Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] mandatory / automatic source verification

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Andraž 'ruskie' Levstik" <ruskie AT codemages.net>
  • To: <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] mandatory / automatic source verification
  • Date: Mon, 02 Jun 2008 15:39:12 +0200

On 14:43:43 2008-06-02 Thomas Orgis <thomas-forum AT orgis.org> wrote:
> Hi again...
>
> just a note about our source verification: I just updated the mksh
> spell which has a special source archive format (cpio.gz) which we
> don't have a handler for. The spell creator made a PRE_BUILD that
> contains the line to unpack the archive... it was missing
> default_pre_build, and thus missing any source verification! That rang
> a little, but loud, bell inside my head: Shouldn't source verification
> be a mandatory step _before_ PRE_BUILD?
>
> Of course the best solution for this specific problem would be to add
> cpio.gz unpacking to sorcery, but the general question remains if it
> should be that easy to (accidentally) circumvent the source
> authenticity checks.
>
> Again, opinions?
>

He should have called verify_source (same params as unpack_source)

--
Andraž "ruskie" Levstik
Source Mage GNU/Linux Games grimoire guru
Geek/Hacker/Tinker

Be sure brain is in gear before engaging mouth.
Ryle hira.

Key id = F4C1F89C
Key fingerprint = 6FF2 8F20 4C9D DB36 B5B6 F134 884D 72CC F4C1 F89C





Archive powered by MHonArc 2.6.24.

Top of Page