Skip to content

Use of autotools as a supply-chain attack risk #46

@kornelski

Description

@kornelski

CVE-2024-3094 has demonstrated that the obscure autotools macro language and the infeasible-to-audit barf of configure are good places for hiding malware.

autotools is not only slow and a barrier to support of non-unix platforms, but also a security liability of executing unreviewed arbitrary code that is able to compromise the entire build.

Please consider dropping autotools. Libevent happens to support cmake which is slightly less terrible in this regard.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions