--- Begin Message ---
|
Subject: |
[PATCH] doc: Call out potential for downgrade attacks with time-machine. |
|
Date: |
Sat, 19 Nov 2022 13:09:31 +0100 |
|
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux) |
* doc/guix.texi (Invoking guix time-machine): Add a note.
---
doc/guix.texi | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/doc/guix.texi b/doc/guix.texi
index eaecfd0daa..c29db13be6 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -60,7 +60,7 @@
Copyright @copyright{} 2018 Mike Gerwitz@*
Copyright @copyright{} 2018 Pierre-Antoine Rouby@*
Copyright @copyright{} 2018, 2019 Gábor Boskovits@*
-Copyright @copyright{} 2018, 2019, 2020 Florian Pelz@*
+Copyright @copyright{} 2018, 2019, 2020, 2022 Florian Pelz@*
Copyright @copyright{} 2018 Laura Lazzati@*
Copyright @copyright{} 2018 Alex Vong@*
Copyright @copyright{} 2019 Josh Holland@*
@@ -4834,6 +4834,13 @@ Invoking guix time-machine
large number of packages; the result is cached though and subsequent
commands targeting the same commit are almost instantaneous.
+@quotation Note
+Naturally, no security fixes can be provided for old versions of Guix
+or its channels. This also means that careless use of @command{guix
+time-machine} opens the door to downgrade attacks.
+@xref{Invoking guix pull, @option{--allow-downgrades}}.
+@end quotation
+
The general syntax is:
@example
base-commit: 7502af793172714b2b322c21ba2379c698108ef2
--
2.38.0
--- End Message ---
--- Begin Message ---
|
Subject: |
Re: bug#59383: [PATCH] doc: Call out potential for downgrade attacks with time-machine. |
|
Date: |
Tue, 22 Nov 2022 15:47:09 +0100 |
|
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux) |
zimoun’s wording is good; less alarmist. I used his words (with a
period before @xref, no french spacing and a less alarmist commit
message and Co-authored by line). Pushed as
b8d4c323f5d089dd800b358143d5bae26c965404. Closing.
Regards,
Florian
--- End Message ---