On 2/10/06, Kevin Horton <[EMAIL PROTECTED]> wrote: > On 10 Feb 2006, at 07:35, Chris Zubrzycki wrote: > > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > > > On Feb 10, 2006, at 6:27 AM, Kevin Horton wrote: > > > >> On 9 Feb 2006, at 21:53, William Scott wrote: > >> > >>> I wonder if it might be worthwhile to have some sort of informal > >>> web ring of people who serve their fink along these lines: > >>> http://fink.sourceforge.net/doc/advanced/bindist.php?phpLang=en > >>> > >>> I make mine available to my user community, but as long as the > >>> user accepts it (and the associated risks) as-is, and doesn't > >>> overwhelm my server, I'd be willing to do that. > >> > >> I'd be willing to contribute any .debs I have. It would also be > >> useful to have a daily script that could check to see which of my > >> debs needed copying to the server. > >> > >> Bandwidth might become a concern though, as something like this > >> could become quite popular. > > > > Popular? yes. Easy? kinda. Secure? no. The reason we haven't done > > this yet is because of the ease of making a package that contains > > malicious code. It's nothing to make a bunch of debs that contain > > trojans that would damage your machine, or give me complete control > > of it. I don't recommend doing this unless you know and trust the > > person very much. > > I agree that such a deb distribution system should not be allowed to > accept debs from just anyone. But, it should be possible to come up > with a short list of people that could contribute debs. > > Anyone with cvs access should be eligible to contribute debs. Long- > time package maintainers without cvs access should be eligible to > contribute debs. We wouldn't really need too many people. The most > popular packages would probably be installed on many possible > contributor's machines. We don't need to provide a deb for every > possible package. > > This doesn't need to be an official fink server, if the project is > afraid of the liability. For liability reasons, it would probably be > best if the server was not based in the US. > > Kevin Horton > Ottawa, Canada > >
Why? It's not "liability" that's the problem, It's "I've installed foo and it doesn't work". After several iterations on the mailing lists, we'll finally find out that the person having problems installed foo-1.2.3-binary-darwin-powerpc.deb from Joe Schmo, rather than from Joe Bloe, or Jane Doe, or... This facetious example illustrates a point. While the security issue is indeed important, quality control is also a major thing to worry about. Let me provide a few examples to think about. 1) Linkage from outside. Fink package builds aren't necessarily bulltetproof. It's entirely possible for a package to link libraries from /usr/local/lib. In such a case the .debs will be broken for any system that doesn't happen to have that library in /usr/local/lib. 2) Missing dependencies. This is related to the problem with X11 versions. If a package happens to link a shared library that's not in the dependency list, the package will be broken at runtime for somebody who has an earlier version (or, indeed, doesn't have at all) the package that provides this library. 3) Other issues. This is more important if people had a list of deb sources in their sources.list file rather than a central repo. In such a case somebody could forget and change something on their box that breaks binaries for everbody else. An example of my own; I build packages on my desktop machine at work and have it set up to serve .deb files--mainly so that I don't have to build stuff again for my laptop. As I've said, I use xorg, so other people on average wouldn't be able to use it. At one point before Tiger came out, I 'd given the URI out so that somebody who had xorg installed and was having problems building KDE could save some time and use my .debs. Fair enough. A few months passed and I'd forgotten about that. I interact with a lot of people on the lists and on IRC. Tiger came out and I upgraded. My APT server was just set up to point at "dists" so my repo changed from pointing to 10.3 .debs to pointing to those that I built on 10.4. This didn't matter to me, because I upgraded both my computers nearly simultaneously. However, unbeknownst to me, the aforementioned person still had my repo in their sources.list but was still on Panther. They wound up with a whole lot of broken packages. Just some more things to think about. -- Alexander K. Hansen Fink Documenter [Day Job] Levitated Dipole Experiment http://psfcwww2.psfc.mit.edu/ldx/ ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://sel.as-us.falkag.net/sel?cmd=lnk&kid3432&bid#0486&dat1642 _______________________________________________ Fink-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/fink-users
