Integrity of the Newlib sources can't be validated; ideas for improvement

John Scott <[email protected]> Tue, 21 Apr 2026 20:33:34 +0000

Newsgroups	gmane.comp.lib.newlib
Message-ID	<[email protected]>

Hello,
I've checked the mailing list archives and haven't seen this explicitly pointed out before: for folks building toolchains and perhaps working on embedded gizmos, it's very hard with Newlib in particular to get the sources in a secure way. This is for a couple reasons:
◦ Newlib doesn't published signed release artifacts. The snapshot tarballs on sourceware.org aren't intended to be used in general anyway; it's my understanding that folks are encouraged to use the latest and greatest sources from Git. This differs from Binutils, GCC, GDB, and friends where the formal releases are the main deliverable.
◦ Newlib commits and tags are almost never signed by anyone contributing. The current workflow of sending patches to the mailing list makes this impossible because emailed patches cannot preserve Git commit signatures. I sent a patch here two weeks ago and despite signing the commit on my own machine, it was discarded when doing git format-patch.

I guess the best one can do right now is use TLS to fetch sources over Git and hope for the best. This would be a little bit nicer if sourceware.org used DANE to mitigate the need to rely on certificate authorities, but I see sourceware.org uses Linode nameservers and they may not support setting TLSA resource records. Hypothetically HTTP Message Signatures (RFC 9421) would make it possible to do a 'git clone' that could be validated after the fact, but software support is limited for now and setup would likely be more trouble than it's worth.

Is this a problem anyone has thought about before and are there any good ideas? One thought would be for, on every Git push, if a sourceware.org server could do the equivalent of a 'git archive' and publish a signature over that archive somewhere. This need not imply preserving or publishing those tarballs that had been signed; it suffices if a 'git archive' on my machine can produce a bit-by-bit reproducible tarball to that which a Sourceware machine made a signature over.

Newlib, clearly, is a very important part of an embedded software stack and improvements here would be really appreciated, I think. It's something to think about if nothing else.

Thanks,
John

signature.asc (application/pgp-signature, 407 B)