[SM-Discuss] mandatory / automatic source verification
"Andraž 'ruskie' Levstik"
ruskie at codemages.net
Mon Jun 2 09:39:12 EDT 2008
On 14:43:43 2008-06-02 Thomas Orgis <thomas-forum at orgis.org> wrote:
> Hi again...
>
> just a note about our source verification: I just updated the mksh
> spell which has a special source archive format (cpio.gz) which we
> don't have a handler for. The spell creator made a PRE_BUILD that
> contains the line to unpack the archive... it was missing
> default_pre_build, and thus missing any source verification! That rang
> a little, but loud, bell inside my head: Shouldn't source verification
> be a mandatory step _before_ PRE_BUILD?
>
> Of course the best solution for this specific problem would be to add
> cpio.gz unpacking to sorcery, but the general question remains if it
> should be that easy to (accidentally) circumvent the source
> authenticity checks.
>
> Again, opinions?
>
He should have called verify_source (same params as unpack_source)
--
Andraž "ruskie" Levstik
Source Mage GNU/Linux Games grimoire guru
Geek/Hacker/Tinker
Be sure brain is in gear before engaging mouth.
Ryle hira.
Key id = F4C1F89C
Key fingerprint = 6FF2 8F20 4C9D DB36 B5B6 F134 884D 72CC F4C1 F89C
More information about the SM-Discuss
mailing list