Re: openwrt Conclusions from CVE-2024-3094 (libxz disaster)

[Guy Harris <gharris () sonic net>]

On Apr 1, 2024, at 6:53 AM, Michael Richardson <mcr () sandelman ca> wrote:

> I wonder if we should nuke our own make tarball system.

I.e., replace:

        to get {libpcap,tcpdump,tcpslice} version X.Y.Z, download 
{libpcap,tcpdump,tcpslice}-X.Y.Z.tar.{compression-suffix}

with

        to get {libpcap,tcpdump,tcpslice} version X.Y.Z, do

                git clone {repository}

        and then check out Git tag {libpcap,tcpdump,tcpslice}-X.Y.Z?

If so, do we

        1) require people to have autotools installed and run ./autogen.sh

or

        2) generate the configure scripts on some standard platform and check it in

so that they have a configure script?  Or is there some other way to arrange that people can get the configure scripts?
_______________________________________________
tcpdump-workers mailing list -- tcpdump-workers () lists tcpdump org
To unsubscribe send an email to tcpdump-workers-leave () lists tcpdump org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s