|
|
|
|
|
|
by g-b-r
23 days ago
|
|
|
> Sure - but running build scripts on an end-user's machine requires the user to have all relevant tools installed, and isn't exactly reducing the attack surface... Well, that's what building from source means; you could maybe distribute some compiled files for those who prefer them, and are willing to take the risk. But you seem to be arguing that having users compile their software themselves doesn't increase their security? > As mentioned, the first thing that came to mind to make things easier to audit is to stick their contents into a community-controlled VCS. True |
|
|
On the contrary! I gave examples where source files get generated. This happens in one of two places: Either when the maintainer publishes a new version, or every time an end user builds the package.
I'm arguing for the former, you're arguing for the latter. There are pros and cons to either approach. Some cons for the latter:
First, the build process becomes more brittle, as every end user now has to install the necessary tools. In case of the project containing RELAX NG schemas I alluded to, this would require a recent version of Perl, a Java runtime, and the Trang utility written in Java. The alternative? Just shipping a single XML file.
Second, the build process often doesn't become more, but less auditable: Instead of just reviewing the source files that actually get compiled, you now have to track down how they get generated, and review all the scripts that do so.