Re: [gentoo-portage-dev] Environment Whitelisting

[Alec Warner <warnera6@egr.msu.edu>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Brian Harring wrote:
> On Mon, Aug 22, 2005 at 11:59:54PM +0200, Marius Mauch wrote:
> 
>>On 08/22/05  Brian Harring wrote:
>>
>>
>>>On Mon, Aug 22, 2005 at 11:33:23PM +0200, Marius Mauch wrote:
>>>
>>>>Theoretical discussions about this are pointless IMO without
>>>>numbers/facts to back things up.
>>>
>>>I'd posit theroetical discussions about this are pointless without 
>>>getting ebuild dev's to give a yay/nay on whether they want it or not;
>>>
>>>not much for trying to force it down their throats if they don't want 
>>>it (more work, essentially).
>>
>>That too. But providing them with some numbers will certainly have an
>>effect on their decision (especially if it shows that it doesn't really
>>affect them ;)
> 
> Rather hard to back it up though, without specialized knowledge in 
> (effectively) the whole tree- either we do it, or we ask nicely those 
> who are supposed to have such knowledge :)
> 
> I can rattle off a couple of env vars that screw things up, but how 
> many of us are aware that an exported ARCH screws with kernel builds 
> fex?
> 
> I'd punt it to them, and find out what they think (tiz the route I 
> took when I brought this up last).
> 
> Explicit whitelisting is great for getting closer to deterministic 
> builds, but it's a helluva overhead on a side note.
> ~harring

I'm kinda with genone on implementing both ( since they are similar ).
If it's decided that blacklisting is easier to maintain, I can always
make up my own whitelist for pkg-foo and apply it and if it works submit
it as a bug ( or even some other whitelist database? ) and thus can
gaurentee that my package was built 'correctly'(TM).  I think this would
be important in fex, an enterprise distribution type deal where the
build env is important to some.  Put the whitelists in the tree and have
them --excluded by default, so only the users that use them have to
downlaod them.

Regardless I'd like to see what actual people who write and manage
ebuilds think, I've only written a few and I don't have much experience
in that area.  ( Spanky, solar, etc... the crazy ones ) :)

- -Alec Warner (antarus)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iQIVAwUBQwpTUmzglR5RwbyYAQKPOA/+PbhtDYbbasHP9ZDa2SwTN+YVQRfXEfBt
QwqjmtmdSyGSsLJL7C5PtASL/lLUK0z6uI2LmCniHctvIzvHd7/dAZO8deq4Hqcb
18CgXZucwqvGnLhPIC23Z7CTXb3dUf60WTbwjkP4vTmywRtWr3eOqGIZ03pgjrBr
GDtb+onEGn8lSMxdqRuUxCvFnyz+QIaX2ysOahH/qKRIcJXh4w/zFQrDy+9olSpy
CAkaZLrOplRKZSSkz5i/W1dpKioa7fa3FXD43a7uWXzoRsLNxivyhNqtJJ34rnPI
UexjElpelGlnw4zdDGzq5waYDpwUPfme8vz4pHEZ0MtqGQZ7OCsl3Pnz5q44Z7Vd
cwN5+limQGN0dg55kYgbx+pOm0TRi5u9iAHMdlLojxD9e29AeGpRijeaWfm6ZuRk
MEQrBJMFkhm4BaOuZ8+lcmaso1SxsfdQnlEnwXBVnjt2uoqy/G14wGPxye+gb3tL
kUqBhB+DNH8RMO6Sgu+DDTsLT2vx7w7MV7XMQorBD6g4nvIxdl5OR13sI0Yo+gnt
RF6BlM7eShMrx9aYx9Xr97F9XuBH8tIOKzpSqPK+O/cevJVVu6IwSU8VyPW2o0Rr
rKCwS04vrYSwkfpvNgChNHSqhk08NKcBIQD4sLvrMZpp70OyGXgMTvryUxjzgejA
Tb1Woep3gYk=
=Q3sT
-----END PGP SIGNATURE-----
-- 
gentoo-portage-dev@gentoo.org mailing list