Re: xz backdoor

[Kaelyn]

Hi Reza,

On Monday, April 1st, 2024 at 12:46 PM, Reza Housseini 
<reza.housseini@gmail.com> wrote:

> 
> 
> Hi Guixers
> 
> Just stumbled upon this recently discovered supply chain attack on xz,
> inserting a backdoor via test files [1, 2]. And it made me wondering,
> what would have been the effects on guix and how can we potentially
> avoid it?

Thank you for your email about the xz backdoor! To hopefully help with your 
questions, there has already been some discussion on guix-devel about the 
backdoor and how it should be handled now and in the future:

https://lists.gnu.org/archive/html/guix-devel/2024-03/msg00281.html
https://lists.gnu.org/archive/html/guix-devel/2024-03/msg00292.html

The quick summary is that Guix currently shouldn't be affected because a) Guix 
currently packages xz 5.2.8, which predates the backdoor, and b) the backdoor 
includes checks based on absolute paths e.g. under /usr and Guix executable 
paths generally don't match the patterns checked for.

Cheers,
Kaelyn

> Stay safe!
> Reza
> 
> [1] https://www.openwall.com/lists/oss-security/2024/03/29/4
> [2] https://access.redhat.com/security/cve/cve-2024-3094#cve-cvss-v3