[PATCH libnetfilter_log] autoconf: don't curl build script

[PATCH libnetfilter_log] autoconf: don't curl build script

[Florian Westphal]

This is a bad idea; cloning repo followed by "./autogen.sh" brings
repository into a changed state.

Partial revert of 74576db959cb
("build: doc: `make` generates requested documentation")

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 autogen.sh | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/autogen.sh b/autogen.sh
index 93e2a23135d4..5e1344a85402 100755
--- a/autogen.sh
+++ b/autogen.sh
@@ -1,12 +1,4 @@
 #!/bin/sh -e
 
-BUILD_MAN=doxygen/build_man.sh
-
-# Allow to override build_man.sh url for local testing
-# E.g. export NFQ_URL=file:///usr/src/libnetfilter_queue
-curl ${NFQ_URL:-https://git.netfilter.org/libnetfilter_queue/plain}/$BUILD_MAN\
-  -o$BUILD_MAN
-chmod a+x $BUILD_MAN
-
 autoreconf -fi
 rm -Rf autom4te.cache
-- 
2.48.1

Re: [PATCH libnetfilter_log] autoconf: don't curl build script

[Duncan Roe]

Hi Florian,

On Sun, Mar 09, 2025 at 11:55:19AM +0100, Florian Westphal wrote:
> This is a bad idea; cloning repo followed by "./autogen.sh" brings
> repository into a changed state.
>
> Partial revert of 74576db959cb
> ("build: doc: `make` generates requested documentation")
>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>  autogen.sh | 8 --------
>  1 file changed, 8 deletions(-)
>
> diff --git a/autogen.sh b/autogen.sh
> index 93e2a23135d4..5e1344a85402 100755
> --- a/autogen.sh
> +++ b/autogen.sh
> @@ -1,12 +1,4 @@
>  #!/bin/sh -e
>
> -BUILD_MAN=doxygen/build_man.sh
> -
> -# Allow to override build_man.sh url for local testing
> -# E.g. export NFQ_URL=file:///usr/src/libnetfilter_queue
> -curl ${NFQ_URL:-https://git.netfilter.org/libnetfilter_queue/plain}/$BUILD_MAN\
> -  -o$BUILD_MAN
> -chmod a+x $BUILD_MAN
> -
>  autoreconf -fi
>  rm -Rf autom4te.cache
> --
> 2.48.1
>
>
| This is a bad idea; cloning repo followed by "./autogen.sh" brings
| repository into a changed state.

Agree with the above, except IMHO the "bad idea" is to have a frozen version of
build_man.sh in the repository at all.

Pablo did that - I didn't like to quibble at the time but I thought no good
would come of it.

I've sent in an alternative patch to remove build_man.sh from the repo and add
it to .gitignore.

With this patch git clone followed by "./autogen.sh" behaves as it should.

Cheers ... Duncan.

Re: [PATCH libnetfilter_log] autoconf: don't curl build script

[Florian Westphal]

Duncan Roe <duncan_roe@optusnet.com.au> wrote:
> | This is a bad idea; cloning repo followed by "./autogen.sh" brings
> | repository into a changed state.
> 
> Agree with the above, except IMHO the "bad idea" is to have a frozen version of
> build_man.sh in the repository at all.

I absolutely hate the idea of fetching stuff at build time.
And in this case, we fetch an exectuable shell script from
untrusted location.

It has backdoor written all over it.

Re: [PATCH libnetfilter_log] autoconf: don't curl build script

[Duncan Roe]

On Mon, Mar 10, 2025 at 09:34:46AM +0100, Florian Westphal wrote:
>
> I absolutely hate the idea of fetching stuff at build time.
> And in this case, we fetch an exectuable shell script from
> untrusted location.
>
Ok in future I'll send build_man patches to libnetfilter_log once they're
applied to libnetfilter_queue.

Have just found an error in the latest update :( so will wait for the fix
to be accepted.

Cheers ... Duncan.

Re: [PATCH libnetfilter_log] autoconf: don't curl build script

[Pablo Neira Ayuso]

On Sun, Mar 09, 2025 at 11:55:19AM +0100, Florian Westphal wrote:
> This is a bad idea; cloning repo followed by "./autogen.sh" brings
> repository into a changed state.
> 
> Partial revert of 74576db959cb
> ("build: doc: `make` generates requested documentation")

Please, apply this. Thanks.

> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>  autogen.sh | 8 --------
>  1 file changed, 8 deletions(-)
> 
> diff --git a/autogen.sh b/autogen.sh
> index 93e2a23135d4..5e1344a85402 100755
> --- a/autogen.sh
> +++ b/autogen.sh
> @@ -1,12 +1,4 @@
>  #!/bin/sh -e
>  
> -BUILD_MAN=doxygen/build_man.sh
> -
> -# Allow to override build_man.sh url for local testing
> -# E.g. export NFQ_URL=file:///usr/src/libnetfilter_queue
> -curl ${NFQ_URL:-https://git.netfilter.org/libnetfilter_queue/plain}/$BUILD_MAN\
> -  -o$BUILD_MAN
> -chmod a+x $BUILD_MAN
> -
>  autoreconf -fi
>  rm -Rf autom4te.cache
> -- 
> 2.48.1
> 
>