Guido Berhoerster wrote: > * Shawn Walker <[EMAIL PROTECTED]> [2008-11-18 22:41]: >> Specifically, I sincerely doubt that every single contributed package is >> going to have every single line of source code checked to verify that >> something malicious wasn't introduced. > > That might not be the case, but there is at least the possibility > to check it. And that is also an additional deterrent for > submitters not to include sloppy patches or outright malicious > content.
Which, as I mentioned before, is already covered under the proposal. >> I agree that it can reduce the risk, but it does not eliminate it. > > We can agree on that. To bring back your Debian example, in > Debian it took two years to discover the OpenSSL debalce, with > the current proposed procedure for the /contrib repo such a case > might never be discoverd if someone submits a binary OpenSSL > package. I don't see how. They're still submitting the source that they claimed to use. > Now why realize this benefit and reduce this risk by make it a > requirement that packages of opensource software must be > submitted with build instructions or a build recipe and would the > be rebuilt before being moved from /pending into /contrib? Once an automate infrastructure is in place, and where applicable, that seems only logical. > Non-OSS could still be submitted in binary form. What speaks > against that, why is there so much opposition against that? > Because of one time costs of setting up the infrastructure? > Because it might deter potential contributors? This is not clear > to me, it's not a new idea, but standard procedure for all major > Linux distros and the BSDs. Sorry, but I'm not impressed by most GNU/Linux and BSD distributions. Their standard procedures still result in a ton of undesirable or poorly packaged software. Cheers, -- Shawn Walker _______________________________________________ indiana-discuss mailing list [email protected] http://mail.opensolaris.org/mailman/listinfo/indiana-discuss
