Re: Three steps we could take to make supply chain attacks a bit harder

[Carlos Rodriguez-Fernandez <carlosrodrifernandez@xxxxxxxxx>]

Understood. However, at least for those unit tests run in the %check, it 
is going to be almost unfeasible, because of the variability of the way 
things are done in the different programming ecosystems. In Java, unit 
tests are nicely separated in a different folder (i.e., `src/test`), but 
in golang, it is mingled with the source code in `_test.go` files. In C, 
it depends on the programmers convention.

On 4/1/24 09:29, Adam Williamson wrote:
> On Mon, 2024-04-01 at 05:58 -0700, Carlos Rodriguez-Fernandez wrote:
> > Test isolation is still assuming the attack comes in the test phase.
>
> As I initially suggested it, it does not. My suggestion was that we
> ensure the test code is not available to the prep / build / install
> phases *at all*, and is only made available to the test phase.

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature

--
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue