Re: DHCP server bug (miscompiled by GCC compiler)

Milan Ker=C5=A1l=C3=A1ger wrote:
> On Fri, Sep 09, 2005 at 10:30:07AM -0500, Ed Wilts wrote:
>=20
>>>Sure, it's right there in the bug report:
>>>The dhcp-3.0.1-12_EL package was built on Nov 17th 2004,
>>>with compiler 3.4.3-2.EL4 and that is the version that=20
>>>was tested, when no such problems were found .
>>>
>>>That compiler isn't available anywhere I can find, though it might hav=
e
>>>been in RHEL4 beta1 (RHEL4 b2 had gcc-3.4.3-9, which has the bug).
>>
>>Interesting.  I've heard claims before that a rebuild of the sources
>>doesn't necessarily get you the equivalent of the binaries because you
>>can't guarantee the build order but I didn't realize that Red Hat used
>>compilers that weren't publicly available.  I thought it was FUD before
>>but I guess it really is true that the rebuilds aren't bug for bug
>>compatible.
>>
>>Not that it bothers me much but I like to have all the facts in hand if
>>I can. =20
>=20
>=20
> RH did not guarantee the system is self-hosting (read: is able to build
> itself) because they needs reasonable QA and once a package passed QA,
> should not be rebuild as if it is, new QA cycle is needed.
>=20
> This mean that every bugfix and subsequental rebuild of all packages
> mean new full QA cycle. This is not possible so some packages are prett=
y
> old (if they are not updated they did not become rebuilded since last
> change as passed QA in their "old" state).
>=20
> RH has a build farm and this is possible (especially before the new
> release) that some of the building machines has "hot fixes" to be able
> to build packages without bugs... and when official GCC fix hit the
> public, this is possible that some of the fixes may introduce new
> [hidden] bugs).

So, GPL is irrelevant after all.
You can use any compiler version, perhaps once released, but no longer=20
available, to build binaries nobody else can reproduce.


This stinks to high heaven. Relying to compiler bugs to protect=20
commercial firm value!

Paranoid thought of line would have RH deviced this at will, but I would=20
have more faith in incompetence, bad practices and such.

--=20
Raimo Koski  http://www.lineox.net/  http://www.raimokoski.com/