On Fri, 1 Mar 2013 03:26:09 -0500 (EST)
Bohuslav Kabrda <bkabrda(a)redhat.com> wrote:
Hi all,
the previous mail [1] from Tomas Radej made me wondering, whether we
should allow adding arbitrary repos to copr. Most importantly, anyone
can build package A that is totally ok in copr, but make it depend on
"evil" package B from an outside repo. So when a user would try to
install all the dependencies of package A, that would also require
installing package B (and user might just trust that B is ok, add the
outside repo and go on). So from my point of view, we can't add third
party repos to generated .repo files, that's for sure. But that
brings a question whether it even makes sense to add these to copr
repos. Because they would only be good for building packages, but
users would never be able to reach them. So here is my proposal:
- For now, keep the posibility of adding arbitrary repos to copr, but
never make them available through .repo files.
- Consider dropping these ^^ completely (I'm not sure about this
point, I'd like to hear some opinions).
- A very nice functionality would be to only add other coprs to
repos. This way, we could make sure that anything user tries to
install will have dependencies met and also we will have them under
control. Also, that would allow us to generate RPMs with .repo files
that would depend on other (e.g. copr X depends on copr Y, generated
RPM for X depends on RPM for Y, Yum can download that somehow).
Thoughts? And I still hope that this would actually not destroy any
of Tomas's work :)
okay - the whole point of coprs is to allow you to build pkgs including
build requirements from an arbitrary set of repositories. From ANYWHERE
NO MATTER WHAT. If that functionality is not allowed in coprs - then
there is no point in coprs. B/c that functionality is ENTIRELY provided
by scratch and chain builds in koji.
The reason why we're building on brand new cloud instances and then
immediately destroying the instances is b/c we CANNOT trust or know
where the buildrequirements are coming from. We have to assume that the
system could have been compromised by a %post script in a buildreq
running as root on the builder.
This is identical to how PPAs work, afaik. The user is taking a risk -
that's just how it is.
We are not offering pristine builds, nor are we offering any guarantee
that the set of pkgs that these pkgs were built from are not trojanned
or compromised. The whole point is that people want to be able to build
arbitrary stuff and the majority of people are trustworthy and not out
to get anyone.
Which, for the record, is the case.
-sv