Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122886
Content-Type: multipart/alternative;
 boundary="------------IbzMe5nCJnoMe8wJ9Orn5FkH"
Message-ID: <ef7edce7-8787-4eb0-8fba-254168e1d266@gmail.com>
Date: Tue, 2 Apr 2024 12:05:35 -0600
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PHP-DEV] Consider removing autogenerated files from tarballs
Content-Language: en-US
To: internals@lists.php.net
References: <AM8P250MB01705B564C0F9B2F460F56B0E2392@AM8P250MB0170.EURP250.PROD.OUTLOOK.COM>
 <9008050F-4EE1-4E19-B513-654602E118A7@benramsey.com>
 <CADyq6sLr=Zv0OmL55na0c6kGkaxvy9A8fJhptn71si8u7rzedQ@mail.gmail.com>
 <CAEKnhAGmDRMypM=fsWAroC6M6JcbwQRf7HYbb7n3GPNVQGvXjA@mail.gmail.com>
 <95c92b6a-6788-fddb-a130-e4d122338b68@php.net>
 <CAEKnhAG4AYy9wPzuVq3y_hqfjcWMDi8HtCkVQyL9Txoqogwz7A@mail.gmail.com>
 <CAO__Xv7=31W8FQgJ8xTokzA_qu0wo0bcVfOC7dKTMGGeOxmAhA@mail.gmail.com>
 <CAEKnhAEtuiQZ_7TpkwcONCeJ4=nOB-_UCHoJ+ojO1tGVNCmcWw@mail.gmail.com>
In-Reply-To: <CAEKnhAEtuiQZ_7TpkwcONCeJ4=nOB-_UCHoJ+ojO1tGVNCmcWw@mail.gmail.com>
From: smalyshev@gmail.com (Stanislav Malyshev)

This is a multi-part message in MIME format.
--------------IbzMe5nCJnoMe8wJ9Orn5FkH
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Hi!


>     That is something PHP is missing atm, no one can verify the build
>     process for releases.
>
>
> Yes that's what I was suggesting. This should be done by RM. In that 
> way, the RM becomes more someone that verifies the build and not the 
> actual person that provides the build.

I'm not sure though how the RM can really verify it. I mean, we have the 
tar blob that comes from the git repo - which we assume is legit. We 
also have some files that aren't in the repo. If RM builds them by 
themselves then the question comes up what if RM's environment is 
compromised and something bad is injected. If RM receives the files from 
outside source, how the RM verifies they are genuine?  I don't think 
reading through the whole "configure" file and verifying it's not bad is 
realistic for any person. And from what I understand, "configure" and 
such are quite environment-dependant, so you can't just have a standard 
hash to compare to. You can't have the RM to just run "buildconf" again 
and do hash check because they may get different bits than the ones 
coming from the outside, like CI. I dunno, maybe if we had some kind of 
Docker image for generating it that would produce reproducible result, 
that'd be possible? Otherwise I am still not sure how the verification 
procedure looks like.

Right now as I understand we're simply trusting the RM that they have 
uncompromised environment and third parties have no way to verify it's 
the case. But I guess it's time we do better?

Thanks,

Stas

--------------IbzMe5nCJnoMe8wJ9Orn5FkH
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>Hi!<br>
    </p>
    <br>
    <blockquote type="cite"
cite="mid:CAEKnhAEtuiQZ_7TpkwcONCeJ4=nOB-_UCHoJ+ojO1tGVNCmcWw@mail.gmail.com">
      <div dir="ltr">
        <div class="gmail_quote">
          <blockquote class="gmail_quote"
style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
            <div dir="ltr">
              <div class="gmail_quote">
                <div>That is something PHP is missing atm, no one can
                  verify the build process for releases.<br>
                </div>
              </div>
            </div>
          </blockquote>
          <div><br>
          </div>
          <div>Yes that's what I was suggesting. This should be done by
            RM. In that way, the RM becomes more someone that verifies
            the build and not the actual person that provides the build.</div>
        </div>
      </div>
    </blockquote>
    <p>I'm not sure though how the RM can really verify it. I mean, we
      have the tar blob that comes from the git repo - which we assume
      is legit. We also have some files that aren't in the repo. If RM
      builds them by themselves then the question comes up what if RM's
      environment is compromised and something bad is injected. If RM
      receives the files from outside source, how the RM verifies they
      are genuine?  I don't think reading through the whole "configure"
      file and verifying it's not bad is realistic for any person. And
      from what I understand, "configure" and such are quite
      environment-dependant, so you can't just have a standard hash to
      compare to. You can't have the RM to just run "buildconf" again
      and do hash check because they may get different bits than the
      ones coming from the outside, like CI. I dunno, maybe if we had
      some kind of Docker image for generating it that would produce
      reproducible result, that'd be possible? Otherwise I am still not
      sure how the verification procedure looks like.</p>
    <p>Right now as I understand we're simply trusting the RM that they
      have uncompromised environment and third parties have no way to
      verify it's the case. But I guess it's time we do better?</p>
    <p>Thanks,</p>
    <p>Stas<br>
    </p>
  </body>
</html>

--------------IbzMe5nCJnoMe8wJ9Orn5FkH--