I've just pushed this to coreutils.
I propose to move the rule to gnulib's maint.mk.
Why? Just noticed that Fedora 11 is still using a vulnerable
version of automake-1.11, and that some projects don't require
automake-1.11.1.
Any objections or suggestions?
>From 1b361e21d08b2e7252f137b40419ffa0a675a91c Mon Sep 17 00:00:00 2001
From: Jim Meyering <meyer...@redhat.com>
Date: Wed, 27 Jan 2010 22:36:27 +0100
Subject: [PATCH] maint: add a syntax-check rule to check for vulnerable
Makefile.in
* cfg.mk (sc_vulnerable_makefile_CVE-2009-4029): New rule.
---
cfg.mk | 13 +++++++++++++
1 files changed, 13 insertions(+), 0 deletions(-)
diff --git a/cfg.mk b/cfg.mk
index b5a21c3..6fc10ee 100644
--- a/cfg.mk
+++ b/cfg.mk
@@ -246,6 +246,19 @@ sc_prohibit_sleep:
msg='prefer xnanosleep over other sleep interfaces' \
$(_prohibit_regexp)
+sc_vulnerable_makefile_CVE-2009-4029:
+ @files=$$(find $(srcdir) -name Makefile.in); \
+ if test -n "$$files"; then \
+ grep -E \
+ 'perm -777 -exec chmod a\+rwx|chmod 777 \$$\(distdir\)' \
+ $$files && \
+ { echo '$(ME): the above files are vulnerable; beware of' \
+ 'running "make dist*" rules, and upgrade to fixed automake' \
+ 'see http://bugzilla.redhat.com/542609 for details' \
+ 1>&2; exit 1; } || :; \
+ else :; \
+ fi
+
include $(srcdir)/dist-check.mk
update-copyright-env = \
--
1.7.0.rc0.158.g8f946
