[aur-general] Is it OK to provide the binary inside the PKGBUILD?
I noticed mp4join doesn't provde an upstream url and the PKGBUILD looks ... interesting: https://aur.archlinux.org/packages/mp/mp4join/PKGBUILD package() { cat << 'ENDEVOMGELAENDE' | openssl base64 -d > mp4join <code goes here> ENDEVOMGELAENDE chmod 755 mp4join install -D -m755 ./mp4join "${pkgdir}/usr/bin/mp4join" } Is it kosher?
Definitely not kosher, especially with everything in base64 (pkgbuild
is basically obfuscated).
Providing binaries is a pretty big no-no in general with few exceptions anyway.
J. Leclanche
On Wed, Dec 4, 2013 at 8:54 AM, Karol Blazewicz
I noticed mp4join doesn't provde an upstream url and the PKGBUILD looks ... interesting: https://aur.archlinux.org/packages/mp/mp4join/PKGBUILD
package() {
cat << 'ENDEVOMGELAENDE' | openssl base64 -d > mp4join
<code goes here>
ENDEVOMGELAENDE chmod 755 mp4join install -D -m755 ./mp4join "${pkgdir}/usr/bin/mp4join" }
Is it kosher?
Hi, Thanks for letting us know. The package in question will be removed unless it is fixed within hours. Best regards, Alexander / xyproto
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
"Alexander Rødseth"
Hi,
Thanks for letting us know.
The package in question will be removed unless it is fixed within hours.
Best regards,
Alexander / xyproto
I think that the maintainer is the author of this application. So I think he may upload sources anywhere (not binary) and I think it is better way. - -- С уважением, Е.Алексеев. Sirencelly yours, E.Alekseev. e-mail: darkarcanis@mail.ru ICQ: 407-398-235 Jabber: arcanis@jabber.ru -----BEGIN PGP SIGNATURE----- Version: APG v1.0.9 iQJEBAEBCAAuBQJSnvoSJxxFdmdlbml5IEFsZWtzZWV2IDxkYXJrYXJjYW5pc0Bt YWlsLnJ1PgAKCRAuiQEjMTYfAXefD/9SA+cL9im1SjGxCwm8DV8Ck/ytPAXOWNSo Tm0HYT5kR0dYCSxeudgGx4tiS9Hek8HP4MsJ/CZizW9v7qpRdd0GEFxA+acQEHqR NPtSFEBuGCxGlwJaumvqKOE4EC6/RHDU/H3mtyMp9+UXC+sTE1j/EZfpd5R6M3rD /R+cEoD4yHADR3f+gChymi8GshejQNc0kCCdUGvYXnQTu+CxoOfcsJlmdX+TP71M S0bVqx9CnkiPj9HuFFMGxL7t5eK6RJpuCKA4QvcshW5wXYWjKlu5pOjmaG8Db/Lc vQk1m03Z5sssVmk8OxeuhFw3QNQMuunCsRHScW1NLCb+5aWrwsOHRyJE/E321rQI vK+yGzDDFKmdIhaddSRG0eyA3Nt1ndzT5rHH+uFLiVudc0404MtzHwC71K7wGmVR vKgYVT6mgLn26Jc6eg3WXkxMVx/pAYS48zZUU37IMcc4m3A5FGeRFkMjCIatjeIb hr0NT5V8uKsraH2C6o2AaW9uicx60J/zMuDV/bZvLL+Zf5IfdPsPJAw7AMfZanUi 9Y+bYGjqpMVpJcj7squE1MQcCCSQDWTimL7th3i2AriP0wkEMKv8I6uhswukn+RN Ug7NxcwzqEKxkdkeD6peRHzkI4yVn9/V6iJAAUl5/W+BF4VlAfFrhBGMRlrRMdKT UDStrnea3A== =srqL -----END PGP SIGNATURE-----
participants (4)
-
Alexander Rødseth
-
Evgeniy Alekseev
-
Jerome Leclanche
-
Karol Blazewicz