On 02/17/2015 08:57 AM, Heinz Diehl wrote:
On 16.02.2015, Ranjan Maitra wrote:
The problem I am having is that the stapler version at the URL is called
stapler-master..
In the .spec file, you have a line like this:
Source0: https://github.com/hellerbarde/stapler/archive/master.zip
I think this is a security hole, because anybody with access to the git tree
can manipulate the code which gets packaged here, and your rpm build process
will gladly download and build it.
Exactly. We have rules in the FPG on how to deal with github URLs.
The way I used in my spec is one of these.
Ralf
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
