undefined | Better HN

0 pointsdboreham2y ago0 comments

Something about this I found surprising is that Linux distros are pulling and packaging pre-built binaries from upstream projects. I'd have expected them to build from source.

0 comments

7 comments · 2 top-level

richardwhiuk2y ago· 5 in thread

They were pulling a tarball from upstream and building it - the tarball was compromised.

Lockal2y ago

The answer is not complete. There were 2 ways to pull sources:

bad - https://github.com/tukaani-project/xz/releases/download/...

or:

good - https://github.com/tukaani-project/xz/archive/refs/tags/...

Specifically in Gentoo, there is a note in https://github.com/gentoo/gentoo/blob/master/app-arch/xz-uti...

  # Remember: we cannot leverage autotools in this ebuild in order
  #           to avoid circular deps with autotools

Namely, to unpack autoconf-2.72e.tar.xz from gnu.org you need xz-tools. And this is just the shortest circle. It is not very common, but xz-utils was one of few rare cases where regeneration of autohell files was considered as unnecessary complication (it backfired).

dpkirchner2y ago

Unfortunately, those GitHub links are no longer valid, so we randos can't use them to learn what went wrong here. Hopefully GH will reverse this decision once the dust settles.

Lockal2y ago

GitHub should not just reverse and make repo public and archived "as is", because there are many rolling distributions (from Gentoo to LFS), submodule pullers, CI systems, unaware users, which may pull and install the latest backdoored commit of archived project.

However if you want to access exact copies of backdoored tarballs, they are still available on every mirror, e. g. in http://gentoo.mirror.root.lu/distfiles/9f/ . For project of this level artifacts are checksummed and mirrored across the world by many people, and nothing wrong with that.

1 more reply

NekkoDroid2y ago

The gist of it is: The "good" one is the auto generated "Source code" releases made by github. The "bad" one is a manually generated and uploaded source code release, which can have whatever you want.

richardwhiuk2y ago

Sorry, by "they" I mean "Debian and Fedora", which (when including derivatives) include most Linux systems which use a Linux distro in the standard sense.

frankjr2y ago

Not in this case as the other commenter pointed out but for example Vivaldi on Arch Linux is just a repackaged upstream build.

https://gitlab.archlinux.org/archlinux/packaging/packages/vi...

j / k navigate · click thread line to collapse

0 comments

7 comments · 2 top-level

richardwhiuk2y ago· 5 in thread

They were pulling a tarball from upstream and building it - the tarball was compromised.

Lockal2y ago

The answer is not complete. There were 2 ways to pull sources:

bad - https://github.com/tukaani-project/xz/releases/download/...

or:

good - https://github.com/tukaani-project/xz/archive/refs/tags/...

Specifically in Gentoo, there is a note in https://github.com/gentoo/gentoo/blob/master/app-arch/xz-uti...

  # Remember: we cannot leverage autotools in this ebuild in order
  #           to avoid circular deps with autotools

dpkirchner2y ago

Unfortunately, those GitHub links are no longer valid, so we randos can't use them to learn what went wrong here. Hopefully GH will reverse this decision once the dust settles.

Lockal2y ago

1 more reply

NekkoDroid2y ago

richardwhiuk2y ago

Sorry, by "they" I mean "Debian and Fedora", which (when including derivatives) include most Linux systems which use a Linux distro in the standard sense.

frankjr2y ago

Not in this case as the other commenter pointed out but for example Vivaldi on Arch Linux is just a repackaged upstream build.

https://gitlab.archlinux.org/archlinux/packaging/packages/vi...

j / k navigate · click thread line to collapse