3 ms·

True, but irrelevant -- _some packages_, _somewhere_, do depend on xz, which, if built, requires pulling the source from GitHub (see the default.nix: https://gi

True, but irrelevant -- _some packages_, _somewhere_, do depend on xz, which, if built, requires pulling the source from GitHub (see the default.nix: https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/tools/compression/xz/default.nix#L60 https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/to...) It's not the vulnerability that's a problem right now (NixOS was protected by a couple of factors) but rather GitHub's hamfisted response. That is the problem.

dave_universetf 3y ago
It's not a problem, never has been. Nix mirrors all source bundles it pulls from third parties and caches them. cache.nixos.org has a copy of all the sources needed to build not just current HEAD, but also past commits (although deep history might start getting pruned for cost control soon, iiuc). The Software Heritage archive also has an up to date mirror of xz's repo: https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.com/tukaani-project/xz https://archive.softwareheritage.org/browse/origin/directory...
- dwattttt 3y ago
  In this instance then, it sounds like it has cached the source with a backdoor in it, and anyone using it is potentially exposing themselves to a very public problem right now.
  - dave_universetf 3y ago
    Also no. It was rolled back hours ago, and cache.nixos.org keeps all past builds so it didn't even need rebuilding. Orthogonal to that, the backdoor was irrelevant to nix in at least three different ways: the malicious build logic targeted rpm/deb build environments and so didn't trigger in nix's build sandbox, the backdoor code makes assumptions about filesystem layout that are invalid on nixos and so wouldn't have activated anyway, and nix doesn't include the downstream patch that results in the backdoor even getting into sshd's address space. Still got rolled back out of an abundance of caution, but nix got lucky that the attacker didn't bother targeting it the way they did debian and rpm-based distros.
    - Timshel 3y ago
      The issue is that the author had been contributing for 2 years. Debian is considering reverting prior to his involment or switching, cf: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024
      - seba_dos1 3y ago
        They do that out of caution, not because that's what needs to be done. No reason to panic if your distro doesn't go as far.
- ndriscoll 3y ago
  Are they storing source archives for each version? I'd think mirroring the actual repo might take less space than a bunch of copies of source archives. Though it looks like git only uses deflate on pack files. Someone should write a patch to add lzma support. :-)
gertop 3y ago
I find it amusing that you choose to blame GitHub and not nix's brittle design. (can you imagine any other OS breaking because a repository goes down?)
- anotherhue 3y ago
  NPM called... Anyway, it's called unstable for a reason. Despite debian trying to change the meaning of the term :)
anotherhue 3y ago
Sure, but 'my updates are broken' is a happier (and more familiar to nixos-unstable users) place to be in than 'my ssh access has been compromised for days'. Confirming no lzma linking on my recent x86_64 system: https://pastebin.com/hgN0LTxd https://pastebin.com/hgN0LTxd
- 1attice 3y ago
  yes, true, but also offtopic? Why are you bringing this up? This feels like 'anchoring' to me https://en.wikipedia.org/wiki/Anchoring_effect https://en.wikipedia.org/wiki/Anchoring_effect

dave_universetf 3y ago

It's not a problem, never has been. Nix mirrors all source bundles it pulls from third parties and caches them. cache.nixos.org has a copy of all the sources needed to build not just current HEAD, but also past commits (although deep history might start getting pruned for cost control soon, iiuc). The Software Heritage archive also has an up to date mirror of xz's repo: https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.com/tukaani-project/xz https://archive.softwareheritage.org/browse/origin/directory...

dwattttt 3y ago
In this instance then, it sounds like it has cached the source with a backdoor in it, and anyone using it is potentially exposing themselves to a very public problem right now.
- dave_universetf 3y ago
  Also no. It was rolled back hours ago, and cache.nixos.org keeps all past builds so it didn't even need rebuilding. Orthogonal to that, the backdoor was irrelevant to nix in at least three different ways: the malicious build logic targeted rpm/deb build environments and so didn't trigger in nix's build sandbox, the backdoor code makes assumptions about filesystem layout that are invalid on nixos and so wouldn't have activated anyway, and nix doesn't include the downstream patch that results in the backdoor even getting into sshd's address space. Still got rolled back out of an abundance of caution, but nix got lucky that the attacker didn't bother targeting it the way they did debian and rpm-based distros.
  - Timshel 3y ago
    The issue is that the author had been contributing for 2 years. Debian is considering reverting prior to his involment or switching, cf: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024
    - seba_dos1 3y ago
      They do that out of caution, not because that's what needs to be done. No reason to panic if your distro doesn't go as far.
ndriscoll 3y ago
Are they storing source archives for each version? I'd think mirroring the actual repo might take less space than a bunch of copies of source archives. Though it looks like git only uses deflate on pack files. Someone should write a patch to add lzma support. :-)

gertop 3y ago

I find it amusing that you choose to blame GitHub and not nix's brittle design. (can you imagine any other OS breaking because a repository goes down?)

anotherhue 3y ago
NPM called... Anyway, it's called unstable for a reason. Despite debian trying to change the meaning of the term :)

anotherhue 3y ago

Sure, but 'my updates are broken' is a happier (and more familiar to nixos-unstable users) place to be in than 'my ssh access has been compromised for days'. Confirming no lzma linking on my recent x86_64 system: https://pastebin.com/hgN0LTxd https://pastebin.com/hgN0LTxd

1attice 3y ago
yes, true, but also offtopic? Why are you bringing this up? This feels like 'anchoring' to me https://en.wikipedia.org/wiki/Anchoring_effect https://en.wikipedia.org/wiki/Anchoring_effect