IRC channel logs

2024-05-10.log

back to list of logs

<oriansj>well I do like the idea of improving the security situation of git workflows, git namespaces make me wonder about potential security exploits that can be hidden inside of them.
<fossy>Googulator, stikonas: https://github.com/fosslinux/live-bootstrap/pull/new/fix-preseed small fix. would like CI to run in case it breaks something later (i didn't run a full bootstrap)
<fossy>oops wrong link
<fossy> https://github.com/fosslinux/live-bootstrap/pull/467
<janneke> https://guix.gnu.org/en/blog/2024/authenticate-your-git-checkouts/
<matrix_bridge><Andrius Štikonas> fossy: yeah, I noticed missing libdir in heirloom too
<matrix_bridge><Andrius Štikonas> Also byacc uses different convention for makefile (in files and not in mk/)
<matrix_bridge><Andrius Štikonas> But early preseed is at least redistributable now, no more cddl+GPL issue...
<fossy>:D
<oriansj>janneke: excellent point
<kpcyrd>question regarding ruby: it seems there's this tarball https://whatsrc.org/artifact/sha256:1c3b21d372fdbcc5a4d3a53cbddd2b3ce1b88aefa278c79ecb368256a06e909a that allows building ruby without having ruby as a build dependency, but going from `git -> dist-tarball` seems to require ruby - how does #bootstrappable feel about this?
<stikonas>well, for #live-bootstrap we need to build from source
<stikonas>without using pregenerated files
<fossy>would depend a bit. what is git->dist-tarball doing
<fossy>is it generating files?
<fossy>or is it just packaging it up into a tarball?
<stikonas>I would assume so
<stikonas>and probably using ruby?
<stikonas>but yeah, hard to tell without more details
<stikonas>i assume all distros just use tarball, so they don't need ruby
<kpcyrd>fossy: it's generating files, otherwise it'd be a non-issue (and `git archive` doesn't require ruby) :)
<stikonas>yeah, so that's not good enough for live-bootstrap
<stikonas>that's why we bootstrap flex, bison, perl and autoconf the long way
<stikonas>and probably many other things
<stikonas>python too does quite a few rebuilds, starting from 2.4
<stikonas>perhaps ruby can also be done this way
<stikonas>does ruby 3.0 need ruby as well?
<kpcyrd>stikonas: Arch Linux is trying to avoid pre-processed source code (post Jia Tan) and prefer building from git snapshots, that's how the topic came up :)
<stikonas>how do they deal with bison/flex/python then/
<stikonas>or they haven't noticed it yet
<stikonas>anyway, the easies suggestion is to go via older versions...
<kpcyrd>bison: https://whatsrc.org/artifact/sha256:315fd9a80a9a9b4aa36a2ee2ba16c68762dd340d70d4d75223bb4a66b557f3d3
<kpcyrd>flex: https://whatsrc.org/artifact/sha256:8efb99e0cf260f842e4b9b0e7d5a94e0009df18af60d3c9306eb92b0f0119259
<kpcyrd>python: https://whatsrc.org/artifact/sha256:8802bb76247347f4e59707972526e0c26a7260b69f900dfcfd908c58dc665bdf
<kpcyrd>(all of them are flagged as autotools pre-processed)
<stikonas>well, they are also bison/flex processed
<stikonas>e.g. they include both bison-3.8.2/src/scan-gram.l and bison-3.8.2/src/scan-gram.c
<stikonas>scan-gram.c is not genuine source...
<stikonas>though might be more readable than autotools...
<kpcyrd>the annotation I do is kinda makeshift, hopefully people have a better understanding of "true source code" in a few years and this kind of heuristic annotation won't be necessary anymore
<stikonas>well, in live-bootstrap we spend quite a bit figuring out all those pregenerated files... More than anywhere else...
<stikonas>though generally upstreams were not receptive...
<fossy>yes, people tended to not be particularly interested in the pregenerated files issue, so we've been kind of chugging along doing it by ourselves over here
<fossy>perhaps there is more interest nowdays?
<fossy>wrt to this specific ruby situation i would personally say that does not suffice, as you're just kinda adding an extra step in the cycle that obscures the cycle
<stikonas>ruby 1.8 might be buidlable without ruby
<stikonas>miniruby at least...
<matrix_bridge><cosinusoidally> I've added annother alternative bootstrap path to my tcc_bootstrap_alt project. Alt bootstrap path is hex0 -> hex1 -> hex2 -> M0 -> M2_simple_asm.M1 -> M2_simple_asm.c -> M2_tcc_js_simple.c (less a cut down version of M2) -> tcc_js -> .... -> tcc-0.9.27 . tldr I am able to bootstrap without depending on cc_x86.M1
<matrix_bridge><cosinusoidally> this alt path depends on glibc and bash though
<oriansj>cosinusoidally: a binary glibc and bash or a built one?
<Googulator>cosinusoidally: what's the point of avoiding cc_x86?
<Googulator>Why not hex0 -> hex1 -> hex2 -> M0 -> cc_x86 -> M2-Planet (bootstrap version) -> full M2-Planet -> M2-Mesoplanet -> mescc-tools -> mescc-tools-extra (up to this point, this is just stage0) -> tcc_js -> .... -> tcc-0.9.27?
<oriansj>well it does create an alternate path which could be used to detect if something was slipped into stage0's later stages.
<oriansj>and I am assuming cosinusoidally is enjoying that work and it could provide some ideas for anyone wanting to go from M2-Mesoplanet to TCC directly (providing another potential path early in the chain)