#60782 - Channels and dependency confusion

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #12 received at 60782@debbugs.gnu.org (full text, mbox, reply):

Received: (at 60782) by debbugs.gnu.org; 13 Jan 2023 17:17:04 +0000
From debbugs-submit-bounces@debbugs.gnu.org Fri Jan 13 12:17:04 2023
Received: from localhost ([127.0.0.1]:52287 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1pGNfq-0002Bs-Lg
	for submit@debbugs.gnu.org; Fri, 13 Jan 2023 12:17:04 -0500
Received: from mail-wr1-f48.google.com ([209.85.221.48]:40903)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <zimon.toutoune@gmail.com>) id 1pGNfj-0002B5-IM
 for 60782@debbugs.gnu.org; Fri, 13 Jan 2023 12:16:59 -0500
Received: by mail-wr1-f48.google.com with SMTP id r2so21686697wrv.7
 for <60782@debbugs.gnu.org>; Fri, 13 Jan 2023 09:16:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112;
 h=content-transfer-encoding:mime-version:message-id:date:references
 :in-reply-to:subject:to:from:from:to:cc:subject:date:message-id
 :reply-to; bh=8Bvqqaagw89mV6msUE+wNr2iqou9VS/piQbxYfpdxbw=;
 b=J5SFVQcdkdsoo8rYOKb+vI0VvhawBRY3qhx86V+xaRqi5v6IK9dU/DnSvMhJY9I34R
 RhVoDc+S1EUUtu+v8vy60WtKg10vPn4jHZEjVn+mfESwfxV4LtSuXVuIBNswnDRjHBQD
 ZXn++7WuZhrrNg5R7zQ/W1c7+fFVYGHLOwfS0REDoq7/UJb5iQm/VZZ9VwCTXVS2QnB1
 nNjBA9U1h+TVd1LxCHj8FkWLq32tPoWq7QhQlkWX6DW3mSHSeqn7R+N/5HFqBSDmaqBY
 ovyhD4PghbgwC6H0xRV3k6NIf0F3eVv0y4AWmbqY8Q7IPua1slIiSk8wCEuT+81yBZSe
 Wbaw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20210112;
 h=content-transfer-encoding:mime-version:message-id:date:references
 :in-reply-to:subject:to:from:x-gm-message-state:from:to:cc:subject
 :date:message-id:reply-to;
 bh=8Bvqqaagw89mV6msUE+wNr2iqou9VS/piQbxYfpdxbw=;
 b=413DyzNXfCUEmlLKwceB2VFSNqOkai5irEG7S4Xa6L5dAyT/HThj1WjWgtkTHEnFcf
 Gq+EvWEVnylq721jchlAzMnw+SbSPHwxMd7URPG7K8sTlortOwXW9Acurhhb9celkysc
 UCrNxfxly3SxPXsxdccDrFZuO9bGz67Xsw23V1rIvzHIiygsaXHevkFb07lP6cKxaZ96
 eIEHbZ53y1GXm57mMx+4yw4W2oZ7ST/D6TUI0FPFiJNKPX6VG/5QEY2odo7HTMhOznwx
 W07eWE7NbIzsZEbVu3+q/topgZh8yJ2jOVXT70O0Noy89UBkUm46btlQ7hWZZczEnG8l
 RXHg==
X-Gm-Message-State: AFqh2kpl9l8Vu60PGrU/c7qASplF+kExXkt1icatWL/FoaldOp09PP1O
 hjDI/ces7PkJFXgonRsaDMTGU3+9RzM=
X-Google-Smtp-Source: AMrXdXsgkdq0ZDAi3QSQqYlZ+U4W7o6XHzm5FCqmeZ+YgOs3ZXhvw73oXPEnoJjA4BNzMrfSVlzvOg==
X-Received: by 2002:a5d:4842:0:b0:2bb:62bf:f5cb with SMTP id
 n2-20020a5d4842000000b002bb62bff5cbmr3542866wrs.4.1673630209851; 
 Fri, 13 Jan 2023 09:16:49 -0800 (PST)
Received: from pfiuh07 ([193.48.40.241]) by smtp.gmail.com with ESMTPSA id
 t6-20020adfe446000000b002bb28209744sm19150946wrm.31.2023.01.13.09.16.49
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Fri, 13 Jan 2023 09:16:49 -0800 (PST)
From: Simon Tournier <zimon.toutoune@gmail.com>
To: Ludovic Courtès <ludovic.courtes@inria.fr>,
 60782@debbugs.gnu.org
Subject: Re: bug#60782: Channels and dependency confusion
In-Reply-To: <87r0vybl4q.fsf@inria.fr>
References: <87r0vybl4q.fsf@inria.fr>
Date: Fri, 13 Jan 2023 18:16:41 +0100
Message-ID: <87sfgeuzgm.fsf@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 60782
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Hi,

On ven., 13 janv. 2023 at 14:48, Ludovic Courtès <ludovic.courtes@inria.fr> wrote:

> Nothing, because the ‘guix’ channel always comes first in the module
> search path (see ‘%package-module-path’ in (gnu packages)).  Good.
>
> Now same scenario, but with references to another channel, for example
> (@ (past packages boost) boost-1.68) provided by Guix-Past.

The PyPI attack used to comprised PyTorch exploits that the PyPI index
takes precedence and sadly PyPI is not curated.

    https://github.com/pypa/pip/issues/8606

Well, the assumption for a similar attack using Guix channels is that
the user first adds the channel to their channel list.  Therefore, they
trust what they consider able to be trust. ;-)

> This time, if the user pulls in an additional channel that also provides
> (@ (past packages boost) boost-1.68), we do not know which one is going
> to take precedence.  It may go unnoticed though, because
> ‘channel-instances->derivation’ calls ‘profile-derivation’, which uses
> ‘build-profile’, which calls ‘union-build’ with the default file
> collision policy, which is to warn (the warning only appears in the
> build log).
>
> I think it would be best to error out if multiple channels provide
> same-named files.

Yes, it could be a counter-measure.  Aside the security risk, it even
appears to me sane to error because this collision leads to an undefined
behaviour.  And such undefined behaviour should be removed; they are
never a good thing.

Cheers,
simon

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Mon Sep 8 01:36:12 2025; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#60782 Channels and dependency confusion