Cosmetic changes commits as a potential security risk (was Re: Questionable "cosmetic changes" commits)

[Mark H Weaver]

Hi Raghav,

I asked:
>> Do you have an explanation for why you are removing comments in your
>> "cosmetic changes" commits?

"Raghav Gururajan" <raghavgururajan@disroot.org> replied:
> I think the comments are useful for non-trivial cases.  In these
> definitions, the inputs were propagated because they were mentioned in
> .pc files.  Propagation because of pkg-config is trivial.  So I
> removed the comments.

Thanks for the explanation.

Please keep in mind that every comment in Guix was deliberately put
there by a Guix developer, which means that at least one developer
thought the comment was worth including.

I'm concerned that you felt so confident in your assessment that these
comments were superfluous that you felt justified in removing them
without telling anyone, let alone asking your mentors if they agreed.

My larger concern is that these removals were effectively hidden within
a commit that ostensibly only rearranged and reindented code.

* * *

It occurs to me that commits that rearrange or reindent code are a
potential security risk, because they obscure other changes made within
the same commit.  Even developers who try to keep an eye on changes
being made to Guix tend to simply *assume* that commits like these are
what they claim to be, because it's too tedious to verify them.

If we allow unannounced changes to be obscured within "cosmetic changes"
commits without reprimand, we invite the future possibility of
deliberate corruption of our code base via such commits, by attackers
who have compromised our developers' machines or signing keys.

* * *

Having said all of this, I should also say that I truly appreciate your
contributions, Raghav, and I'm glad that you are here.

      Regards,
        Mark