GNU bug report logs - #59383
[PATCH] doc: Call out potential for downgrade attacks with time-machine.

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: "pelzflorian (Florian Pelz)" <pelzflorian <at> pelzflorian.de>
Cc: tracker <at> debbugs.gnu.org
Subject: bug#59383: closed ([PATCH] doc: Call out potential for downgrade
 attacks with time-machine.)
Date: Tue, 22 Nov 2022 14:48:02 +0000

[Message part 1 (text/plain, inline)]

Your message dated Tue, 22 Nov 2022 15:47:09 +0100
with message-id <87o7szcahe.fsf <at> pelzflorian.de>
and subject line Re: bug#59383: [PATCH] doc: Call out potential for downgrade attacks with time-machine.
has caused the debbugs.gnu.org bug report #59383,
regarding [PATCH] doc: Call out potential for downgrade attacks with time-machine.
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs <at> gnu.org.)


-- 
59383: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=59383
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: "pelzflorian (Florian Pelz)" <pelzflorian <at> pelzflorian.de>
To: guix-patches <at> gnu.org
Subject: [PATCH] doc: Call out potential for downgrade attacks with
 time-machine.
Date: Sat, 19 Nov 2022 13:09:31 +0100

* doc/guix.texi (Invoking guix time-machine): Add a note.
---
 doc/guix.texi | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index eaecfd0daa..c29db13be6 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -60,7 +60,7 @@
 Copyright @copyright{} 2018 Mike Gerwitz@*
 Copyright @copyright{} 2018 Pierre-Antoine Rouby@*
 Copyright @copyright{} 2018, 2019 Gábor Boskovits@*
-Copyright @copyright{} 2018, 2019, 2020 Florian Pelz@*
+Copyright @copyright{} 2018, 2019, 2020, 2022 Florian Pelz@*
 Copyright @copyright{} 2018 Laura Lazzati@*
 Copyright @copyright{} 2018 Alex Vong@*
 Copyright @copyright{} 2019 Josh Holland@*
@@ -4834,6 +4834,13 @@ Invoking guix time-machine
 large number of packages; the result is cached though and subsequent
 commands targeting the same commit are almost instantaneous.
 
+@quotation Note
+Naturally, no security fixes can be provided for old versions of Guix
+or its channels.  This also means that careless use of @command{guix
+time-machine} opens the door to downgrade attacks.
+@xref{Invoking guix pull, @option{--allow-downgrades}}.
+@end quotation
+
 The general syntax is:
 
 @example

base-commit: 7502af793172714b2b322c21ba2379c698108ef2
-- 
2.38.0

[Message part 3 (message/rfc822, inline)]

From: "pelzflorian (Florian Pelz)" <pelzflorian <at> pelzflorian.de>
To: 59383-done <at> debbugs.gnu.org
Cc: Ludovic Courtès <ludo <at> gnu.org>,
 Tobias Geerinckx-Rice <me <at> tobias.gr>, zimoun <zimon.toutoune <at> gmail.com>
Subject: Re: bug#59383: [PATCH] doc: Call out potential for downgrade
 attacks with time-machine.
Date: Tue, 22 Nov 2022 15:47:09 +0100

zimoun’s wording is good; less alarmist.  I used his words (with a
period before @xref, no french spacing and a less alarmist commit
message and Co-authored by line).  Pushed as
b8d4c323f5d089dd800b358143d5bae26c965404.  Closing.

Regards,
Florian

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.