Re: shortest path to bootstrap gauche?

--===============1417754405634530130==
Content-Type: multipart/alternative; boundary="000000000000e99a690627a69ba7"

--000000000000e99a690627a69ba7
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Ah, I see.

Re-tracing the chain of trusted sources may end up either impractical
(taking too much time) or entering another rabbit hole (getting trusted
STk).  If we really want one, a possible path is to write a version of a
subset of Gauche that is enough to run precomp, in portable R7RS.   It is a
lot of work, but once done, any trusted R7RS implementation can do the job.

However, if this kind of patch-and-regenerate is relatively rare, I could
create an intermediate release (0.9.15-p2).   It is at least "official";
you can confirm its integrity by my signature.

--shiro


On Sun, Nov 24, 2024 at 12:55=E2=80=AFAM Jens Thiele <[email protected]> wrote=
:

> Shiro Kawai <[email protected]> writes:
>
> > IIRC, earlier versions of Gauche required STk.  It won't be very simple
> to
> > retrace everything.
> > What is it for?
>
> How I ended up there:
>
> During fixing the reproducible build issue
> (https://github.com/shirok/Gauche/issues/1080) you changed
> libobj.scm. To apply this change to the debian package I have to run
> precomp of the previous gauche version to produce a new libobj.c. I then
> could add a patch updating libobj.c to the debian package. Of course
> this patch is unreadable (by a human). Now my host could be compromised
> and the new libobj.c could contain a backdoor? Of course I could just
> wait for you to make a new release but similarly one could argue that the
> generated files in the release tar ball could be backdoored, too?
>
> Or did I end up in the wrong rabbit hole?
>
> Best regards
> Jens
>
>
> _______________________________________________
> Gauche-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/gauche-devel
>

--000000000000e99a690627a69ba7
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Ah, I see.<div><br></div><div>Re-tracing the chain of trus=
ted sources may end up either impractical (taking too much time) or enterin=
g another rabbit hole (getting trusted STk).=C2=A0 If we really want one, a=
 possible path is to write a version of a subset of Gauche that is enough t=
o run precomp, in portable R7RS.=C2=A0 =C2=A0It is a lot of work, but once =
done, any trusted R7RS implementation can do the job.</div><div><br></div><=
div>However, if this kind of patch-and-regenerate is relatively rare, I cou=
ld create an intermediate release (0.9.15-p2).=C2=A0 =C2=A0It is at least &=
quot;official&quot;; you can confirm its integrity by my signature.</div><d=
iv><br></div><div>--shiro</div><div><br></div></div><br><div class=3D"gmail=
_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Sun, Nov 24, 2024 at 12:55=
=E2=80=AFAM Jens Thiele &lt;<a href=3D"mailto:[email protected]">[email protected]=
e</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin=
:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"=
>Shiro Kawai &lt;<a href=3D"mailto:[email protected]" target=3D"_blank"=
>[email protected]</a>&gt; writes:<br>
<br>
&gt; IIRC, earlier versions of Gauche required STk.=C2=A0 It won&#39;t be v=
ery simple to<br>
&gt; retrace everything.<br>
&gt; What is it for?<br>
<br>
How I ended up there:<br>
<br>
During fixing the reproducible build issue<br>
(<a href=3D"https://github.com/shirok/Gauche/issues/1080" rel=3D"noreferrer=
" target=3D"_blank">https://github.com/shirok/Gauche/issues/1080</a>) you c=
hanged<br>
libobj.scm. To apply this change to the debian package I have to run<br>
precomp of the previous gauche version to produce a new libobj.c. I then<br=
>
could add a patch updating libobj.c to the debian package. Of course<br>
this patch is unreadable (by a human). Now my host could be compromised<br>
and the new libobj.c could contain a backdoor? Of course I could just<br>
wait for you to make a new release but similarly one could argue that the<b=
r>
generated files in the release tar ball could be backdoored, too?<br>
<br>
Or did I end up in the wrong rabbit hole?<br>
<br>
Best regards<br>
Jens<br>
<br>
<br>
_______________________________________________<br>
Gauche-devel mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">Gau=
[email protected]</a><br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/gauche-devel" rel=
=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/lists/listi=
nfo/gauche-devel</a><br>
</blockquote></div>

--000000000000e99a690627a69ba7--


--===============1417754405634530130==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============1417754405634530130==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Gauche-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/gauche-devel

--===============1417754405634530130==--