Re: installing binary archives as non-root user

2018-01-12 Thread db
On 18 Nov 2017, at 20:38, Ryan Schmidt wrote: > It is preferable to install MacPorts with root (administrator) privileges and > to run it with sudo. This is more secure, because, with those privileges, > MacPorts can drop privileges and use the unprivileged "macports" user while > building. In

Re: trace mode by default

2018-01-12 Thread db
On 8 Jan 2018, at 21:27, Clemens Lang wrote: > Note that some ports (e.g. Go) do not build in trace mode, though. I gave it a try just to see where it would stop or what clues would I get in the logs and it didn't even extract, although from a glimpse into porttrace.tcl the program used (AFAIR)

Re: installing binary archives as non-root user

2018-01-12 Thread Ryan Schmidt
On Jan 12, 2018, at 07:40, db wrote: > On 18 Nov 2017, at 20:38, Ryan Schmidt wrote: >> It is preferable to install MacPorts with root (administrator) privileges >> and to run it with sudo. This is more secure, because, with those >> privileges, MacPorts can drop privileges and use the unprivile

Re: lib dependency confusion

2018-01-12 Thread Ryan Schmidt
On Jan 11, 2018, at 11:31, Vincent Habchi wrote: > Alternatively to what Ryan just mentioned, you can statically link the > executable, which means that you embed all the code the executable and its > dependencies need into the main code. This result in a bigger executable > (more code) but le

Re: lib dependency confusion

2018-01-12 Thread Bill Cole
On 12 Jan 2018, at 8:49 (-0500), Ryan Schmidt wrote: On Jan 11, 2018, at 11:31, Vincent Habchi wrote: Alternatively to what Ryan just mentioned, you can statically link the executable, which means that you embed all the code the executable and its dependencies need into the main code. This re

Re: lib dependency confusion

2018-01-12 Thread Ryan Schmidt
On Jan 12, 2018, at 08:14, Bill Cole wrote: > On 12 Jan 2018, at 8:49 (-0500), Ryan Schmidt wrote: > >> On Jan 11, 2018, at 11:31, Vincent Habchi wrote: >> >>> Alternatively to what Ryan just mentioned, you can statically link the >>> executable, which means that you embed all the code the exe

Re: What's the push to require the latest Perl?

2018-01-12 Thread Daniel J. Luke
On Jan 11, 2018, at 5:28 PM, Dave Horsfall wrote: >> I look forward to seeing your contributions! Maybe you will come up with a >> solution that no one else has thought of yet. :) > > OK, where do I start? I wasn't joking when I offered to help... subscribe to macports-dev and discuss there wh

Re: lib dependency confusion

2018-01-12 Thread Dave Horsfall
On Fri, 12 Jan 2018, Ryan Schmidt wrote: Then I guess I shouldn't bother submitting an as-static-as-possible bash build variant, which is necessary if one wants a safe /bin/{bash,sh} on OS versions Apple didn't update for ShellShock. It's a bit ugly anyway... If you're suggesting that with t

Re: lib dependency confusion

2018-01-12 Thread Daniel J. Luke
On Jan 12, 2018, at 3:27 PM, Dave Horsfall wrote: > Whether Apple wants to admit that its machines can crash and thereby cream > the filesystem is another question... presumably that's what macOS Recovery is for: https://support.apple.com/en-us/HT201314 -- Daniel J. Luke

Re: installing binary archives as non-root user

2018-01-12 Thread db
On 12 Jan 2018, at 14:43, Ryan Schmidt wrote: >> I installed macports as non-root and built coreutils and noticed that it >> does as root. > What do you mean? What specifically did you notice? Non-root macports installed coreutils setting root:wheel for all files of the port. I remember configu

Re: lib dependency confusion

2018-01-12 Thread Bill Cole
On 12 Jan 2018, at 15:37, Daniel J. Luke wrote: On Jan 12, 2018, at 3:27 PM, Dave Horsfall wrote: Whether Apple wants to admit that its machines can crash and thereby cream the filesystem is another question... presumably that's what macOS Recovery is for: https://support.apple.com/en-us/HT

Re: lib dependency confusion

2018-01-12 Thread Daniel J. Luke
On Jan 12, 2018, at 5:22 PM, Bill Cole wrote: > All very well and good for a machine running an OS version that got the > ShellShock update from Apple. people probably shouldn't be running an OS version that hasn't been patched for a 4 year old vulnerability. > One of the use cases for MacPor

Re: lib dependency confusion

2018-01-12 Thread Dave Horsfall
On Fri, 12 Jan 2018, Daniel J. Luke wrote: Whether Apple wants to admit that its machines can crash and thereby cream the filesystem is another question... presumably that's what macOS Recovery is for: https://support.apple.com/en-us/HT201314 That, of course, assumes that everything is work

Re: trace mode by default

2018-01-12 Thread Clemens Lang
Hi, On Fri, Jan 12, 2018 at 02:42:06PM +0100, db wrote: > I gave it a try just to see where it would stop or what clues would I > get in the logs and it didn't even extract, although from a glimpse > into porttrace.tcl the program used (AFAIR) should have been in the > allowed system directories.