[gentoo-portage-dev] Environment Whitelisting

[Alec Warner <warnera6@egr.msu.edu>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Was talking with Brian about the build environment and how settings were
to be passed into the build environment.

Essentially three scenarios were presented.

1)  The full environment is passed to the build environment.  This was
generally agreed upon to be bad since there are environmental things
that can cause build problems.

2)  The full environment is parsed via a blacklist to strip out
environment settings that are known to be bad for building packages.
This leads to a clean* build environment.  However, maintaining the
blacklist can be a challenge if it grows in size.

(*) clean, meaining all the bad things we know about are not in the
build environment.  This does not account for the bad things we do NOT
know about.

3)  The full environment is parsed via a whitelist to get a list of
environment settings that are known to be good for building packages.
This leads to a clean build environment, as only whitelisted environment
settings are passed in.  However, the whitelist will probably be worse
to maintain than a blacklist.

Both 2) and 3) above have issues where some build variables are bad for
ebuild X but not ebuild Y.  I am unsure how exactly to cover any kind of
situation like that ( and I don't have an example from the tree, save
perhaps LANG=weird-language ).

To me 1) is unacceptable and 3) is the best option.  Feel free to shoot
these down as you see fit ;)

- -Alec Warner (antarus)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iQIVAwUBQwjjSGzglR5RwbyYAQIAeQ//cGJLLF0BKATfaUjAikiKgJ8miHeMBw9p
UMN+xmB3N48Qj8bEC9qhhisSVZGFUVBuucWX5ObKGOG9vQx2Ry/i3NJG0W124s77
f9lLYOcPBOXV6Wo9F4WQ20SZt+0ktoCe2aphC/aVVyiyQhagtqjud50caBcUVfGq
OlpZLLze9LW5SeqRC5N826kZJh63wP/4YOqqRo5DKjIJb/ahFUT0IZqBVWs2OADD
548yRsBsW4G3n8+JxANbGVeFwPACiWc+DFUBU651X36D01+D/M/a5Cp1f+J+Y2IW
AouTkuzxmu8FgiK1+xNN3hOPM+PiqHfcWT7gBa+5Xb+h19mwgJuQAAD7stQNKxZk
GorIA6GubOx+6qQd4nbzdR7bm2/LUhpC2IOQlIwmMwh2RPYnVp7QRILvsFRGPELV
Fb0/enfwD2EzhwJJKkx5LFOdTFA71RP7WICNUJTbntRWp89aspgPg+gB/6gq9s0t
Hf8oRsHR1Xox0NH09oJTTToxakgjdnSrjUAG42ZqDLRvP1x8FmL6BWbYZ9CIXBaJ
r7wxYCwW6pQGcuCAtZCnc9UEIHXTZuy4btxnrfxAwtT10dJub2BrBo4TSZgRQyKu
++N3nxVb0m8qOgRJYsv4hBb0ybJgrDiqCmvfSgSEJAO1+wKPnR8YhEqsOkNBul4Y
sLBvLF9lJl8=
=AXLx
-----END PGP SIGNATURE-----
-- 
gentoo-portage-dev@gentoo.org mailing list