On Fri, 19 Sep 2014, Jakub Wilk wrote: > This package's debian/rules sets HOME set to /tmp in debian/rules. But > HOME is supposed to be writable only by trusted users, whereas /tmp is > world-writable. > > For example, python2.7 (which debian/rules indirectly runs) loads code from > $HOME/.local/lib/python2.7/site-packages/.
Heh. Yeah... I should know better than to have done that. Fixed in git, and I'll upload a fixed version soonish. Hopefully fontconfig has stopped writing to home... but if it hasn't, I'll figure out a better way to work around that. -- Don Armstrong http://www.donarmstrong.com "What, now?" "Soon equates to good, later to worse, Uagen Zlepe, scholar. Therefore, immediacy." -- Iain M. Banks _Look to Windward_ p 213 -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
