Conversation

Notices

1. Embed this notice
   Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Sunday, 15-Jun-2025 15:29:55 JST Haelwenn /элвэн/ :triskell:

   • Julia :v_trans: :v_bi: (not cute)
   @Rairii @julia Yeah that too, the license more matters when you want to make modifications and share them, without say having a Nintendo throwing you a DMCA.
   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Sunday, 15-Jun-2025 15:36:43 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • Julia :v_trans: :v_bi: (not cute)

     @Rairii @julia And well if you want to audit GNU code, you'll probably want binary-auditing skills because:

     • GNU Gettext has gettext-tools/m4/csharpexec-test.exe and 3 java class files in gettext-tools/examples
     • gnulib (vendored in so many projects) has lib/javaversion.class with no recipe for it

     (And parts of me wonder how well that works legally given the GPL…)

   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Sunday, 15-Jun-2025 18:46:32 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • Julia :v_trans: :v_bi: (not cute)
     • mid_kid
     @mid_kid @julia @Rairii Seems to be the case for gettext but debian has a *lot* of pre-built binaries.
     
     Like here's prebuild java detected by lintian: https://udd.debian.org/lintian-tag/source-contains-prebuilt-java-object?affected=yes
     
     And for other pre-built detected by lintian, https://wiki.debian.org/AutoGeneratedFiles has a list of URLs.
   • Embed this notice
     mid_kid (mid_kid@fosstodon.org)'s status on Sunday, 15-Jun-2025 18:46:33 JST mid_kid

     in reply to

     • Julia :v_trans: :v_bi: (not cute)

     @lanodan @julia @Rairii I expect distros like debian have removed those from the source tarball... Not like java and c# are very auditable as an ecosystem anyway.

   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Sunday, 15-Jun-2025 19:06:52 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • Julia :v_trans: :v_bi: (not cute)
     • mid_kid
     @mid_kid @julia @Rairii Well firefox for a while shipped a build of python2.7 and as far as I can tell (not a debian packager) it was left there.
     
     https://salsa.debian.org/mozilla-team/firefox/-/commits/esr78/master/obj-x86_64-pc-linux-gnu/_virtualenvs/init/bin
   • Embed this notice
     mid_kid (mid_kid@fosstodon.org)'s status on Sunday, 15-Jun-2025 19:06:53 JST mid_kid

     in reply to

     • Julia :v_trans: :v_bi: (not cute)

     @lanodan @julia @Rairii I suppose java objects and some others might be the exception, as really the ecosystem doesn't make it easy to properly rebuild everything, but as the top of the page states, the DFSG requires source code to be available for everything shipped in the distro, and stripping blobs from source archives is part of that goal. Debian doesn't ship source-less blobs outside of the "non-free" repo.

   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Sunday, 15-Jun-2025 19:22:10 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • Sun Microdevil Pte Ltd
     • Julia :v_trans: :v_bi: (not cute)
     @koakuma @julia @Rairii 7 layers of macros vs. one optimised binary with some obscure instructions, which way auditor? :D
     Phantasm likes this.
   • Embed this notice
     Sun Microdevil Pte Ltd (koakuma@uwu.social)'s status on Sunday, 15-Jun-2025 19:22:11 JST Sun Microdevil Pte Ltd

     in reply to

     • Julia :v_trans: :v_bi: (not cute)

     @lanodan @julia @Rairii Because... sometimes the source is just complicated enough that reading the generated binary and/or observing it running *is* your best bet at understanding it :akko_aaa:

   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Sunday, 15-Jun-2025 19:27:52 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • Sun Microdevil Pte Ltd
     • Julia :v_trans: :v_bi: (not cute)
     @koakuma @Rairii @julia And personally I think there's some executables where the resulting binary ought to be audited, setuid executables for example.
   • Embed this notice
     Alexey (yyp@fosstodon.org)'s status on Sunday, 15-Jun-2025 22:30:43 JST Alexey

     in reply to

     @lanodan All those files have source equivalents now*. It's definitely very strange that binaries were put there instead of just compiling during the build. Both csharptest and javaversion are tiny but compiled with ancient toolchains which means it's very annoying to reproduce them exactly. Auditing is quite easy: `javap -p -c` and `ikdasm` (from mono) can show the very few instructions making up those files – there's nothing funny going on there.

     * Concerning (2023!): https://lists.gnu.org/archive/html/bug-gettext/2023-02/msg00016.html

   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Sunday, 15-Jun-2025 22:30:43 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • Alexey

     @yyp As far as I know for java you could use -target 1.1 with javac. But well the only javac I got was an old version of eclipse-ecj (as I failed to bootstrap OpenJDK).
     And failing that it should still be proper documented so it can be remade for modifications when needed (in fact Guix and quite few other distros keep ancient versions around as mere build-dependencies).

     And recipes are required per GPL, at least GPLv3's "Corresponding Source", which GNU gettext is licensed under.

   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Sunday, 15-Jun-2025 22:42:41 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • Julia :v_trans: :v_bi: (not cute)
     • mid_kid
     @mid_kid @Rairii @julia Also, mono isn't into non-free even though I'm pretty sure Debian does not builds it 100% from source as the only one I know which managed to is Guix after a massive effort: https://guix.gnu.org/blog/2024/adding-a-fully-bootstrapped-mono/
     
     To give you an idea, that's the blobs in mono-6.12.0.122 tarball: https://hacktivis.me/notes/mono-6.12.0.122_deblob.log
   • Embed this notice
     Alexey (yyp@fosstodon.org)'s status on Sunday, 15-Jun-2025 22:47:45 JST Alexey

     in reply to

     @lanodan The javaversion.java file has a command to build it (not sure if it counts as a "recipe").

     With some tweaking I managed to build the binary with openjdk-jdk8u which is the oldest version I could get on Alpine (javac -d . -target 1.1 -source 1.2 javaversion.java) but it still has a 3 byte difference from the original. Not sure what's up with that.

     As for C#, well, there are no instructions or compiler versions anywhere. Using standard csc from the latest mono gives tons of differences.

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Alexey (yyp@fosstodon.org)'s status on Sunday, 15-Jun-2025 23:01:20 JST Alexey

     in reply to

     @lanodan I've managed to get a 100% match for javaversion.class.

     Unfortunately, the provided source is not correct. The binary class file contains debug symbols, in particular line numbers. At some point the source was modified and had its line numbers shifted which caused a mismatch when I recompiled it. I "fixed" it by deleting 3 comment lines from the header to compensate for the shift.

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Alexey (yyp@fosstodon.org)'s status on Monday, 16-Jun-2025 02:49:36 JST Alexey

     in reply to

     @lanodan I've got a few things working with csharpexec-test. I could get a build pretty close the shipped one with Mono 2.6.7 (running in Wine because I couldn't build a native version, oops). It has functions in the wrong order and some field values have minor differences but it's probably the closest I could get to a complete match. Also, C# assemblies have a random build ID so a 100% would never be possible. This project took way too much time, the findings are impractical, but it was "fun"

     Haelwenn /элвэн/ :triskell: likes this.