12

About a year ago, I made a modified copy of the Tiny C Compiler, which is licensed under LGPL-2.1. Using the techniques described in Ken Thompson's talk and paper titled "Reflections on Trusting Trust", my modified version of TCC ("EvilTCC") deliberately miscompiles the original TCC source code, regenerating my modification and injecting it back in before compiling it. It also miscompiles the GNU nano text editor, replacing the [ Welcome to nano. For basic help, type Ctrl+G. ] text with [ Your nano has been hacked by an evil compiler. ], as a proof-of-concept.

If I were to compile the original TCC with my EvilTCC binary, and distribute the resulting binary, would I be obligated to share the source code for EvilTCC?

Note that this is purely hypothetical, as I have no plans to distribute EvilTCC - it remains in a private GitHub repository and a local repository on my laptop, and I do not want to take any risks, no matter how small, that my work on this gets repurposed for something genuinely nefarious.

2
  • 1
    In future, it's probably best to keep mentions of anything you don't want "repurposed for something genuinely nefarious" strictly hypothetical, with irrelevant details modified, omitted, or exaggerated. (Trusting Trust isn't a secret, pulling it off isn't that hard even from scratch, and such attacks are fairly easy to defend against, so you're probably safe here.)
    – wizzwizz4
    Commented Apr 9 at 20:04
  • @wizzwizz4 if I had discovered an unknown method or attack vector, I would be much more careful about it. I am willing to talk about what I did precisely because it's so well known, and easy enough for me to implement, despite having done very little C programming before or since. Raising more awareness of the problem and ways to defend against it (like Diverse Double Compiling) is, by my assessment, a net neutral to positive. Making a Trusting Trust attack attack easier to pull off is a net neutral to negative. Still, thanks for making sure that I was thinking it through. Commented Apr 10 at 15:14

1 Answer 1

13

Yes.

When distributing the binary of a GPL work, you must share the "Corresponding Source" of the work. "Corresponding Source" is defined in Section 1 of the GPL v3 as

The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work.

While TCC is a generally available free program, you are not using it unmodified so you you cannot take advantage of that exception.

2
  • It looks like there are similar terms in the text of the LGPL 2.1 license. Commented Apr 8 at 19:09
  • I would add this part quoted from the GPL: "The “source code” for a work means the preferred form of the work for making modifications to it. “Object code” means any non-source form of a work."
    – ecm
    Commented Apr 8 at 22:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.