From: smallm@panix.com   
      
   Rich  writes:   
      
   > tarball.  The obsfucation level itself is nearly to the level of Ken   
   > Thompson's "Reflections on Trusting Trust" [1].  The fact that having   
      
   I didn't fully read and understand the descriptions of the obfuscation,   
   but I found the use of the m4 file, part of autotools infrastructure I   
   guess, quite interesting. I also didn't yet find the stamina to read   
   through a debian devel thread on how they're going to try to improve   
   verifying archives against source repository contents, but it strikes me   
   (and I don't want to put this in too simplistic a way - I don't want to   
   pick on gnu build tooling at all in a "it was the fault of X's ____   
   software" sort of way) that the way a configure script gets built up,   
   and how long it ends up being, leaves a lot of dark corners in which to   
   hide.   
      
   I know if I were code reviewing a change that had some understandable C   
   change in parallel with autoconf build script changes -- the difficulty   
   I have grasping those tools again causing strain to my limited stamina   
   -- well, it would be tempting only to concentrate on the C changes.   
      
   One of the items that's been popping up in multiple threads concerning   
   this story is Antonio Diaz Diaz's lzip software and his paper critical   
   of xz. Bear with me, I'm not intending to go down that road the way you   
   might think either. I didn't really grasp the paper, but when I glanced   
   at his source I noticed, IIRC, he'd written his own configure script. It   
   acted just like a generated autoconf configure script in terms of its   
   user interface and options, but it wasn't autoconf generated. It strikes   
   me that for simpler packages that just barely need something like   
   autoconf but where only a makefile would be insufficient, that this is a   
   fine approach. Just write the thing yourself for the few things you   
   need. That would be so much easier to understand as it changes. For more   
   complex needs, well, use autoconf (or some newer alternative if it's   
   your thing, but I'd rather people used autoconf in that case rather than   
   these re-invented wheels -- if you're tired of new init systems you must   
   be seriously sick of new build systems).   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)