oss-security - Re: From xz to ibus: more questionable tarballs

Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 2 Apr 2024 01:39:49 +0900
From: Takao Fujiwara <takao.fujiwara1@...il.com>
To: Jan Engelhardt <jengelh@...i.de>
Cc: oss-security@...ts.openwall.com
Subject: Re: From xz to ibus: more questionable tarballs

I don't understand what are your issues.
However I recommend to use the my uploaded files likes
https://github.com/ibus/ibus/releases/download/$VERSION/ibus-${VERSION}.tar.gz
instead of GitHub generated tar.gz and zip files from the git tag.
The target translatable strings per release are included in
https://github.com/ibus/ibus/blob/main/po/ibus10.pot

On Mon, Apr 1, 2024 at 9:58 PM Jan Engelhardt <jengelh@...i.de> wrote:
>
>
> In the ibus repository at https://github.com/ibus/ibus ,
> commit 0ad8e77bd36545974ad8acd0a5283cf72bc7c8ad
> was tagged as refs/tags/1.5.29-rc2 (+signed) on 2023-11-09,
> and a disted tarball was made available (but unsigned), and Linux distros have
> imported it (file checksums all line up).
>
> https://github.com/ibus/ibus/releases/download/1.5.29/ibus-1.5.29-rc2.tar.gz
>
> Comparing this disttar to the git repository and favorably
> *discounting* autotools-related files and (what appears to be)
> vala-to-c transpiling, I'm left with benign, but unexplicable
> changes. It seems the git is "older", as e.g. one still finds "beta3"
> in the diff, but also the disttar's ibuscodegen.h has an older
> copyright line and an incomplete cherry-pick from
> 8f00d67b809036b0b76ae257cfe7e102bc8f1dec.
>
> *runs away screaming*
>
> In light of the xz revelations, I thought it's worth pointing out
> this class of problems.
>
>
> $ tar -xf ibus-1.5.29-rc2.tar.gz
> $ git clone -b 1.5.29-rc2 https://github.com/ibus/ibus ibus-git
> $ diff -dprux .git ibus-git ibus-1.5.29-rc2
> diff -dpru ibus-git/engine/simple.xml.in ibus-1.5.29-rc2/engine/simple.xml.in
> --- ibus-git/engine/simple.xml.in       2024-04-01 14:08:16.541903956 +0200
> +++ ibus-1.5.29-rc2/engine/simple.xml.in        2023-11-09 07:10:15.000000000 +0100
> @@ -3,781 +3,596 @@
>      <name>org.freedesktop.IBus.Simple</name>
>      <description>A table based simple engine</description>
>      <exec>@libexecdir@...us-engine-simple</exec>
> -    <version>1.5.29-beta3.20230822</version>
> +    <version>1.5.29-rc2.20231109</version>
>      <author>Peng Huang &lt;shawn.p.huang@...il.com&gt;</author>
>      <license>GPL</license>
> ...
> --- ibus-git/po/de.po   2024-04-01 14:08:16.555237247 +0200
> +++ ibus-1.5.29-rc2/po/de.po    2023-11-09 07:10:08.000000000 +0100
> @@ -22,7 +22,7 @@ msgid ""
>  msgstr ""
>  "Project-Id-Version: IBus\n"
>  "Report-Msgid-Bugs-To: https://github.com/ibus/ibus/issues\n"
> -"POT-Creation-Date: 2023-08-02 00:14+0900\n"
> +"POT-Creation-Date: 2023-11-09 15:10+0900\n"
>  "PO-Revision-Date: 2023-08-04 17:21+0000\n"
>  "Last-Translator: Mike FABIAN <mfabian@...hat.com>\n"
>  "Language-Team: German <https://translate.fedoraproject.org/projects/ibus/"
> diff -dpru ibus-git/src/ibusunicodegen.h ibus-1.5.29-rc2/src/ibusunicodegen.h
> --- ibus-git/src/ibusunicodegen.h       2024-04-01 14:08:16.568570535 +0200
> +++ ibus-1.5.29-rc2/src/ibusunicodegen.h        2023-11-09 07:09:53.000000000 +0100
> @@ -1,8 +1,8 @@
>  /* -*- mode: C; c-basic-offset: 4; indent-tabs-mode: nil; -*- */
>  /* vim:set et sts=4: */
>  /* ibus - The Input Bus
> - * Copyright (C) 2018-2023 Takao Fujiwara <takao.fujiwara1@...il.com>
> - * Copyright (C) 2018-2023 Red Hat, Inc.
> + * Copyright (C) 2018-2021 Takao Fujiwara <takao.fujiwara1@...il.com>
> + * Copyright (C) 2018-2021 Red Hat, Inc.
>   *
>   * This library is free software; you can redistribute it and/or
>   * modify it under the terms of the GNU Lesser General Public
> @@ -1310,6 +1310,10 @@ const static char *unicode_blocks[] = {
>      /* TRANSLATORS: You might refer the translations from gucharmap with
>                      the following command:
>         msgmerge -C gucharmap.po ibus.po ibus.pot */
> +    N_("CJK Unified Ideographs Extension I"),
> +    /* TRANSLATORS: You might refer the translations from gucharmap with
> +                    the following command:
> +       msgmerge -C gucharmap.po ibus.po ibus.pot */
>      N_("CJK Compatibility Ideographs Supplement"),
>      /* TRANSLATORS: You might refer the translations from gucharmap with
>                      the following command:
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.