Public SourceMage Discussion List

["Andraž 'ruskie' Levstik" <ruskie AT codemages.net>]

On 14:43:43 2008-06-02 Thomas Orgis <thomas-forum AT orgis.org> wrote:
> Hi again...
> 
> just a note about our source verification: I just updated the mksh
> spell which has a special source archive format (cpio.gz) which we
> don't have a handler for. The spell creator made a PRE_BUILD that
> contains the line to unpack the archive... it was missing
> default_pre_build, and thus missing any source verification! That rang
> a little, but loud, bell inside my head: Shouldn't source verification
> be a mandatory step _before_ PRE_BUILD?
> 
> Of course the best solution for this specific problem would be to add
> cpio.gz unpacking to sorcery, but the general question remains if it
> should be that easy to (accidentally) circumvent the source
> authenticity checks.
> 
> Again, opinions?
> 

He should have called verify_source (same params as unpack_source)

--
Andraž "ruskie" Levstik
Source Mage GNU/Linux Games grimoire guru
Geek/Hacker/Tinker

Be sure brain is in gear before engaging mouth.
Ryle hira.

Key id = F4C1F89C
Key fingerprint = 6FF2 8F20 4C9D DB36 B5B6  F134 884D 72CC F4C1 F89C