MIME-Version: 1.0
References: <1c614505-92f2-42b4-ba46-b227777e0d5b@lodispoto.com> <CAH8yC8=R7=9LvfJ55P230n-eSgZaje37q63KMGa9XRDzgeNr2g@mail.gmail.com>
In-Reply-To: <CAH8yC8=R7=9LvfJ55P230n-eSgZaje37q63KMGa9XRDzgeNr2g@mail.gmail.com>
Reply-To: noloader@gmail.com
From: Jeffrey Walton <noloader@gmail.com>
Date: Sun, 31 Mar 2024 20:08:41 -0400
Message-ID: <CAH8yC8kXk8R+bjV_fhh65hbad_-c-H7MEU2D2ci+TLSYFsnf7g@mail.gmail.com>
Subject: Re: XZ force downgrade led to removal of many packages
To: Mike Lodispoto <mike@lodispoto.com>
Cc: ~alpine/users@lists.alpinelinux.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sun, Mar 31, 2024 at 8:08=E2=80=AFPM Jeffrey Walton <noloader@gmail.com>=
 wrote:
>
> On Sat, Mar 30, 2024 at 1:18=E2=80=AFAM Mike Lodispoto <mike@lodispoto.co=
m> wrote:
> >
> > I was attempting to downgrade XZ because of the SSH backdoor in it.
> >
> > I'm not the most familiar with Alpine, so this might have been user ine=
xperience that screwed me, but I did
> >
> >  apk add xz-libs=3D5.4.6 --force
> >
> > I had tried it without force before, but it had said something along th=
e lines of xz-libs is required by world.
> >
> > This ended up with a bunch of essential packages removed.
> >
> > certbot-nginx-pyc certbot-nginx certbot-pyc certbot py3-configargparse-=
pyc py3-configargparse py3-distro-pyc py3-distro py3-distutils-extra-pyc py=
3-distutils-extra py3-parsedatetime-pyc py3
> > -parsedatetime py3-future-pyc py3-future py3-acme-pyc py3-acme py3-jose=
py-pyc py3-josepy py3-pyrfc3339-pyc py3-pyrfc3339 py3-tz-pyc py3-tz py3-ope=
nssl-pyc py3-openssl py3-cryptography-pyc p
> > y3-cryptography py3-cffi-pyc py3-cffi py3-cparser-pyc py3-cparser cloud=
-init-openrc cloud-init-doc cloud-init-pyc cloud-init cloud-utils-growpart =
partx sfdisk py3-configobj-pyc py3-configob
> > j py3-six-pyc py3-six py3-jinja2-doc py3-jinja2-pyc py3-jinja2 py3-mark=
upsafe-pyc py3-markupsafe py3-jsonpatch-pyc py3-jsonpatch py3-jsonpointer-p=
yc py3-jsonpointer py3-jsonschema-pyc py3-j
> > sonschema py3-jsonschema-specifications-pyc py3-jsonschema-specificatio=
ns py3-referencing-pyc py3-referencing py3-attrs-pyc py3-attrs py3-rpds-py-=
pyc py3-rpds-py py3-requests-pyc py3-reques
> > ts py3-certifi-pyc py3-certifi py3-charset-normalizer-pyc py3-charset-n=
ormalizer py3-idna-pyc py3-idna py3-urllib3-pyc py3-urllib3 py3-yaml-pyc py=
3-yaml shadow-doc shadow tzdata-doc tzdata
> > eudev-doc eudev-openrc eudev udev-init-scripts-openrc udev-init-scripts=
 eudev-libs gdbm-doc grub-bios grub-doc grub ifupdown-ng-iproute2 iproute2-=
minimal iotop-pyc iotop-doc iotop json-c-do
> > c kmod-doc libelf libfdisk libsmartcols libxml2-doc libzip-doc linux-pa=
m-doc linux-virt mariadb-doc mariadb-openrc mkinitfs-doc mkinitfs kmod lddt=
ree mpdecimal-doc mysql mariadb php7-cgi ph
> > p7-fpm php7-simplexml php7-soap php7-xmlreader php7-dom php7-xmlrpc php=
7-xml php7-zip php81-doc php81 php81-common py3-packaging-pyc py3-parsing-p=
yc py3-pip-pyc py3-pip-doc py3-pip py3-setu
> > ptools-pyc py3-setuptools py3-packaging py3-parsing python3-doc python3=
-pyc python3-pycache-pyc0 pyc yaml python3 kmod-libs libzip libxml2 xz-libs=
 cryptsetup-libs argon2-libs gdbm json-c li
> > bpanelw linux-pam mpdecimal
> >
> > In my mind, force would have had it told me what packages were going to=
 be changed before applying them, so I could approve it like normal.
> >
> > Am I just completely screwed? I can do a clean install if needed, but I=
'd like to salvage my system.

Whoops, sorry about the empty reply. Here's an important comment from
oss-security mailing list message,
<https://www.openwall.com/lists/oss-security/2024/03/31/4>:

commit f9cf4c05edd14dedfe63833f8ccbe41b55823b00 (HEAD -> master,
origin/master, origin/HEAD)
Author: Lasse Collin <lasse.collin@...aani.org>
Date:   Sat Mar 30 14:36:28 2024 +0200

    CMake: Fix sabotaged Landlock sandbox check.

    It never enabled it.