[prev in list] [next in list] [prev in thread] [next in thread] 

List:       debian-devel
Subject:    Re: Architecture independent binaries and building from source
From:       Shaun Jackman <sjackman () telus ! net>
Date:       2004-08-11 0:55:40
Message-ID: 200408101755.40122.sjackman () telus ! net
[Download RAW message or body]

On Tue August 10, 2004 13h14, Martin Schulze wrote:
> Roland Stigge wrote:
> > Also consider the hassles we come into when we need to patch upstream
> > sources; and reliably and automatically checking if packages build from
> > source.
> 
> I guess this is a good enough reason not to distribute upstream provided
> binaries instead of creating them from the source.
> 
> Just assume there's a security bug in the upstream blob.  Also assume
> that the package is part of stable release of Debian.  Now assume that
> the security team needs to fiddle with the (in that case) broken build
> system to get a) the blob built from the provided source and b) pray
> to God that it really builds from source and isn't only said to do so.
> If building then fails on one architecture for whatever strange reason,
> we're doomed.  We're also doomed if building results in a broken blob.
> 
> Hence, please don't do that, but compile it from the provided source,
> always.
> 
> Regards,
> 
> 	Joey
> 

The build system can function much like automake does. Makefile.in is
not usually regenerated from Makefile.am. If Makefile.in is removed it
will be regenerated. Likewise, the build system could typically
redistribute upstream's derivative form. If the security team finds it
necessary to patch the source, simply removing upstream's binary will
cause it to be rebuilt. This allows both redistribution of a pristine
upstream binary as well as potential modification by the security
team.

Cheers,
Shaun


-- 
To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

[prev in list] [next in list] [prev in thread] [next in thread]