On Sunday, October 16, 2022 3:04:45 AM EDT Liliana Marie Prikler wrote: > Am Samstag, dem 15.10.2022 um 19:23 -0400 schrieb Philip McGrath: > > On Saturday, October 1, 2022 12:54:27 PM EDT Ludovic Courtès wrote: > > > Hello! > > > > > > Philip McGrath <[email protected]> skribis: > > > > 1) If we want to continue to hard-code a specific shell into > > > > Glibc, I > > > > think we should document the decision (for example, why 'bash- > > > > static' vs. > > > > 'bash- minimal'?) […] > > > > > > The choice of ‘bash-static’ rather than ‘bash-minimal’ is motivated > > > by > > > the fact that, in (gnu packages commencement), we want to make sure > > > ‘glibc-final’ does not retain references to its build-time > > > environment. > > > See #:allowed-references in ‘glibc-final’. > > > > This makes sense as far as using 'bash-static' in Glibc. The aspects > > I'm unsure of are: > > > > 1. If I'm packaging software that implements a function like > > > > 'system' (e.g. Racket, SML/NJ, Chez Scheme, etc.), should I use > > 'bash-minimal' or 'bash-static'? > > > > 2. Do we really need 'bash-minimal' at all? Why not just replace it > > > > with 'bash-static'? > > We already explained those two to you. Racket, SML/NJ, Chez Scheme et > al. are not bootstrap-relevant, thus they can use bash-minimal. Unlike > bash-static, bash-minimal can be grafted, i.e. a security bug in bash(- > minimal) that necessitates a version bump or similar does not cause a > world rebuild. A security bug in bash-static does. >
I don't think I understand this. Does it mean that, in the following, I am
running a Bash that wouldn't have security bugs fixed? If so, that seems quite
bad!
--8<---------------cut here---------------start------------->8---
philip@bastet:/tmp$ cat run-bshell.scm
(use-modules
(guix build-system gnu)
(guix gexp)
((guix licenses) #:prefix license:)
(guix packages))
(define src
(plain-file "run-bshell.c"
"
#include <stdlib.h>
#include <unistd.h>
#include <paths.h>
int main(void)
{
execl(_PATH_BSHELL,
_PATH_BSHELL,
\"-c\",
\"echo \" _PATH_BSHELL,
(char *)NULL);
}
"))
(package
(name "run-bshell")
(version "0")
(source src)
(build-system gnu-build-system)
(arguments
(list
#:phases
#~(modify-phases %standard-phases
(delete 'configure)
(replace 'build
(lambda args
(invoke "gcc" "-o" "run-bshell" #$src)))
(delete 'check)
(replace 'install
(lambda args
(install-file "run-bshell" (string-append #$output "/bin")))))))
(home-page #f)
(synopsis #f)
(description #f)
(license license:cc0))
philip@bastet:/tmp$ guix shell --rebuild-cache --container --no-cwd -f run-
bshell.scm -- run-bshell
substitute: updating substitutes from
'https://bordeaux-us-east-mirror.cbaines.nsubstitute: updating substitutes from
'https://bordeaux-us-east-mirror.cbaines.net'... 100.0%
substitute: updating substitutes from 'https://bordeaux.guix.gnu.org'...
100.0%
substitute: updating substitutes from 'https://ci.guix.gnu.org'... 100.0%
The following derivations will be built:
/gnu/store/q5bib9dgaxzag29a2l4b833mm5l12dx3-profile.drv
/gnu/store/r45khn1mq17fc0xsab1yszii85ynsm2j-run-bshell-0.drv
building /gnu/store/r45khn1mq17fc0xsab1yszii85ynsm2j-run-bshell-0.drv...
building CA certificate bundle...
listing Emacs sub-directories...
building fonts directory...
building directory of Info manuals...
building profile with 1 package...
/gnu/store/720rj90bch716isd8z7lcwrnvz28ap4y-bash-static-5.1.8/bin/sh
philip@bastet:/tmp$
--8<---------------cut here---------------end--------------->8---
signature.asc
Description: This is a digitally signed message part.
