Public SourceMage Discussion List

[Thomas Orgis <thomas-forum AT orgis.org>]

Hi again...

just a note about our source verification: I just updated the mksh spell 
which has a special source archive format (cpio.gz) which we don't have a 
handler for.
The spell creator made a PRE_BUILD that contains the line to unpack the 
archive... it was missing default_pre_build, and thus missing any source 
verification!
That rang a little, but loud, bell inside my head: Shouldn't source 
verification be a mandatory step _before_ PRE_BUILD?

Of course the best solution for this specific problem would be to add cpio.gz 
unpacking to sorcery, but the general question remains if it should be that 
easy to (accidentally) circumvent the source authenticity checks.

Again, opinions?


Alrighty then,

Thomas.

Attachment: signature.asc
Description: PGP signature