Re: From xz to ibus: more questionable tarballs

[HW42 <hw42 () ipsumj de>]

Hi Jan,

great that you are looking for further problems. (Just to be clear, I'm
not associated with ibus in any way.)

Jan Engelhardt:
> In the ibus repository at https://github.com/ibus/ibus ,
> commit 0ad8e77bd36545974ad8acd0a5283cf72bc7c8ad
> was tagged as refs/tags/1.5.29-rc2 (+signed) on 2023-11-09,
> and a disted tarball was made available (but unsigned), and Linux distros have
> imported it (file checksums all line up).
>
> https://github.com/ibus/ibus/releases/download/1.5.29/ibus-1.5.29-rc2.tar.gz
>
> Comparing this disttar to the git repository and favorably
> *discounting* autotools-related files and (what appears to be)
> vala-to-c transpiling, I'm left with benign, but unexplicable
> changes. It seems the git is "older", as e.g. one still finds "beta3"
> in the diff, but also the disttar's ibuscodegen.h has an older
> copyright line and an incomplete cherry-pick from
> 8f00d67b809036b0b76ae257cfe7e102bc8f1dec.
>
> *runs away screaming*
>
> In light of the xz revelations, I thought it's worth pointing out 
> this class of problems.
>
>
> $ tar -xf ibus-1.5.29-rc2.tar.gz
> $ git clone -b 1.5.29-rc2 https://github.com/ibus/ibus ibus-git
> $ diff -dprux .git ibus-git ibus-1.5.29-rc2
> diff -dpru ibus-git/engine/simple.xml.in ibus-1.5.29-rc2/engine/simple.xml.in
> [...]

That's another generated file. See engine/{gensimple.py,Makefile.am}

> --- ibus-git/po/de.po   2024-04-01 14:08:16.555237247 +0200
> +++ ibus-1.5.29-rc2/po/de.po    2023-11-09 07:10:08.000000000 +0100
> [...]

I'm not familiar with the gettext workflow. But IIUC those strings to
translate are extracted from the source files. Why only de.po? I don't
know, maybe mtime of checked out files triggered an update only for this
file?

> diff -dpru ibus-git/src/ibusunicodegen.h ibus-1.5.29-rc2/src/ibusunicodegen.h
> --- ibus-git/src/ibusunicodegen.h       2024-04-01 14:08:16.568570535 +0200
> +++ ibus-1.5.29-rc2/src/ibusunicodegen.h        2023-11-09 07:09:53.000000000 +0100

Also generated see src/{unicode-parser.c,Makefile.am}.

But yeah, this makes auditing really hard. The translation of SCM
revision -> distribution tar should be auditable fully automatic
(something like install dependencies && git checkout $rev && ./gen-tar
and then getting a bit for bit identical file).

Also probably a good idea to not check-in fully generated files at all.
This makes the SCM diffs smaller.

Simon

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature