Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

On 1/4/24 06:00, Eric Gallager wrote:
> So, `aclocal` has a flag to control this behavior: specifically, its
> `--install` flag. Right now I don't see `aclocal` mentioned in the GNU
> Coding Standards at all. Should they be updated to include a
> recommendation as to whether it's better to put `--install` in
> `ACLOCAL_AMFLAGS` or not? Or would such a recommendation be a better
> fit for the `automake` manual (since that's where `aclocal` comes
> from)?
>
A common scenario is that the embedded M4 files are not the latest 
version and that the code in configure.ac is not compatible with newer 
versions that might be installed. Setting the --install flag and make 
every developer bootstrap with 'aclocal --install' or anyone trying to 
bootstrap an old version of the project would be very fragile. Also 
'aclocal --install' only overwrite the embedded copy if the serial 
numbers in the files suggest the installed file is a newer version than 
the embedded M4 file.

Peter