GNU bug report logs - #60782
Channels and dependency confusion

Previous Next

Full log

Message #12 received at 60782 <at> debbugs.gnu.org (full text, mbox):

From: Simon Tournier <zimon.toutoune <at> gmail.com>
To: Ludovic Courtès <ludovic.courtes <at> inria.fr>,
 60782 <at> debbugs.gnu.org
Subject: Re: bug#60782: Channels and dependency confusion
Date: Fri, 13 Jan 2023 18:16:41 +0100

Hi,

On ven., 13 janv. 2023 at 14:48, Ludovic Courtès <ludovic.courtes <at> inria.fr> wrote:

> Nothing, because the ‘guix’ channel always comes first in the module
> search path (see ‘%package-module-path’ in (gnu packages)).  Good.
>
> Now same scenario, but with references to another channel, for example
> (@ (past packages boost) boost-1.68) provided by Guix-Past.

The PyPI attack used to comprised PyTorch exploits that the PyPI index
takes precedence and sadly PyPI is not curated.

    https://github.com/pypa/pip/issues/8606

Well, the assumption for a similar attack using Guix channels is that
the user first adds the channel to their channel list.  Therefore, they
trust what they consider able to be trust. ;-)


> This time, if the user pulls in an additional channel that also provides
> (@ (past packages boost) boost-1.68), we do not know which one is going
> to take precedence.  It may go unnoticed though, because
> ‘channel-instances->derivation’ calls ‘profile-derivation’, which uses
> ‘build-profile’, which calls ‘union-build’ with the default file
> collision policy, which is to warn (the warning only appears in the
> build log).
>
> I think it would be best to error out if multiple channels provide
> same-named files.

Yes, it could be a counter-measure.  Aside the security risk, it even
appears to me sane to error because this collision leads to an undefined
behaviour.  And such undefined behaviour should be removed; they are
never a good thing.


Cheers,
simon

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.