Re: security alerts in busybox

On Sat, 25 Apr 2026 at 21:46, Ladislav Michl <[email protected]> wrote:
>
> On Fri, Apr 24, 2026 at 04:40:47PM +0200, Roberto A. Foglietta via busybox wrote:
> > Hi,
...
> > These are trivial alerts, therefore I faced it first to provide an
> > example. And the second main question is straightforward: does this
> > fix worth 177 bytes? In relative terms it is 150 ppm compared with the
> > full size footprint. In terms of certifications is a solid step
> > towards peace of mind.
>
> These are not trivial alerts, but pure garbage. Adding even single
> byte to 'fix' non-existant bug does not make any sense.
>

It doesn't make any sense for you, but for busybox as a single binary
self-contained is a must to have.

The core technical point: Busybox is not pthread-safe by design, but a
self-contained binary must be. Therefore static-analysis alerts that
are 99.9% false-positive in multi-process Busybox become mandatory
fixes in single-binary deployment. This is a genuine architectural
distinction that bureaucratic tool-wrangling would miss.

Best regards, R-