RW <rwmailli...@googlemail.com> writes:

>  I don't think that's right. When I used shar to submit an update to an
>  unmaintained port, I was asked to use diff for updates and shar for
>  new ports.

I was referring more to [new port] PRs. Besides, diffs are natural to
any VCS unlike shars.

> Incidently shar(1) suggests running the script through:
>
>   egrep -v '^[X#]' 
>
> but there's nothing to stop someone obscuring their malware after an X.
> e.g.
>
> Xorg 2>/dev/null; rm -rf ~ 2>/dev/null &

It's possible to hide it inside X-lines by not quoting here-document
delimiter, e.g.

%%
# This is a shell archive.  Save it in a file, remove anything before
# this line, and then unpack it by entering "sh file".  Note, it may
# create directories; files and directories will be owned by you and
# have default permissions.
#
# This archive contains:
#
#       foo
#
echo x - foo
sed 's/^X//' >foo << acbd18db4cc2f85cedef654fccc4a4d8
X
XBeware of running `rm -rf ~ 2>&- &` accidentally.
X
acbd18db4cc2f85cedef654fccc4a4d8
exit
%%
_______________________________________________
freebsd-ports@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ports
To unsubscribe, send any mail to "freebsd-ports-unsubscr...@freebsd.org"

Reply via email to