> 1a. As a consequence of (1) autogenerated artifacts should always be committed.
Or… just have downstream users run autotools as part of the build?
Or… just have downstream users run autotools as part of the build?
See point 3:
> 3. A corollary of (1) and (2) is that autotools is bad and the autotools culture is bad.
Source distribution tarballs should not contain code different from what's in the source repository. They should not contain automatically generated artifacts, since those should not be in the repository, since they are by definition not the source, but output of some kind of build process.
Having the automatically generated configure script in the repository would have made it slightly easier to spot the backdoor if anyone took the time to read the committed configure script, but if it's already in the repository most people will just take that for granted, not run whatever process generates it, and not notice that it's not actually the output of said process.
The use of autotools or other similar tools, ones that are supposed to generate code on the fly on the final user's machine, make this requirement essentially impossible.
Letting people run autotools would completely avoid this one hack.
But well, you have a point in that most of what makes autotools bad is that you can't expect your userbase to learn how to use it.