On 4/25/22 13:42, Fabio Valentini wrote:
On Mon, Apr 25, 2022 at 10:51 AM Vít Ondruch <vondruch@xxxxxxxxxx> wrote:
2) Standalone script does not solve the main issue and that is a way CI could obtain the tarball. Of course you mentioned "with support for extraction in spectool", but that is also part of the issue, because that would need the "spectool" changes as well as CI changes. My proposal does not need that. Of course, this is proof of concept, while the part of the script you point out could be possibly improved and abstracted by some macro.
This has come up before, but given that the current maintainer of
spectool (which is me) has offered to implement support for this, I
don't see this as a problem.
I also assume that the CI you're talking about already calls spectool
to download package sources for new versions, so doing this would
actually make any changes to the CI environment entirely unnecessary.
We'd just need to agree on a way to specify the path to the script
that needs to be run for generating source X.
For example, we could use something like:
# SourceScript: gen_clean_tarball.sh
That would make it easy for spectool to parse this information from
the .spec file, and then execute the program with that name.
I think it does require some changes to CI, otherwise, this will execute
untrusted code when all it was supposed to do is download. I do
currently assume that I can run `spectool -g` on an untrusted spec to
look at the source code, without running untrusted code.
I think the user should make an active decision to execute such scripts,
thus a API change for CI would be needed.
David
We could possibly also supply some variables as command line arguments
to that script, for example, the current "Version" from the .spec
file, so it doesn't have to be modified in two places.
Fabio
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
