Subject: bug#60782: Channels and dependency confusion

From: Simon Tournier <[email-masked]>
Date: Fri, 13 Jan 2023 18:16:41 +0100

Hi,

On ven., 13 janv. 2023 at 14:48, Ludovic Courtès <[email-masked]> wrote:

> Nothing, because the ‘guix’ channel always comes first in the module
> search path (see ‘%package-module-path’ in (gnu packages)).  Good.
>
> Now same scenario, but with references to another channel, for example
> (@ (past packages boost) boost-1.68) provided by Guix-Past.

The PyPI attack used to comprised PyTorch exploits that the PyPI index
takes precedence and sadly PyPI is not curated.

    https://github.com/pypa/pip/issues/8606

Well, the assumption for a similar attack using Guix channels is that
the user first adds the channel to their channel list.  Therefore, they
trust what they consider able to be trust. ;-)

> This time, if the user pulls in an additional channel that also provides
> (@ (past packages boost) boost-1.68), we do not know which one is going
> to take precedence.  It may go unnoticed though, because
> ‘channel-instances->derivation’ calls ‘profile-derivation’, which uses
> ‘build-profile’, which calls ‘union-build’ with the default file
> collision policy, which is to warn (the warning only appears in the
> build log).
>
> I think it would be best to error out if multiple channels provide
> same-named files.

Yes, it could be a counter-measure.  Aside the security risk, it even
appears to me sane to error because this collision leads to an undefined
behaviour.  And such undefined behaviour should be removed; they are
never a good thing.

Cheers,
simon