[bug#49898,v5] gnu: Add spectre-meltdown-checker.

Hi Liliana,

> Hi Petr,
>
> Am Samstag, den 18.09.2021, 15:25 +0000 schrieb phodina:
>
> > [...]
>
> > -           (add-after 'unpack 'fix-relative-locations
> >
> >
> > -             (lambda* (#:key outputs #:allow-other-keys)
> >
> >
> > -               (let ((icoreutils (assoc-ref %build-inputs
> >
> >
> >
> > "coreutils"))
> >
> > -                     (igrep (assoc-ref %build-inputs "grep"))
> >
> >
> > -                     (iutil-linux (assoc-ref %build-inputs "util-
> >
> >
> >
> > linux"))
> >
> > -                     (iutil-linux-with-udev
> >
> >
> > -                       (assoc-ref %build-inputs "util-linux-with-
> >
> >
> >
> > udev"))
> >
> > -                     (igawk (assoc-ref %build-inputs "gawk"))
> >
> >
> > -                     (igzip (assoc-ref %build-inputs "gzip"))
> >
> >
> > -                     (iunzip (assoc-ref %build-inputs "unzip"))
> >
> >
> > -                     (ilzop (assoc-ref %build-inputs "lzop"))
> >
> >
> > -                     (iperl (assoc-ref %build-inputs "perl"))
> >
> >
> > -                     (iprocps (assoc-ref %build-inputs "procps"))
> >
> >
> > -                     (isqlite (assoc-ref %build-inputs "sqlite"))
> >
> >
> > -                     (iwget (assoc-ref %build-inputs "wget"))
> >
> >
> > -                     (iwhich (assoc-ref %build-inputs "which"))
> >
> >
> > -                     (ixz (assoc-ref %build-inputs "xz"))
> >
> >
> > -                     (izstd (assoc-ref %build-inputs "zstd")))
> >
> >
>
> I don't think Hungarian notation is very helpful here.
>
> > -                 (substitute* "spectre-meltdown-checker.sh"
> >
> >
> > -                  ; TODO: Find regexp what will work
> >
> >
> > -                  ;(("echo") (string-append icoreutils "/bin/echo"))
> >
> >
> > -                  ;(("printf") (string-append icoreutils
> >
> >
> >
> > "/bin/printf"))
>
> There are multiple ways of handling this, but I thing the best one
>
> would be to substitute both `command -v printf' and` which echo' with
>
> the path to false, then match the line
>
> [ -z "$echo_cmd" ] && echo_cmd='echo'
>
> and instead put there
>
> echo_cmd_type='printf'
>
> echo_cmd=(path-to "/bin/printf")
>
> > -                   (("dirname") (string-append icoreutils
> >
> >
> >
> > "/bin/dirname"))
> >
> > -                   (("cat") (string-append icoreutils "/bin/cat"))
> >
> >
> > -                   (("grep[ ]+") (string-append igrep "/bin/grep "))
> >
> >
> > -                   (("cut") (string-append icoreutils "/bin/cut"))
> >
> >
> > -                   (("mktemp") (string-append icoreutils
> >
> >
> >
> > "/bin/mktemp"))
> >
> > -                   (("stat[ ]+") (string-append icoreutils "/bin/stat
> >
> >
> >
> > " ))
> >
> > -                   (("tail[ ]+") (string-append icoreutils "/bin/tail
> >
> >
> >
> > " ))
> >
> > -                   (("head[ ]+") (string-append icoreutils "/bin/head
> >
> >
> >
> > " ))
> >
> > -                   (("mount[ ]+")  "/run/setuid-programs/mount ")
> >
> >
> > -                   (("modprobe") (string-append iutil-linux
> >
> >
> >
> > "/bin/modprobe"))
> >
> > -                   (("dd") (string-append icoreutils "/bin/dd"))
> >
> >
> > -                   (("dmesg[ ]+") (string-append iutil-linux-with-udev
> >
> >
> >
> > "/bin/dmesg "))
> >
> > -                   (("awk") (string-append igawk "/bin/awk"))
> >
> >
> > -                   (("gzip") (string-append igzip "/bin/gzip"))
> >
> >
> > -                   (("unzip") (string-append iunzip "/bin/unzip"))
> >
> >
> > -                   (("lzop") (string-append ilzop "/bin/lzop"))
> >
> >
> > -                   (("perl") (string-append iperl "/bin/perl"))
> >
> >
> > -                   (("ps[ ]+") (string-append iprocps "/bin/ps "))
> >
> >
> > -                   (("sqlite3") (string-append isqlite
> >
> >
> >
> > "/bin/sqlite3"))
> >
> > -                   (("wget") (string-append iwget "/bin/wget"))
> >
> >
> > -                   (("which") (string-append iwhich "/bin/which"))
> >
> >
> > -                   (("xz") (string-append ixz "/bin/xz"))
> >
> >
> > -                   (("zstd") (string-append izstd "/bin/zstd")))))))))
> >
> >
>
> Group those that need spaces and those that don't together, with an
>
> explanation as to why those two groups exist.
>
> > -   (inputs `(("binutils" ,binutils)
> > -                ("coreutils",coreutils)
> >
> >
> > -                ("gawk" ,gawk)
> >
> >
> > -                ("grep" ,grep)
> >
> >
> > -                ("gzip" ,gzip)
> >
> >
> > -                ("unzip" ,unzip)
> >
> >
> > -                ("lzop" ,lzop)
> >
> >
> > -                ("perl" ,perl)
> >
> >
> > -                ("procps" ,procps)
> >
> >
> > -                ("sqlite" ,sqlite)
> >
> >
> > -                ("util-linux" ,util-linux)
> >
> >
> > -                ("util-linux-with-udev" ,util-linux+udev)
> >
> >
>
> Why both?
>
> > -                ("wget" ,wget)
> >
> >
> > -                ("which" ,which)
> >
> >
> > -                ("xz" ,xz)
> >
> >
> > -                ("zstd" ,zstd)))
> >
> >
> > -   (synopsis "Spectre, Meltdown ... vulnerability/mitigation
> >
> >     checker")
> > -   (description "A shell script to assess your system's resilience
> >
> >     against
> >
> >     +the several transient execution CVEs that were published since early
> >
> >     2018,
> >
> >     +and give you guidance as to how to mitigate them.")
> > -   (home-page "https://github.com/speed47/spectre-meltdown-checker"
> >
> >     )
> > -   (license license:gpl3)))
> >
> > (define-public snapscreenshot
> >
> > (package
> >
> > (name "snapscreenshot")
> > ----------------------------------------------------------------
> >
> > 2.32.0

I've used the wrap-program as an alternative to the your suggested solution.

Going through the program there is a function update_fwdb [1] that downloads and updates database files when the script is executed with the --update-fwdb argument.

I've added both files [2][3] in question to the lists of inputs.

However, since they are supposed to be updated at runtime (stored in $HOME) I don't know to represent this in the package definition.

Could you please suggest how to proceed?

----
Petr

[1] https://github.com/speed47/spectre-meltdown-checker/blob/master/spectre-meltdown-checker.sh#L838
[2] https://github.com/platomav/MCExtractor/raw/master/MCE.db
[3] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/archive/main.zip

Hi Petr,

sorry for the very late reply.  Are you still interested in adding
spectre-meltdown-checker?  If so, there's a new version out.  Also...

Am Dienstag, dem 07.12.2021 um 22:04 +0000 schrieb phodina:
> I've used the wrap-program as an alternative to the your suggested
> solution.
That does work, but remains quite inelegant.

> Going through the program there is a function update_fwdb [1] that
> downloads and updates database files when the script is executed with
> the --update-fwdb argument.
> 
> I've added both files [2][3] in question to the lists of inputs.
> 
> However, since they are supposed to be updated at runtime (stored in
> $HOME) I don't know to represent this in the package definition.
> 
> Could you please suggest how to proceed?
I'd suggest removing that functionality as well as the associated
inputs (i.e. curl etc., not the databases).  Even if it's treated as
"just data", users should be able to specify on their own the data to
check against.  Perhaps you could suggest to upstream that adding --
fwdb /path/to/fwdb might be useful?

Since this patch is rather old, there are a few style-related changes
that should also be incorporated:


> +    (arguments
> +     `(...))
Use a list of G-Expressions.

> +                   (paths (map
> +                           (lambda (input)
> +                             (string-append (assoc-ref inputs input)
> "/bin"))
> +                           '("coreutils" "grep" "util-linux"
> "iucode-tool"
> +                             "util-linux-with-udev" "gawk" "gzip"
> "lzop"
> +                             "lzop" "perl" "procps" "sqlite" "wget"
> "which" "xz" "zstd"))))
You can use (search-input-file inputs "/bin/CMD") to search CMD from
inputs.
> +    (inputs `(("binutils" ,binutils)
> +              ("coreutils",coreutils)
> +              [...])
You can drop the input labels, but you'll have to find another way to
pass the firmware databases.  Speaking of which, is anything even done
with those?  Could we add (a) separate package(s) with those databases
instead?

Cheers

Hi,

Yes I'm still interested in upstreaming this package. True, in the meantime a lot has happened and I'll prepare a patch with simplified inputs and Gexps.

Also the databases will be in separate packages and just put into the inputs and linked correctly.

And I'll also update the package version.

Unfortunately HW issues will remain with us for long and it's useful to have some way to check for them.

FIY I'm currently also in process of packaging other stuff so it might take some time.

----
Petr