Re: Consider removing autogenerated files from tarballs
| From: | Christian Schneider | Date: | Sun, 31 Mar 2024 13:53:54 +0000 |
| Subject: | Re: Consider removing autogenerated files from tarballs | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-122835@lists.php.net to get a copy of this message | ||
Am 30.03.2024 um 16:35 schrieb Daniil Gentili <daniil.gentili@gmail.com>:
>> That would break lots of tools as it requires extra dependencies so it is not something
>> that would could in stable versions.
> Btw, I do not believe that "it would require end users to install autotools and bison in
> order to compile PHP from tarballs" is valid reason to delay the patching of a serious attack
> vector ASAP.
I agree with Jakub that removing configure would just shift the problem, not solve it, while at the
same time puts a new burden on people compiling PHP from downloaded archives.
But my main question is: I fail to see the difference whether I plant my malicious code in
configure, configure.ac or *.c: Someone has to review the changes and notice the problem. And we
have to trust the RMs. What am I missing?
Regards,
- Chris