oss-security - Re: From xz to ibus: more questionable tarballs

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 1 Apr 2024 17:13:10 +0200
From: HW42 <hw42@...umj.de>
To: oss-security@...ts.openwall.com, Jan Engelhardt <jengelh@...i.de>
Cc: takao.fujiwara1@...il.com
Subject: Re: From xz to ibus: more questionable tarballs

Hi Jan,

great that you are looking for further problems. (Just to be clear, I'm
not associated with ibus in any way.)

Jan Engelhardt:
> In the ibus repository at https://github.com/ibus/ibus ,
> commit 0ad8e77bd36545974ad8acd0a5283cf72bc7c8ad
> was tagged as refs/tags/1.5.29-rc2 (+signed) on 2023-11-09,
> and a disted tarball was made available (but unsigned), and Linux distros have
> imported it (file checksums all line up).
> 
> https://github.com/ibus/ibus/releases/download/1.5.29/ibus-1.5.29-rc2.tar.gz
> 
> Comparing this disttar to the git repository and favorably
> *discounting* autotools-related files and (what appears to be)
> vala-to-c transpiling, I'm left with benign, but unexplicable
> changes. It seems the git is "older", as e.g. one still finds "beta3"
> in the diff, but also the disttar's ibuscodegen.h has an older
> copyright line and an incomplete cherry-pick from
> 8f00d67b809036b0b76ae257cfe7e102bc8f1dec.
> 
> *runs away screaming*
> 
> In light of the xz revelations, I thought it's worth pointing out 
> this class of problems.
> 
> 
> $ tar -xf ibus-1.5.29-rc2.tar.gz
> $ git clone -b 1.5.29-rc2 https://github.com/ibus/ibus ibus-git
> $ diff -dprux .git ibus-git ibus-1.5.29-rc2
> diff -dpru ibus-git/engine/simple.xml.in ibus-1.5.29-rc2/engine/simple.xml.in
> [...]

That's another generated file. See engine/{gensimple.py,Makefile.am}

> --- ibus-git/po/de.po   2024-04-01 14:08:16.555237247 +0200
> +++ ibus-1.5.29-rc2/po/de.po    2023-11-09 07:10:08.000000000 +0100
> [...]

I'm not familiar with the gettext workflow. But IIUC those strings to
translate are extracted from the source files. Why only de.po? I don't
know, maybe mtime of checked out files triggered an update only for this
file?

> diff -dpru ibus-git/src/ibusunicodegen.h ibus-1.5.29-rc2/src/ibusunicodegen.h
> --- ibus-git/src/ibusunicodegen.h       2024-04-01 14:08:16.568570535 +0200
> +++ ibus-1.5.29-rc2/src/ibusunicodegen.h        2023-11-09 07:09:53.000000000 +0100

Also generated see src/{unicode-parser.c,Makefile.am}.

But yeah, this makes auditing really hard. The translation of SCM
revision -> distribution tar should be auditable fully automatic
(something like install dependencies && git checkout $rev && ./gen-tar
and then getting a bit for bit identical file).

Also probably a good idea to not check-in fully generated files at all.
This makes the SCM diffs smaller.

Simon


Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (834 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.