From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org) by nuthatch.gentoo.org with esmtp (Exim 4.43) id 1E7Kf4-0002c9-Ft for garchives@archives.gentoo.org; Mon, 22 Aug 2005 22:20:58 +0000 Received: from robin.gentoo.org (localhost [127.0.0.1]) by robin.gentoo.org (8.13.4/8.13.4) with SMTP id j7MMJcp5022015; Mon, 22 Aug 2005 22:19:38 GMT Received: from smtp.gentoo.org (smtp.gentoo.org [134.68.220.30]) by robin.gentoo.org (8.13.4/8.13.4) with ESMTP id j7MMJbBN011269 for ; Mon, 22 Aug 2005 22:19:37 GMT Received: from cpe-65-26-255-237.wi.res.rr.com ([65.26.255.237] helo=nightcrawler) by smtp.gentoo.org with esmtpa (Exim 4.43) id 1E7KeV-0001Oy-8j for gentoo-portage-dev@lists.gentoo.org; Mon, 22 Aug 2005 22:20:23 +0000 Date: Mon, 22 Aug 2005 17:19:15 -0500 From: Brian Harring To: gentoo-portage-dev@lists.gentoo.org Subject: Re: [gentoo-portage-dev] Environment Whitelisting Message-ID: <20050822221915.GV10816@nightcrawler> References: <4308E349.8010107@egr.msu.edu> <20050822233323.276ad887@andy.genone.homeip.net> <20050822214059.GU10816@nightcrawler> <20050822235954.4aece5d1@andy.genone.homeip.net> Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-portage-dev@gentoo.org Reply-to: gentoo-portage-dev@lists.gentoo.org Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="J/zg8ciPNcraoWb6" Content-Disposition: inline In-Reply-To: <20050822235954.4aece5d1@andy.genone.homeip.net> User-Agent: Mutt/1.5.8i X-Archives-Salt: 1e0f4172-2e4e-4e0e-b2ab-9cad77b26730 X-Archives-Hash: 22db09d11cc227a9c401a274166b1502 --J/zg8ciPNcraoWb6 Content-Type: text/plain; charset=utf8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Aug 22, 2005 at 11:59:54PM +0200, Marius Mauch wrote: > On 08/22/05 Brian Harring wrote: >=20 > > On Mon, Aug 22, 2005 at 11:33:23PM +0200, Marius Mauch wrote: > > > Theoretical discussions about this are pointless IMO without > > > numbers/facts to back things up. > > I'd posit theroetical discussions about this are pointless without=20 > > getting ebuild dev's to give a yay/nay on whether they want it or not; > >=20 > > not much for trying to force it down their throats if they don't want= =20 > > it (more work, essentially). >=20 > That too. But providing them with some numbers will certainly have an > effect on their decision (especially if it shows that it doesn't really > affect them ;) Rather hard to back it up though, without specialized knowledge in=20 (effectively) the whole tree- either we do it, or we ask nicely those=20 who are supposed to have such knowledge :) I can rattle off a couple of env vars that screw things up, but how=20 many of us are aware that an exported ARCH screws with kernel builds=20 fex? I'd punt it to them, and find out what they think (tiz the route I=20 took when I brought this up last). Explicit whitelisting is great for getting closer to deterministic=20 builds, but it's a helluva overhead on a side note. ~harring --J/zg8ciPNcraoWb6 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFDCk9ivdBxRoA3VU0RAk2GAKDU/ydo+sAADMU2wWIpiMnAIQr7kgCg10+B k5YbfgXdmv8DD+UjpEZTAnI= =yQCI -----END PGP SIGNATURE----- --J/zg8ciPNcraoWb6-- -- gentoo-portage-dev@gentoo.org mailing list