[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Downloading sources from an unsigned intranet repository



On Lu, 06 oct 14, 21:13:17, Stuart Longland wrote:
> 
> The beef I have, is this not what happens if you do an `apt-get
> download` or an `apt-get source`: in both those latter cases, it never
> asks the question, it just flatly refuses to give you the sources.
> 
> Now, merely obtaining the binary package or sources, is surely much less
> dangerous than actually *installing* the package?  One just dumps the
> files in your local directory (a convenience around doing a `wget`
> myself), the other unpacks them and places files in my root.
> 
> Is it just me, or is something backward here?

No, it makes sense and you should probably file a bug about it. If the 
fix is not too intrusive it might make it in stable as a regression fix 
for whichever security fix broke this use case.

As a work-around see if --print-uris helps.

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser
Offtopic discussions among Debian users and developers:
http://lists.alioth.debian.org/mailman/listinfo/d-community-offtopic
http://nuvreauspam.ro/gpg-transition.txt

Attachment: signature.asc
Description: Digital signature


Reply to: