Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.project > #8652

Re: third-party packages adding apt sources

From Bas Wijnen <wijnen@debian.org>
Newsgroups linux.debian.project
Subject Re: third-party packages adding apt sources
Date 2016-05-19 19:50 +0200
Message-ID <rAAf7-2QX-15@gated-at.bofh.it> (permalink)
References <rAxTX-1sm-3@gated-at.bofh.it> <rAzCp-2Bt-13@gated-at.bofh.it> <rAzM5-2EV-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, May 19, 2016 at 07:15:01PM +0200, Daniel Pocock wrote:
> Another thing comes to mind: making sure that even if the user
> explicitly allows some other repository, they are protected from package
> updates that come along and replace other things like apt itself, libc,
> bash, gnupg, ...

I don't think we want to prevent that.  If they want to install a package that
does that, they can.  However, I think it is reasonable to warn them that they
should get ready for trouble when installing a package that isn't from Debian,
and especially if they install a new entry into sources.list from an external
source.

I don't see how to technically do such a thing though; the problem is that
these kind of upstreams often don't care about our (or their user's) systems
and will inject any code in their package that makes the warnings go away.

Thanks,
Bas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJXPfugAAoJEJzRfVgHwHE61mcQAKQzjwht59J73zievxLTlqoz
QNMnmorJJb5vvx1PDwJzfqqL4rqRPu5/h9wiHjYhi+O3YM2J8W4phKxyMNIDYR1R
p+BA1CwSUuGX3/4je1QWaNpHa6IpgU9HxlUtrLNnjhJvtAuRR4PXfv15tPxsGgxi
AT5770XMSuCjNSehpC5nhp2l9HFiaRnaTa8tIENf6Bj1NrXrH/Em2/3CKbZiTkTf
S5C0IHWPTJyIYGqRALub+DiVvYd/d2ZNdFAwRW3/8nyJeBLwEkQ9BO8mNOdBHZWF
Fbvi0WJ5bBo1mcIVc9vO/4QvrFGPqxXYo8Sf+dI2O/NmzKdQ6XXwcy30HL8R/DhD
gZzhOJLnJFmUTpvqUAv1ywt9mfqNE4ed7/9ccN+4nTVHNSbxqJZyEimIi6x7dZop
dYZvdjoDgHRBFG7cBaGGH0Dqb+r0fSkP05Foxxy3ShITMzYQRPDzRPmxRxaU6ojB
Y5+GLQ3wlEMmiNsK34y1pQcJYKI5B7d+LYS1B/K5/Enkv7Z+4n8CX2AHtRMDmpHt
wQYKKaHjOktGZQonE1fF0vb4WE4otoidAyyN0jnlQDlq9aTp4OHDFcx5o8u6ppgG
LmKw7YTosFwzd37kHmH7icwvXiPHwIvHwR+9Vt/0wra/juD9Xktom2TtuA02MwIY
nPAD/aVlO95tD43+9EQP
=54DY
-----END PGP SIGNATURE-----

Back to linux.debian.project | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

third-party packages adding apt sources Daniel Pocock <daniel@pocock.pro> - 2016-05-19 17:20 +0200
  Re: third-party packages adding apt sources Paul Tagliamonte <paultag@debian.org> - 2016-05-19 17:50 +0200
    Re: third-party packages adding apt sources Bas Wijnen <wijnen@debian.org> - 2016-05-19 19:00 +0200
      Re: third-party packages adding apt sources "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-05-19 19:10 +0200
      Re: third-party packages adding apt sources Mike Hommey <mh@glandium.org> - 2016-05-20 00:40 +0200
      Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-20 07:30 +0200
        Re: third-party packages adding apt sources Antonio Terceiro <terceiro@debian.org> - 2016-05-20 14:00 +0200
          Re: third-party packages adding apt sources The Wanderer <wanderer@fastmail.fm> - 2016-05-20 14:30 +0200
          Re: third-party packages adding apt sources Ole Streicher <olebole@debian.org> - 2016-05-20 15:00 +0200
            testing is a tool for the release team (Re: third-party packages  adding apt sources Holger Levsen <holger@layer-acht.org> - 2016-05-20 15:10 +0200
          Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-20 20:40 +0200
        Re: third-party packages adding apt sources Paul Wise <pabs@debian.org> - 2016-05-21 08:10 +0200
      Re: third-party packages adding apt sources Tollef Fog Heen <tfheen@err.no> - 2016-05-20 14:50 +0200
    Re: third-party packages adding apt sources Ian Jackson <ijackson@chiark.greenend.org.uk> - 2016-05-19 20:20 +0200
  Re: third-party packages adding apt sources Russ Allbery <rra@debian.org> - 2016-05-19 17:50 +0200
    Re: third-party packages adding apt sources Holger Levsen <holger@layer-acht.org> - 2016-05-19 18:00 +0200
  Re: third-party packages adding apt sources Ian Jackson <ijackson@chiark.greenend.org.uk> - 2016-05-19 19:10 +0200
    Re: third-party packages adding apt sources Daniel Pocock <daniel@pocock.pro> - 2016-05-19 19:20 +0200
      Re: third-party packages adding apt sources Bas Wijnen <wijnen@debian.org> - 2016-05-19 19:50 +0200
        Re: third-party packages adding apt sources Ian Jackson <ijackson@chiark.greenend.org.uk> - 2016-05-19 20:20 +0200
      Re: third-party packages adding apt sources Russ Allbery <rra@debian.org> - 2016-05-19 20:20 +0200
      Re: third-party packages adding apt sources Ian Jackson <ijackson@chiark.greenend.org.uk> - 2016-05-19 20:20 +0200
    Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-20 07:40 +0200
      Re: third-party packages adding apt sources Charles Plessy <plessy@debian.org> - 2016-05-20 11:40 +0200
      Re: third-party packages adding apt sources Paul Wise <pabs@debian.org> - 2016-05-21 08:10 +0200
        Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-21 08:50 +0200
          Re: third-party packages adding apt sources Paul Wise <pabs@debian.org> - 2016-05-21 09:00 +0200
            Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-21 09:10 +0200
        Re: third-party packages adding apt sources Lars Wirzenius <liw@liw.fi> - 2016-05-21 09:40 +0200
          Re: third-party packages adding apt sources Martin Steigerwald <martin@lichtvoll.de> - 2016-05-21 10:30 +0200
          Re: third-party packages adding apt sources Martin Steigerwald <martin@lichtvoll.de> - 2016-05-21 10:30 +0200
            Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-21 11:00 +0200
              Re: third-party packages adding apt sources Martin Steigerwald <martin@lichtvoll.de> - 2016-05-21 11:30 +0200
        Re: third-party packages adding apt sources Martin Steigerwald <martin@lichtvoll.de> - 2016-05-21 10:10 +0200
          Re: third-party packages adding apt sources Lars Wirzenius <liw@liw.fi> - 2016-05-21 10:40 +0200
            Re: third-party packages adding apt sources Martin Steigerwald <martin@lichtvoll.de> - 2016-05-21 11:20 +0200
      Re: third-party packages adding apt sources Ole Streicher <olebole@debian.org> - 2016-05-21 10:00 +0200
        Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-21 11:00 +0200
  Re: third-party packages adding apt sources Hakan Peker <holypeker@manlymail.net> - 2016-05-19 19:50 +0200
    Re: third-party packages adding apt sources Vincent Danjean <vdanjean.ml@free.fr> - 2016-05-20 21:40 +0200
      Re: third-party packages adding apt sources Hakan Peker <holypeker@manlymail.net> - 2016-05-22 16:50 +0200
        Re: third-party packages adding apt sources Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2016-05-22 17:10 +0200
  Re: third-party packages adding apt sources Charles Plessy <plessy@debian.org> - 2016-05-21 05:50 +0200
  Re: third-party packages adding apt sources Paul Wise <pabs@debian.org> - 2016-05-21 07:50 +0200
    Re: third-party packages adding apt sources Adam Borowski <kilobyte@angband.pl> - 2016-05-21 14:40 +0200
      Re: third-party packages adding apt sources Paul Wise <pabs@debian.org> - 2016-05-22 03:50 +0200

csiph-web