[SM-Discuss] mandatory / automatic source verification
Thomas Orgis
thomas-forum at orgis.org
Mon Jun 2 08:43:43 EDT 2008
Hi again...
just a note about our source verification: I just updated the mksh spell which has a special source archive format (cpio.gz) which we don't have a handler for.
The spell creator made a PRE_BUILD that contains the line to unpack the archive... it was missing default_pre_build, and thus missing any source verification!
That rang a little, but loud, bell inside my head: Shouldn't source verification be a mandatory step _before_ PRE_BUILD?
Of course the best solution for this specific problem would be to add cpio.gz unpacking to sorcery, but the general question remains if it should be that easy to (accidentally) circumvent the source authenticity checks.
Again, opinions?
Alrighty then,
Thomas.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: not available
Url : http://lists.ibiblio.org/pipermail/sm-discuss/attachments/20080602/04fce3e5/attachment.bin
More information about the SM-Discuss
mailing list