Re: [gentoo-project] Some focus for Gentoo

[Rich Freeman]

On Wed, Jan 21, 2015 at 3:11 PM, hasufell <hasufell@g.o> wrote:
> Rich Freeman:
>> On Wed, Jan 21, 2015 at 11:36 AM, Julian <hasufell@××××××××.de> wrote:
>>>
>>> We would need much better tools and PM support for overlays. I've talked
>>> about this too and there are examples of at least two distros that are
>>> running a more decentralized model:
>>> 1. NixOS, also see my thread on nix-dev about how they want to ensure
>>> focus [0]
>>
>> I still don't get how NixOS avoids some fundamental issues.  As I
>> understand it they assign a unique ID to every build of everything,
>> and the dependencies are expressed in the same way.  So, my build 123
>> of appfoo v1.1 depends on build 456 of libz v2.  Your package might
>> depend on build 457 of libz v2, and that is fine since both versions
>> will be installed side-by-side.  Then we get to have two copies of
>> libz in RAM and maybe build 456 has a security vulnerability.  It is
>> better than static linking, but not by far.
>>
>
> All copies are known to the PM. That's nothing like bundles libs or
> static linkage. It's probably a triviality to develop a tool that checks
> for vulnerable libraries (not sure if there already is one).

I'm not saying that anything bundles libs.  My understanding is that
packages are basically all content-hashed and all dependencies
including linking is against one of these.  So, if you want you can
have 14 versions of the same library with the same SONAME and
completely different ABI/APIs and it will all work, because each
package is linked against the EXACT library it was built against.  Two
packages can still share the same library (in disk and in RAM), but
they could also use two different libraries which on most other
distros would collide (identical version, SONAME, etc).

So, when you use a package you're using the exact same code the
maintainer uses, including all the libraries.

I'm sure this breaks down at some point - you can't have 47 different
versions of dbus all running at the same time if you want processes to
actually talk to each other.  You obviously can only run one kernel at
a time, and there is only one port 80/25/etc on the system unless you
run every process in its own namespace.

I don't see how you'd check for vulnerable libraries other than using
heuristics (ie actually run the exploit against the library).  If
ANYBODY can create a repository, and a repository can contain any
number of builds of any number of versions of zlib, then how could you
possibly tell whether any particular build is patched for any
particular vulnerability otherwise?  Certainly you could offer a tool
that checks for known-vulnerable versions from a selection of
supported repositories.

Such a model also only promotes choice to a degree.  You can choose to
use Fred's version of libfoo, and Tony's version of java, but you
can't use them together unless tony also chooses to support this
configuration.  Tony's java could very well link to Sam's libfoo and
you don't like that version of it, but java isn't all that popular
these days so beggars can't be choosers.

With Gentoo you can mix/match dependencies but the same thing that
allows that to work will also cause the system to break horribly when
somebody changes an ABI without changing an SONAME and so on.

>
> My point was: it's not enough talking about "what should we focus on?".
> How do you implement that focus?

I do agree with this, which is one of my concerns with the original
post.  We can certainly talk about what we should focus on, but the
only thing as a Council we really have the power to do is to forbid
people from working on other things, or to expel hot air.  The latter
can accomplish some good, but not much.

>
> What's your idea there, except of keeping status quo which clearly does
> not work since even gentoo oldtimers seem to realize something is going
> wrong?
>

If I had solutions I'd be posting them.  Apologies if it seems like
I'm nitpicking.  The thing is that while the status quo has some clear
deficiencies, in some ways it is also the best Gentoo has really ever
been.

Or put another way, where else are we going to go?  Maybe that is why
so many of us that seem to have so much conflict with each other all
stick around.

-- 
Rich