Re: Three steps we could take to make supply chain attacks a bit harder

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, Apr 03, 2024 at 07:48:03PM +0200, Kevin Kofler via devel wrote:
> Eric Blake wrote:
> > The upstream autoconf discussion says that 'autoreconf -fi' behavior
> > on which 'serial NN' .m4 files to update is determined by automake,
> > not autoconf, in part inspired by semantics desired in gnulib.  And
> > the automake and gnulib developers have argued that the upstream
> > behavior is intentional:
> > 
> > https://lists.gnu.org/archive/html/bug-autoconf/2024-04/msg00005.html
> 
> Don't you love intentional bugs? Yet another reason to avoid autotools at 
> all costs.
> 
> By the way, the documentation of the serials "feature" actually warns about 
> this (and seems to imply that even without serials, --force does not work as 
> advertised for those files):
> https://www.gnu.org/software/automake/manual/html_node/Serials.html

Note - that's in the automake manual (it is the actions taken by aclocal...).

> 
> | Finally, note that the --force option of aclocal has absolutely no effect
> | on the files installed by --install. For instance, if you have modified
> | your local macros, do not expect --install --force to replace the local
> | macros by their system-wide versions. If you want to do so, simply erase
> | the local macros you want to revert, and run ‘aclocal --install’.
> 
> But the documentation of "autoreconf --force" does not include that warning. 
> And this also makes "--force" pretty much useless as it stands.

...and autoreconf is shipped by autoconf.  While the two projects are
related, they are independent (you can use autoconf without automake,
at which point autoreconf --force does update everything that autoconf
touched, since automake's semantics aren't getting in the way; it only
invokes aclocal when it is obvious that automake was also in use).
But I'm sure (speaking as one of the previous upstream autoconf
maintainers, but only as a very infrequent automake patch poster) that
a patch to autoconf's docs to mention the automake pitfalls inherited
from 'aclocal --force' into 'autoreconf --force' is worthwhile.

> 
> We and Debian both need to patch aclocal downstream immediately to make 
> --force actually work. And then of course Fedora needs to actually always 
> run autoreconf -i -f as Debian already does, or the patch will not do much 
> good.

Downstream is certainly entitled to have a different idea of best
practices than upstream, especially when downstream is targetting just
one OS, rather than the world of machines out there that the autotools
originally designed for.  That's one of the joys of open source - you
don't have to live with upstream decisions.

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.
Virtualization:  qemu.org | libguestfs.org
--
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Users]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]

  Powered by Linux