Received-SPF: pass (google.com: domain of linux-kernel+bounces-130530-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
Date: Wed, 3 Apr 2024 22:59:03 +0300
From: Lasse Collin <lasse.collin@tukaani.org>
To: <angel.lkml@16bits.net>
Cc: Andrew Morton <akpm@linux-foundation.org>, Jubin Zhong
 <zhongjubin@huawei.com>, linux-kernel@vger.kernel.org,
 vegard.nossum@oracle.com
Subject: Re: [PATCH 11/11] xz: Adjust arch-specific options for better
 kernel compression
Message-ID: <20240403225903.0773746d@kaneli>
In-Reply-To: <27db456edeb6f72e7e229c2333c5d8449718c26e.camel@16bits.net>
References: <20240320183846.19475-1-lasse.collin@tukaani.org>
	<20240320183846.19475-12-lasse.collin@tukaani.org>
	<27db456edeb6f72e7e229c2333c5d8449718c26e.camel@16bits.net>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On 2024-03-31 angel.lkml@16bits.net wrote:
> Under the light of the recent xz backdoor, I should note that this
> patch (patch 11) does:
> 
> > +# Set XZ_VERSION (and LIBLZMA_VERSION). This is needed to disable
> > features +# that aren't available in old XZ Utils versions.
> > +eval "$($XZ --robot --version)" || exit

The eval method has been on the xz man page for a very long time but I
agree that due to the recent events the above method is not ideal.

It can break also if XZ_OPT or XZ_DEFAULTS contains something that they
usually shouldn't. For example, XZ_OPT=--help would make the above eval
method run the output of $XZ --help.

> So, in the spirit of keeping a fair amount of paranoia, and since it
> doesn't do any harm, any such code should be failproofed to ensure it
> can only import the expected shell variables with the right format[3]:
>
>  eval "$($XZ --robot --version | grep '^\(XZ\|LIBLZMA\)_VERSION=[0-9]*$')" || exit

I would rather get rid of eval. I committed the following to the
upstream repository:

XZ_VERSION=$($XZ --robot --version | sed -n 's/^XZ_VERSION=//p') || exit

Thanks!

-- 
Lasse Collin