Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

[dherring]

On 2024-03-30 18:25, Bruno Haible wrote:
> Eric Gallager wrote:
> > Hm, so should automake's `distcheck` target be updated to perform
> > these checks as well, then?
>
> The first mentioned check can not be automated. ...
>
> The second mentioned check could be done by the maintainer, ...


I agree that distcheck is good but not a cure all.  Any static system 
can be attacked when there is motive, and unit tests are easily gamed.

With a reproducible build system, multiple maintainers can "make dist" 
and compare the output to cross-check for erroneous / malicious dist 
environments.  Multiple signatures should be harder to compromise, 
assuming each is independent and generally trustworthy.

Maybe GNU should establish a cross-verification signing standard and 
"dist verification service" that automates this process?  Point it to a 
repo and tag, request a signed hash of the dist package...  Then 
downstream projects could check package signatures from both the 
maintainer and such third-party verifiers to check that nothing was 
inserted outside of version control.

-- Daniel