From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-ot1-x329.google.com (mail-ot1-x329.google.com [IPv6:2607:f8b0:4864:20::329]) by sourceware.org (Postfix) with ESMTPS id 6334B3847718 for ; Wed, 3 Apr 2024 14:42:16 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 6334B3847718 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 6334B3847718 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::329 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1712155340; cv=none; b=Q2IjblQuLjvSS5XjP+K61nD48Oz4xh6HxKP1PyMvTgApqlAJxtkYZVZo1Yue7QIKKVtvGxUa8KpW7X56vKQZgI2R1mj6nZlRlpvFaP1c6hGZC7JBZ3ScM+SrmSdDabKdN+zA99qTFD8iuW5s/AnpiZxq7vLd6Aj0kndCnOqD8cU= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1712155340; c=relaxed/simple; bh=6wJ3faOVCS0fyKZxaThk9FD0B4MCy3V0FNKFWnMP1xM=; h=DKIM-Signature:Message-ID:Date:MIME-Version:Subject:To:From; b=aYGw70sSjAegILDzifm7MCA8vNoAuCvSntbHDqf6lUQbN9M0dG/5yKzB0kEMUZ+AAxznjzFfI47cF5rTK0KEfkWgbDix99peQxRgxLbVRlQws4c2AHWPXh1tloNEcBIFQri8mzUfCf6MiCeB+1kPPk43HsMosqJp7YWZRaGueoY= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-ot1-x329.google.com with SMTP id 46e09a7af769-6e6ce0702c3so3341342a34.0 for ; Wed, 03 Apr 2024 07:42:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1712155335; x=1712760135; darn=gcc.gnu.org; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=K11PSmvLxUgWO8GyCxGTPv8raE1oT1yCfTUFYmzduV8=; b=mcl2Y5JsK7wjWqxgfFlgQpkKPjzaihmNd8EPGKNAJuTuZ80N7DsYlFrwVWsJStDNIR oagujsf36OJaG/4w5X/EExW8wT3TESQwEzpk/U0Hnh3XVjbXtv6AxyU92ASDtJ3G3CnI 3QJF2U8fyBbVMGl4tCcCiKwAkFbnXluZajDDuv7zvNVEq8xqf1lFVsI4B24FhSlPK9kn j3HJ/70kfvlE7yc8TsckdGQ59OJhNxLo3/GpFqnfFIe1qBQrPUODM3cUgcJOX/+oqTlK fCs9D2COOUJcr98Ziq5XWnATb+EZQykA5htOwthhySzZmg+v3EW3+j6MTa1EvCnj6w96 ObqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1712155335; x=1712760135; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=K11PSmvLxUgWO8GyCxGTPv8raE1oT1yCfTUFYmzduV8=; b=NcG8333JHvt+P7U2UC/EzxYa4DlMnWJfmvCPRlUE7E3rGm1GPCO2KZ4U1VKfOVIzMq Sbm+LFAyF/RmicU9fTZb+HMDwRS6/Tu7iQHoVVaT1vrCSphZj6Ty6Ym4cPWFat0dJwro PLXMWZypMYYHJi34sS0iBAA1rRIYEouDzKKjadZAfZKQHVznkmuv5weMfbJNnY6egA6/ Bgo/fZvbDZ6NX4soXxGuLLLZrJU1iRkVGpv9RtBQ2c4lsth4LQg3mhLDZHFLZMSAUisk Q9rniCbbq+J5vztmIlOs38muNd8EDEIUL4iy1JFZyT2KrskpkPTRXSXVtWALCuQzZOj0 zpUg== X-Forwarded-Encrypted: i=1; AJvYcCUMNqDI+5uxgAFLcNuH9BkFXjgdhVnvV4Is3zZMDJQuaWp/2XiWCLHKLfoza9Yefot80h0uQRUIH4cjlb5pCA0= X-Gm-Message-State: AOJu0YywbFCnms4Jj/HtSTrDhAtQkRFzfdatctizI1QJax2yyEHxxzph Nurrg3AgB0r9m2+etP/exHj5j3yu5ldDkajgm3JagEe51nquDbFY X-Google-Smtp-Source: AGHT+IE1n9AJ3RJmjBKWHTe0InCX9P/AK1FkRWiJfSzGuKCbcJ0PUQgtFvjmrahYvDPzl2eFEdXrzw== X-Received: by 2002:a05:6830:100d:b0:6e9:e442:1584 with SMTP id a13-20020a056830100d00b006e9e4421584mr828394otp.33.1712155335581; Wed, 03 Apr 2024 07:42:15 -0700 (PDT) Received: from [172.31.0.109] ([136.36.72.243]) by smtp.gmail.com with ESMTPSA id g8-20020a056830308800b006e67fcd0ff1sm2652240ots.10.2024.04.03.07.42.14 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 03 Apr 2024 07:42:14 -0700 (PDT) Message-ID: <8bb160e6-d66a-41fa-8c5e-13e236c21919@gmail.com> Date: Wed, 3 Apr 2024 08:42:13 -0600 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Beta Subject: Re: Sourceware mitigating and preventing the next xz-backdoor Content-Language: en-US To: Tom Tromey , Florian Weimer Cc: Guinevere Larsen via Overseers , Sandra Loosemore , Mark Wielaard , Guinevere Larsen , gcc@gcc.gnu.org, binutils@sourceware.org, gdb@sourceware.org, libc-alpha@sourceware.org References: <20240329203909.GS9427@gnu.wildebeest.org> <20240401150617.GF19478@gnu.wildebeest.org> <077b9dd5-0df1-4384-a9d1-58e4283caf09@redhat.com> <87il0ykgw5.fsf@oldenburg.str.redhat.com> <87o7aq8ruc.fsf@tromey.com> From: Jeff Law In-Reply-To: <87o7aq8ruc.fsf@tromey.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-2.4 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: On 4/3/24 8:04 AM, Tom Tromey wrote: >>>>>> "Florian" == Florian Weimer writes: > > Florian> Everyone still pushes their own patches, and there are no > Florian> technical countermeasures in place to ensure that the pushed version is > Florian> the reviewed version. > > This is a problem for gdb as well. > > Probably we should switch to some kind of pull-request model, where > patches can only be landed via the UI, after sufficient review; and > where all generated files are regenerated by the robot before checkin. > (Or alternatively some CI runs and rejects patches where they don't > match.) I've very much prefer to move to a pull-request model. jeff