Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

Jacob Bachmeyer wrote:
> Another related check that /would/ have caught this attempt would be 
> comparing the aclocal m4 files in a release against their (meta)upstream 
> sources before building a package.  This is something distribution 
> maintainers could do without cooperation from upstream.  If 
> m4/build-to-host.m4 had been recognized as coming from gnulib and 
> compared to the copy in gnulib, the nonempty diff would have been 
> suspicious.

True.

Note, however, that there would be some false positives: libtool.m4
is often shipped modified,
  a) if the maintainer happens to use /usr/bin/libtoolize and
     is using a distro that has modified libtool.m4 (such as Gentoo), or
  b) if the maintainer intentionally improved the support of specific
     platforms, such as Solaris 11.3.

Also, for pkg.m4 there is no single upstream source. They distribute
a pkg.m4.in, from which pkg.m4 is generated on the developer's machine.

But for macros from Gnulib or the Autoconf macros archive, this is a
reasonable check to make.

Bruno