[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [RFR] templates://publicfile-installer/{templates}

Quoting Justin B Rye (justin.byam.rye@gmail.com):

> But why does it need a special script to install a package?  (Goes and
> looks...)  Yipe!  It just checks I'm root and then runs
>   dpkg -i /tmp/publicfile-installer/publicfile*_*.deb
> Does the build really leave its output in a predictable location in a
> world-writable directory?  (Checks)  Yes, so if my evil kid brother
> has created a /tmp/publicfile-installer/publicfile_0.52-0_amd64.deb,
> the build-script will happily dump its .deb alongside it.  Then when I
> run "sudo install-publicfile" it'll install the bogus package first,
> executing its install-scripts as root.

That seems correct and probably deserves another bug report, in my
opinion. Thanks for pointing this, Justin...

Attachment: signature.asc
Description: Digital signature

Reply to: