Re: Release process (was Re: DarwinPorts 1.3.1)

Le 3 août 06 à 17:15, Jordan K. Hubbard a écrit :

>> Library injection gives enough granularity to be able to  
>> independently:
>> - detect what the package refers to
>> - prevent the package from doing dirty things
>> - prevent the package from referring to things
>
> Which sounds like we're saying the same thing - I'm also advocating  
> that the package not be able to "refer" to things like /usr/local/ 
> include/jpeg.h or /opt/local/bin/myfuzzylanguage at all unless it's  
> also been explicitly specified in the Portfile as a dependency.   
> Yet you've said in other messages that you don't want to deny opens  
> (or attempts to exec) to either of those things, so now I'm confused.

The keyword here is "independently". I'm just stating what library  
injection can be used for, not what it should do for the very DP  
project.
We still disagree: I don't think we should deny opens (third item),  
while you think we should (and this is what chroot gives anyway).

Let me provide you with an executive summary:
* We both consider that library injection can more or less provide  
the same features as chroot+union mount, but it's more lightweight.
* You suggest to extend the library injection code to be equivalent  
to chroot+union mount. You base this opinion on the fact that it's  
just the way many binary package builder systems work, and this is a  
strong argument indeed.
* I say: those systems use chroot. Library injection provides a  
greater granularity we should take advantage of, in particular by not  
denying opens but just recording them.

I developed arguments for this in several other mails in this thread.

Paul
-- 
Ministre ultraplénipotentiaire en disponibilité.
Mobile. Sans baignoire fixe.
http://www.kallisys.com/
http://www-poleia.lip6.fr/~guyot/