Re: Packages removed from frozen
On 09-Feb-2000, Manoj Srivastava <srivasta@debian.org> wrote:
> Of course, some version X of gcc may introduce a trojan
> visible in the source code, and remove it in version X+1; but leave
> the infected binary around to perpetiuate teh trojan. I would expect
> the gtcc maintainer to be familair with the diffs and catch the most
> obvious of these attemptsl but I susptec that gcc sourrces ought to
> be built on other platforms periodically (perhaps even cross
> compiled) to ensure ourselves that the code is still clean.
Building the gcc source on another platform proves absolutely nothing
except that the sources are compilable.
Cross compiling using a different compiler is a reasonable start.
You actually need to cross compile with a different (preferrably "known
good" compiler that you wrote yourself, but an independent one is
reasonable) C compiler.
Then you should bootstrap the suspected sources with the cross compiled binary.
Then you should bootstrap the same suspected sources with a suspected
infected binary.
The files should check out to be exactly the same.
However, all the tools you use along the way must also be compiled
with the cross-compiled compiler, otherwise (for example) diff might
be infected to report that the files are the same when they are not.
Or ls might give the wrong file size, etc.
This is of course assuming the mother-of-all binary viruses.
I personally don't believe this this exists or has ever existed.
The mechanism of transferral is simply too fragile.
--
The quantum sort:
while (!sorted) { do_nothing(); }
Tyson Dowd <tyson@tyse.net> http://tyse.net/
Reply to: