Re: Bug#1021390: nvda2speechd: downloads source from the network during build
Control: severity -1 serious
[ adding debian-wb-team to Cc ]
On Fri, Oct 07, 2022 at 01:55:41PM +0200, Samuel Thibault wrote:
> Control: severity -1 important
>
> Andreas Beckmann, le ven. 07 oct. 2022 13:38:15 +0200, a ecrit:
> > Justification: fails to build from source (but built successfully in the past)
> >
> > During a local rebuild of contrib and non-free (w/o network access
> > permitted), I noticed
>
> It can build the source, just not without the network. That's why it's
> in contrib, not main.
AFAIK accessing the network from the buildds is simply forbidden.
And what your package does is even worse:
It executes a script downloaded from the internet,
compromising the security of the buildds.
Whoever controls sh.rustup.rs could for example provide a special
version of the script for Debian buildds that tries to find and
upload the private keys used on the buildds.
> Samuel
cu
Adrian
Reply to: