX_la_AM_LDFLAGS variables, in which the global AM_CFLAGS, AM_CPPFLAGS and AM_LDFLAGS are automatically pasted (whereas the corresponding versions without the AM_ prefix

Re: Setting libXXX_la_CPPFLAGS and libXXX_la_CFLAGS erases AM_CPPFLAGS and AM_CFLAGS

2022-11-18 Thread Jan Engelhardt
On Friday 2022-11-18 22:57, Russ Allbery wrote: >madmurphy writes: > >> However, if at the same time I set also the libfoo_la_CPPFLAGS variable (no >> matter the content), as in the following example, > >> AM_CPPFLAGS = \ >> "-DLIBFOO_BUILD_MESSAGE=\"correctly defined via AM_CPPFLAGS\"" >>

Re: Setting libXXX_la_CPPFLAGS and libXXX_la_CFLAGS erases AM_CPPFLAGS and AM_CFLAGS

2022-11-18 Thread Russ Allbery
_CPPFLAGS = \ >"-DLIBFOO_DUMMY=\"This is just a dummy text\"" > the AM_CPPFLAGS variable will be completely overwritten by the > libfoo_la_CPPFLAGS variable, and invoking libfoo_func() will print > Message from the build system: undefined While this is ofte

Setting libXXX_la_CPPFLAGS and libXXX_la_CFLAGS erases AM_CPPFLAGS and AM_CFLAGS

2022-11-18 Thread madmurphy
quot; LIBFOO_BUILD_MESSAGE "\n"); return 0; } and then I set the LIBFOO_BUILD_MESSAGE preprocessor macro via Makefile.am, AM_CPPFLAGS = \ "-DLIBFOO_BUILD_MESSAGE=\"correctly defined via AM_CPPFLAGS\"" invoking libfoo_func() from a linked program will correc

Re: Wrong order of preprocessor and compiler flags

2022-03-28 Thread Evgeny Grin
Hello Alex, On 28.03.2022 4:55, Alex Ameen wrote: This is a message I meant send to "all", I'm sending again for the wider discussion. Please let me know if my understanding of include order is incorrect. Essentially I'm more concerned about relative placement of `AM_CPPF

Re: Wrong order of preprocessor and compiler flags

2022-03-28 Thread Evgeny Grin
ep is to write bug-standa...@gnu.org and suggest clarifying the status of CPPFLAGS, its relationship to CFLAGS, etc. Definitely makes sense. I'll write to the standards list. We could consider changing automake to follow autoconf even if the GCS is not changed, but it would be better if th

Re: Wrong order of preprocessor and compiler flags

2022-03-27 Thread Alex Ameen
This is a message I meant send to "all", I'm sending again for the wider discussion. Please let me know if my understanding of include order is incorrect. Essentially I'm more concerned about relative placement of `AM_CPPFLAGS' and `CPPFLAGS' in any future changes.

Re: Wrong order of preprocessor and compiler flags

2022-03-27 Thread Bob Friesenhahn
ample descriptions where CPPFLAGS comes after CFLAGS/FFLAGS/etc., and sometimes reversed. I think that this is because it was always assumed that the order does not matter. Bob -- Bob Friesenhahn bfrie...@simple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer,

Re: Wrong order of preprocessor and compiler flags

2022-03-27 Thread Jan Engelhardt
r otherwise, at least that's the way make comes across. Some software will just break on `make CFLAGS=-O3` and others will work to compile. As for automake, AM_CPPFLAGS was introduced at the same time as AM_CFLAGS as per the git log. So CPPFLAGS always was a user variable. >[more on CFLAGS

Re: Wrong order of preprocessor and compiler flags

2022-03-27 Thread Karl Berry
iables does not clearly state it one way or another. But its example shows CFLAGS after CPPFLAGS. Thus I think a prior step is to write bug-standa...@gnu.org and suggest clarifying the status of CPPFLAGS, its relationship to CFLAGS, etc. We could consider changing automake to follow autoconf even if

Wrong order of preprocessor and compiler flags

2022-03-27 Thread Evgeny Grin
Hello, This discussion was started initially in the autoconf list. [1] Automake and autoconf use compiler and preprocessor flags in different order. Within 'configure' scripts, compile checks/tests are performed as [2]: $CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&AS_M

Re: type errors, command length limits, and Awk

2022-02-15 Thread Jacob Bachmeyer
files" | $(am__pep3147_tweak) | $(am__base_list) | \ It seems that the problem is that am__base_list expects ListOf/File (and produces ChunkedListOf/File) but am__pep3147_tweak emits ListOf/Glob. This works in the usual case because the shell implicitly converts Glob -> ListOf/File a

Re: type errors, command length limits, and Awk (was: portability of xargs)

2022-02-15 Thread Dan Kegel
FWIW, commandline length limits are a real thing, I've run into them with Make, CMake, and Meson. I did some work to help address them in Meson, see e.g. https://github.com/mesonbuild/meson/issues/7212 And just for fun, here's a vaguely related changelog entry from long ago, back when t

Re: type errors, command length limits, and Awk (was: portability of xargs)

2022-02-15 Thread Mike Frysinger
$(am__base_list) | \ > It seems that the problem is that am__base_list expects ListOf/File (and > produces ChunkedListOf/File) but am__pep3147_tweak emits ListOf/Glob. > This works in the usual case because the shell implicitly converts Glob > -> ListOf/File and implicitly fl

type errors, command length limits, and Awk (was: portability of xargs)

2022-02-15 Thread Jacob Bachmeyer
Mike Frysinger wrote: context: https://bugs.gnu.org/53340 Looking at the highlighted line in the context: > echo "$$py_files" | $(am__pep3147_tweak) | $(am__base_list) | \ It seems that the problem is that am__base_list expects ListOf/File (and produces ChunkedLis

Re: automake 1.16.4 and new PYTHON_PREFIX

2021-09-23 Thread Karl Berry
If anyone who weighed in on the Python prefix stuff (or didn't, for that matter) has a chance to try the new pretest at https://meyering.net/automake/automake-1.16g.tar.xz that'd be great. It'd be nice not to have to do another patch-up release. Thanks, Karl

Re: automake 1.16.4 and new PYTHON_PREFIX

2021-09-19 Thread Karl Berry
hon values. The --with-python_[exec_]prefix options are still present and unchanged, setting the prefixes explicitly. It would be really fantastic if there could be some testing of this by other people before we push out another problematic release. Jim, could you roll a test release please? --th

Re: automake 1.16.4 and new PYTHON_PREFIX

2021-08-26 Thread Karl Berry
I think we need an easy way to set a default for this behaviour from within configure.ac, similar to AC_PREFIX_DEFAULT(), so that the end-user doesn't have to pass a bunch of options to configure just to get the build to work sensibly. I have nothing against the idea, but my immedi

Re: automake 1.16.4 and new PYTHON_PREFIX

2021-08-26 Thread Luke Mewburn
On 21-08-25 10:00, Karl Berry wrote: | yf> Would keeping PYTHON_PREFIX but changing its default to the | "classical" value be a working solution for this ? | | Yes, I think we should. And I think I should have been smart enough to | realize that changing the default

Re: automake 1.16.4 and new PYTHON_PREFIX

2021-08-25 Thread Karl Berry
yf> Would keeping PYTHON_PREFIX but changing its default to the "classical" value be a working solution for this ? Yes, I think we should. And I think I should have been smart enough to realize that changing the default behavior was too risky in the first place. Apologies

Re: automake 1.16.4 and new PYTHON_PREFIX

2021-08-25 Thread Joshua Root
On 2021-8-25 10:14 , Karl Berry wrote: Ok, I guess we'll have to revert the Python change and make another release. I was worried about the change. But I am not sure of how best to deal with the intended benefits. Joshua, can you please take a look at these reports and advise?

Re: automake 1.16.4 and new PYTHON_PREFIX

2021-08-24 Thread FOURNIER Yvan via Discussion list for automake
Hello, Would keeping PYTHON_PREFIX but changing its default to the "classical" value be a working solution for this ? Best regards, Yvan Le 25 août 2021 07:08, j...@macports.org a écrit : On 2021-8-25 10:14 , Karl Berry wrote: > Ok, I guess we'll have to revert the Pyth

RE: automake 1.16.4 and new PYTHON_PREFIX

2021-08-24 Thread Karl Berry
Ok, I guess we'll have to revert the Python change and make another release. I was worried about the change. But I am not sure of how best to deal with the intended benefits. Joshua, can you please take a look at these reports and advise? https://lists.gnu.org/archive/html/automake/20

  1   2   3   4   5   6   7   8   9   10   >