From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 12106 invoked by alias); 31 Mar 2010 20:20:25 -0000 Received: (qmail 12088 invoked by uid 22791); 31 Mar 2010 20:20:24 -0000 X-SWARE-Spam-Status: No, hits=-1.9 required=5.0 tests=BAYES_00,T_RP_MATCHES_RCVD X-Spam-Check-By: sourceware.org Received: from mail.codesourcery.com (HELO mail.codesourcery.com) (38.113.113.100) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Wed, 31 Mar 2010 20:20:20 +0000 Received: (qmail 18397 invoked from network); 31 Mar 2010 20:20:19 -0000 Received: from unknown (HELO digraph.polyomino.org.uk) (joseph@127.0.0.2) by mail.codesourcery.com with ESMTPA; 31 Mar 2010 20:20:19 -0000 Received: from jsm28 (helo=localhost) by digraph.polyomino.org.uk with local-esmtp (Exim 4.69) (envelope-from ) id 1Nx4Of-0008L0-SI; Wed, 31 Mar 2010 20:20:17 +0000 Date: Wed, 31 Mar 2010 20:53:00 -0000 From: "Joseph S. Myers" To: Jim Meyering cc: Ralf Wildenhues , Tristan Gingold , Binutils Subject: Re: [Patch]: upgrade to automake 1.11.1 In-Reply-To: <87d3yki851.fsf@meyering.net> Message-ID: References: <4CC4EBAB-2BE1-428D-BBB5-560CFED33DDE@adacore.com> <20100331082751.GC23926@ins.uni-bonn.de> <877hoslegf.fsf@meyering.net> <87d3yki851.fsf@meyering.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Mailing-List: contact binutils-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: binutils-owner@sourceware.org X-SW-Source: 2010-03/txt/msg00470.txt.bz2 On Wed, 31 Mar 2010, Jim Meyering wrote: > > Checking for world-writable distributed directories might make sense (that > > The net effect (world-writable dist dirs) is not the real risk. > The risk is that while the tarball is being created, the directories > being put into it are world writable, and so can potentially > be made to contain anything. If you or anyone else then use the But checking for world-writable directories in the tarball seems like a more reliable way of determining whether the build of the tarball was exposed to the risk than checking for "make dist" rules that may be dead code for any package not using "make dist" to make its releases (while failing to check for other packaging scripts, such as that used by GCC, that also implement that former requirement of the GNU Coding Standards). -- Joseph S. Myers joseph@codesourcery.com