Subject: bug#59383: closed (Re: bug#59383: [PATCH] doc: Call out potential for downgrade attacks with time-machine.)

From: [email-masked] (GNU bug Tracking System)
Date: Tue, 22 Nov 2022 14:48:02 +0000

Your bug report

#59383: [PATCH] doc: Call out potential for downgrade attacks with time-machine.

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
59383: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=59383
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#59383: [PATCH] doc: Call out potential for downgrade attacks with time-machine.
From: "pelzflorian (Florian Pelz)" <[email-masked]>
To: [email-masked]
Cc: Ludovic Courtès <[email-masked]>, Tobias Geerinckx-Rice <[email-masked]>, zimoun <[email-masked]>
Date: Tue, 22 Nov 2022 15:47:09 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

zimoun’s wording is good; less alarmist.  I used his words (with a
period before @xref, no french spacing and a less alarmist commit
message and Co-authored by line).  Pushed as
b8d4c323f5d089dd800b358143d5bae26c965404.  Closing.

Regards,
Florian

Subject: [PATCH] doc: Call out potential for downgrade attacks with time-machine.
From: "pelzflorian (Florian Pelz)" <[email-masked]>
To: [email-masked]
Date: Sat, 19 Nov 2022 13:09:31 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

* doc/guix.texi (Invoking guix time-machine): Add a note.
---
 doc/guix.texi | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index eaecfd0daa..c29db13be6 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -60,7 +60,7 @@
 Copyright @copyright{} 2018 Mike Gerwitz@*
 Copyright @copyright{} 2018 Pierre-Antoine Rouby@*
 Copyright @copyright{} 2018, 2019 Gábor Boskovits@*
-Copyright @copyright{} 2018, 2019, 2020 Florian Pelz@*
+Copyright @copyright{} 2018, 2019, 2020, 2022 Florian Pelz@*
 Copyright @copyright{} 2018 Laura Lazzati@*
 Copyright @copyright{} 2018 Alex Vong@*
 Copyright @copyright{} 2019 Josh Holland@*
@@ -4834,6 +4834,13 @@ Invoking guix time-machine
 large number of packages; the result is cached though and subsequent
 commands targeting the same commit are almost instantaneous.
 
+@quotation Note
+Naturally, no security fixes can be provided for old versions of Guix
+or its channels.  This also means that careless use of @command{guix
+time-machine} opens the door to downgrade attacks.
+@xref{Invoking guix pull, @option{--allow-downgrades}}.
+@end quotation
+
 The general syntax is:
 
 @example

base-commit: 7502af793172714b2b322c21ba2379c698108ef2
-- 
2.38.0