From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from codesynthesis.com (codesynthesis.com [188.40.148.39]) by sourceware.org (Postfix) with ESMTPS id 1F137385840D for ; Wed, 24 Apr 2024 08:32:17 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 1F137385840D Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=codesynthesis.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=codesynthesis.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 1F137385840D Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=188.40.148.39 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1713947539; cv=none; b=Ci0qjafQhKxLnFiWXG/ZBjgVSnamUD9nRGmrjmZJA0Hvo+zEKwcuXeKFdhBCGbRSbZec558FMJamN68CrwAon+uQxgWZEPKjTGOqCBMPczzkJR/IFyrktyYZe+VJOr3nOhHiTcUWyjYaqTgBf3f3/ABVzmtp829MCE749IImdjU= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1713947539; c=relaxed/simple; bh=X0PImMefqZp8Z25Zr1VhV6Hu3Ppgs4QJB46r+TqWx4o=; h=DKIM-Signature:Date:From:To:Subject:Message-ID:MIME-Version; b=k4SXZCpqIJ1XsAqY8/AOyhAckCMtJSB8XYOhLpYBafedP0zEUw7lcOImoP32z7xA0rwl5a2/kpvoks7/RqZQmR9IYX7fE4ny+Myc47anMqFqNnJnXUI+l+dnIQTQcL9H3tYmGtTiRRVTYWrRhZExvop1yXHh/FduqPrVVjWfBM0= ARC-Authentication-Results: i=1; server2.sourceware.org Received: from brak.codesynthesis.com (unknown [105.224.235.221]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by codesynthesis.com (Postfix) with ESMTPSA id EDFCD6152E; Wed, 24 Apr 2024 08:32:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codesynthesis.com; s=mail1; t=1713947535; bh=X0PImMefqZp8Z25Zr1VhV6Hu3Ppgs4QJB46r+TqWx4o=; h=Date:From:To:Subject:Message-ID:MIME-Version:From; b=nO9HtQwuAorC3IPRXMr5E6GXhO9v7D/0sxGC+Y7Zx82rBWre4GcYkE2ZaaUlpkLX5 p6EouaEOhKIqueoucFSONMWJnLR6QzzpV0gzd645i2gYcbxswLHZcmMuWfxDdrIb6W JOn+qPf+PDydpG8twu/tVilwtjdheRDkI8ueIM3Dnkfix8U5ONo+SZ/jiKf/UitGSC SyOb658xvCZ2M+t7XD5GAVzZTD8evCb6KpsHcBjtO0c37ljMsZgiUcMFa9H95KoK2U U9L7AYOK46Yjq/wFMbObWDbb4rqCGs+XEine14+cczjvTMX1DU2Rq32+078HhEkCJ0 +Ju4D1zA9KyOg== Received: by brak.codesynthesis.com (Postfix, from userid 1000) id 07F89145D42; Wed, 24 Apr 2024 10:32:16 +0200 (SAST) Date: Wed, 24 Apr 2024 10:32:16 +0200 From: Boris Kolpackov To: gcc@gcc.gnu.org Cc: Martin Uecker Subject: Re: Sourceware mitigating and preventing the next xz-backdoor Message-ID: References: <20240329203909.GS9427@gnu.wildebeest.org> <20240401150617.GF19478@gnu.wildebeest.org> <12215cd2-16db-4ee4-bd98-6a4bcf318592@cs.ucla.edu> <6239192ba9ff8aad0752309a54b633dc75a57c77.camel@tugraz.at> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6239192ba9ff8aad0752309a54b633dc75a57c77.camel@tugraz.at> Organization: Code Synthesis X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_PASS,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: Martin Uecker writes: > Do we really still need complex build systems such as autoconf? Are > there still so many different configurations with subtle differences > that every single feature needs to be tested individually by running > code at build time? We have taken the alternative approach in build2. Specifically, instead of dynamic compilation/linking tests (which can fail for all kinds of reasons besides the absent feature), we use static expected values based on the platform/compiler macro checks. For example, if we are compiling with glibc and the version is 2.38 or later, then we know the strl*() function family is available: https://github.com/build2/libbuild2-autoconf We currently have ~200 checks and have built quite a bit of software using this approach (including Qt classic libraries and all their dependencies) on the mainstream platforms (Linux, Windows, Mac OS, FreeBSD).