Mike Kelly wrote:
Alec Warner wrote:
The fact that Gentoo can continue with the codebase is irrelevant. I
think moreso the fact that a particular Package Manager would be the
'Gentoo Package Manager' means in my mind that Gentoo is responsible for
said Package Manager. If someone were to slip evil code into said Package
Manager and Gentoo released it; that would be bad.
Note that with Portage, Gentoo could pull svn access for any individuals
who commit such code. Gentoo have no gaurantee of that with an externally
managed Manager as Gentoo has no control over the source repositories.
If, by your comment above, Gentoo should maintain it's own branch of said
package manager to insulate itself from issues such as the security issue
defined above; well I think that may be one way to address the problem
presented by Seemant.
Come on, that's a bogus argument. By that logic, we should be
maintaining our own branches of, say, sys-apps/shadow, since we don't
control the upstream CVS repository. I think something that's installed
in the base "system" set would also be perceived as something that
Gentoo is responsible for, since we ship it in our stage tarballs, the
basic building blocks of a Gentoo system.
Except we aren't the authors of sys-apps/shadow. sys-apps/shadow is not
a Gentoo project.
I think there is a difference. Take the issue with the ubuntu installer
that left the root password in a
log in /var. Who was responsible? Ubuntu. Why? Because it's their
installer, their project. We don't
endorse things like sys-apps/shadow; we just happen to use it. If we
say 'Package X is the official manager',
then to me that implies endorsement. A package manager is a solid part
of Gentoo. Source based package
management is a huge part of what separates us from all other
distributions, I think that has some meaning,
if not to you than to many of our users. If there was such a security
problem with the official manager, who is
responsible? Gentoo. Even if it's not really 'our' project. Because
it's our manager. Not any other distros, but ours.
-Alec
--
gentoo-dev@gentoo.org mailing list
