[pflyly]

#17004

[RipleyTom]

Looking at https://github.com/VHSgunzo/uruntime/ which this uses, it use a fork of dwarfs:
mhx/dwarfs@main...VHSgunzo:dwarfs:main

This fork seems to used a binary(sstrip) packed with UPX to modify the binary(at least I can see UPX marker and the elf is obviously a packed exe). This seems highly suspicious.

[RipleyTom]

Sorry, was I unclear?
You can't put a random binary without provenance into our build process...

[pflyly]

Sorry, was I unclear? You can't put a random binary without provenance into our build process...

Wrong pressed, Sorry. Closing now.

[illusionyy]

I asked them about it but still quite strange that it's compressed and not built from source.

VHSgunzo/uruntime#10 (comment)

This is an exact replica of my reply in the sharun repo:

Hi, sstrip is https://github.com/aunali1/super-strip.git, it is used in varios projects Gunzo maintains, the binary was UPXed and put into the CI directory because fetching it from a secondary repo would be slow.
Here's the place where it is built: https://github.com/VHSgunzo/squashfs-tools-static/blob/a7aab8e141734b2eecf32d4c4d0aee74b533fd30/build.sh#L136C1-L149C3
I shouldn't have wasted my time reverse engineering it with gdb and this .py script; https://github.com/akamai/akamai-security-research/blob/main/UPX/oepfinder.py
Once I realized it was super-strip I just looked at Gunzo's repos looking for that and I found the place where the file is built

[Samueru-sama]

Hi I will leave some needed context.

The uruntime gets used in this AppImage of citron which is how @pflyly found about it.

We've been working for month to get a lot of these changes into dwarfs so that the fork wouldn't be needed anymore, something that happened 19 hours ago

So please consider getting this PR merged, and not only that but also adopt sharun to make the AppImage, since it makes AppImages that are able to work on any linux system, be it ubuntu 14.04, musl systems and even NixOS directly without any FHS wrapper.

[VHSgunzo]

All changes about sstrip have been added to the main repository and releases rebuilt and published. There are no more binaries in the build process on github. For more context: VHSgunzo/sharun#27
https://github.com/VHSgunzo/uruntime/releases/tag/v0.3.4
https://github.com/VHSgunzo/sharun/releases/tag/v0.6.2

[RipleyTom]

Thanks! LGTM now!