From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Tue, 22 Sep 2026 12:11:05 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1x8xSr-0051cp-2j for lore@lore.pengutronix.de; Tue, 22 Sep 2026 12:11:05 +0200 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1x8xSq-0004yp-SA; Tue, 22 Sep 2026 12:11:04 +0200 Received: from mx1.white.stw.pengutronix.de ([185.203.200.13]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1x8xSd-0004yf-4z for ptxdist@pengutronix.de; Tue, 22 Sep 2026 12:10:51 +0200 Received: from [0.0.0.0] (ptz.office.stw.pengutronix.de [IPv6:2a0a:edc0:0:900:1d::77]) (Authenticated sender: spu@pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id F08612004F0; Tue, 22 Sep 2026 12:10:50 +0200 (CEST) Message-ID: <29a27425-8323-4047-91f7-b62ad1d1b493@pengutronix.de> Date: Tue, 22 Sep 2026 12:10:50 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: ptxdist@pengutronix.de References: <20260914150055.317620-1-ada@thorsis.com> <20260921-granola-stimulus-1fd65d7980e8@thorsis.com> Content-Language: en-US From: =?UTF-8?Q?Sven_P=C3=BCschel?= In-Reply-To: <20260921-granola-stimulus-1fd65d7980e8@thorsis.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.whiteo.stw.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,AWL,BAYES_00 autolearn=ham autolearn_force=no version=3.4.2 Subject: Re: [ptxdist] [PATCH] xz: version bump 5.8.1 -> 5.8.4 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Alexander Dahl Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Hi Alexander, On 9/21/26 08:18, Alexander Dahl via ptxdist wrote: > Hello Michael, > > Am Sat, Sep 19, 2026 at 09:05:28AM +0200 schrieb Michael Olbrich: >> On Mon, Sep 14, 2026 at 05:00:55PM +0200, Alexander Dahl via ptxdist wrote: > […] >>> Notes: >>> Not sure what security gain we have from tarballs created by GitHub? >> It helps detecting supply chain attacks. The "make dist" archive is >> basically impossible to reproduce, so we need to trust the uploader that it >> was not modified. For the git tarball, all changes are visible in the >> commit history. While someone still needs to look, it's much easier to spot >> something. >> And that is not theoretical: The xz backdoor did just that with a modified >> build-to-host.m4. >> >>> This just makes packaging harder. >> I'm not sure what you mean with that. > Usually upstream publishes sha256 sums and gpg signatures along a > tarball release. I usually check those, and compare with the sums > other distributions (e.g. buildroot) have in their packages. If we > take the generated tarball from git, those checks are impossible. I can totally understand both sides. In the end the question is what thread we want to protect against? Your thread model is that GitHub or someone with access to GitHub does bad things. Michael's thread model is against a bad/compromised maintainer trying to hide the actual attack. Both are correct and neither guarantees security, as a bad actor could also simply hide his stuff in some commit. For best security one would have to review the whole (commit) diff between the releases. But given that xz also has PGP signed commit, you could also verify it in the following way: (clone xz repo and verify signature of the given tag) $ git archive --format=tar --prefix=xz-5.8.4/ v5.8.4 | sha256sum ac47844373932e3fed48d7d791fdea426005894592578eaba3f878394d62bfa3 - $ wcurl https://github.com/tukaani-project/xz/archive/refs/tags/v5.8.4.tar.gz (...) $ gzip --decompress --stdout v5.8.4.tar.gz | sha256sum ac47844373932e3fed48d7d791fdea426005894592578eaba3f878394d62bfa3 - Sidenote: From an operational point of view GitHub btw. also disagrees from using their auto generated archives, as they cannot guarantee that they are reproducible [1], but they do their best to not break anything [2]. [1] https://github.com/github/docs/issues/31141#issuecomment-1899101631 [2] https://github.com/github/docs/issues/31141#issuecomment-1899166346 Sincerely     Sven > > Greets > Alex