From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from simark.ca by simark.ca with LMTP id Vx9pKsEODWYcISEAWB0awg (envelope-from ) for ; Wed, 03 Apr 2024 04:09:37 -0400 Authentication-Results: simark.ca; dkim=pass (1024-bit key; secure) header.d=sourceware.org header.i=@sourceware.org header.a=rsa-sha256 header.s=default header.b=B3icLKEK; dkim-atps=neutral Received: by simark.ca (Postfix, from userid 112) id 980FD1E0C0; Wed, 3 Apr 2024 04:09:37 -0400 (EDT) Received: from server2.sourceware.org (server2.sourceware.org [8.43.85.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPS id 777201E08C for ; Wed, 3 Apr 2024 04:09:35 -0400 (EDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id DF71B3847725 for ; Wed, 3 Apr 2024 08:09:34 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org DF71B3847725 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1712131774; bh=lcXrdL9vXwXYm19qwBCp1DAYctzMrBWxC9/tyCIUau8=; h=To:Cc:Subject:In-Reply-To:References:Date:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=B3icLKEKGmTcoUBfNzr4s/6Lmbt/ggp5n5AQw8ZwfR5ankJPdaJ7gYrPHabVshr1Y w0AJgjkJKlOu23GI1QQhnStYohmbByWdhAAeHExLAtAtiG1gBOc3lfsV0X18mI51sH Qe7/z5/ylDFHpfeEF1QgiHmD8tVR7RCtFKTUuEj0= Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTPS id E8BC33847700 for ; Wed, 3 Apr 2024 08:08:35 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org E8BC33847700 ARC-Filter: OpenARC Filter v1.0.0 sourceware.org E8BC33847700 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1712131717; cv=none; b=v4GUUFp1sKH/Ehiu/67ybau36chLVQIw6NoXhlxdKV7nTJ7sa6AOcD8+WWvF2X3ARuWTQuunKq3O680zBcMHDHXlxeAsJjpHla3q4a2HpzE3+JBKQ6rcmdnhK1Ns6YfC54mDcLyARhnPeDgh/RRZc3GEOj9cQR7/rBkdEHbfeA8= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1712131717; c=relaxed/simple; bh=0JMcQLhBeedB61RRwm+96/YLEm1FQPNdY3do6U8WajY=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=vhP7pMxFXGPtV37UicsMqZ4sgVTWshQiUDtT68N509VpX2yCEDaYF3hSgxfQHELOHiS7oTVvFpDEl+QnDAFJXJhKIqKPq8n2EjXGuIzQJitfndbPPzWbp4VqpOszSqMECF1hqQ4MB1DbRV++hCSXaRfO7zL6qZ1nt+gVrJRp1q8= ARC-Authentication-Results: i=1; server2.sourceware.org Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-624-euJWgdpzPG-itRXbouqZ-g-1; Wed, 03 Apr 2024 04:08:34 -0400 X-MC-Unique: euJWgdpzPG-itRXbouqZ-g-1 Received: from smtp.corp.redhat.com (int-mx10.intmail.prod.int.rdu2.redhat.com [10.11.54.10]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id CDB201C54034; Wed, 3 Apr 2024 08:08:33 +0000 (UTC) Received: from oldenburg.str.redhat.com (unknown [10.39.193.76]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 13C9A492BD7; Wed, 3 Apr 2024 08:08:31 +0000 (UTC) To: Guinevere Larsen via Overseers Cc: Sandra Loosemore , Mark Wielaard , Guinevere Larsen , gcc@gcc.gnu.org, binutils@sourceware.org, gdb@sourceware.org, libc-alpha@sourceware.org Subject: Re: Sourceware mitigating and preventing the next xz-backdoor In-Reply-To: <077b9dd5-0df1-4384-a9d1-58e4283caf09@redhat.com> (Guinevere Larsen via Overseers's message of "Tue, 2 Apr 2024 19:08:59 -0300") References: <20240329203909.GS9427@gnu.wildebeest.org> <20240401150617.GF19478@gnu.wildebeest.org> <077b9dd5-0df1-4384-a9d1-58e4283caf09@redhat.com> Date: Wed, 03 Apr 2024 10:08:26 +0200 Message-ID: <87il0ykgw5.fsf@oldenburg.str.redhat.com> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.10 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain X-Spam-Status: No, score=-4.8 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gdb@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Florian Weimer via Gdb Reply-To: Florian Weimer Errors-To: gdb-bounces+public-inbox=simark.ca@sourceware.org Sender: "Gdb" * Guinevere Larsen via Overseers: > Beyond that, we (GDB) are already experimenting with approved-by, and > I think glibc was doing the same. The glibc project uses Reviewed-by:, but it's completely unrelated to this. Everyone still pushes their own patches, and there are no technical countermeasures in place to ensure that the pushed version is the reviewed version. Thanks, Florian