thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

thesamesam

# Distributed under the terms of the GNU General Public License v2
#
# Hook to make it easier to detect compiler output changes in src_configure with stricter Clang
# Outputs logs to /var/tmp/clang.
# Written by Sam James <[email protected]> and Arsen Arsenović <[email protected]>
#
# For background, please see https://wiki.gentoo.org/wiki/Modern_C_porting.
#
# Instructions:
# 1. Install clang:15 or clang:16 or clang:17

thesamesam

Cross instructions

These instructions cover:

1. building a cross toolchain
2. populating the new ROOT
3. making it chrootable using qemu-user to easily run "native" builds or tests (this is like a stage3 at the end)

You do not need to follow through to the end if you don't need a stage3-like root.

Set up the toolchain

thesamesam

GCC

• Alpine Linux
• Arch Linux
• Debian, Ubuntu (on for most arches)
• Fedora does it via spec files globally, not via toolchain
• Gentoo (on for almost every arch by default, obviously in Gentoo you can toggle it easily if you want)
• openSUSE has an interesting gcc-pie package instead which provides a spec file
• Void Linux

LLVM

thesamesam

Hi all,

TL;DR: We really need help! There aren't many developers in Gentoo
interested in working on Itanium. Come hang around in #gentoo-ia64
on libera.chat (IRC) if you're interested in helping.

As discussed in the recent Gentoo Council meeting [0], concerns were raised
about the status of Itanium (IA64) and I agreed to write to gentoo-dev to
assess the level of interest & put out a call for volunteers.

thesamesam

!!! existing preserved libs:
>>> package: dev-libs/libyaml-0.2.5
 *  - /usr/lib64/libyaml-0.so.2
 *  - /usr/lib64/libyaml-0.so.2.0.9
 *      used by /usr/src/linux-5.15.11-gentoo-dist/scripts/dtc/dtc (sys-kernel/gentoo-kernel-5.15.11)
Use emerge @preserved-rebuild to rebuild packages using these libraries

thesamesam

From c08c30a7b6bf418dc8dd43e755eba82ac816be4b Mon Sep 17 00:00:00 2001
From: Sam James <[email protected]>
Date: Wed, 8 Dec 2021 02:10:34 +0000
Subject: [PATCH] Skip sched/priority tests

---
 Lib/test/test_posix.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Lib/test/test_posix.py b/Lib/test/test_posix.py

thesamesam

# -fdiagnostics-color=always: just for colour
# -frecord-gcc-switches: must be in *ALL* *FLAGS* (harmless but not needed in LDFLAGS) to be effective, or Portage skips it
COMMON_FLAGS="-O2 -pipe -march=native -fdiagnostics-color=always -frecord-gcc-switches"
CFLAGS="${COMMON_FLAGS}"
CXXFLAGS="${COMMON_FLAGS}"
FCFLAGS="${COMMON_FLAGS}"
FFLAGS="${COMMON_FLAGS}"
# You can use ${COMMON_FLAGS} here, but please remember to include as-needed manually then.
LDFLAGS="${LDFLAGS} -Wl,--defsym=__gentoo_check_ldflags__=0"

thesamesam

This document is oboslete!

Please read the news item and wiki page instead.

Migrating a Gentoo install to libxcrypt

This is a set of instructions for migrating a Gentoo glibc system's libcrypt provider from glibc[crypt] to libxcrypt[system].

See wiki notes for background, etc.

thesamesam

#!/bin/bash
## Name: commit-changed-pkgs

## Description:
##	Commits all changes with a given template
##  Can exclude by maintainer.
##  Useful for e.g. big batch changes like a sed across tree

## Usage:
##  - bash ~/scripts/commit-changed-pkgs