All of lore.kernel.org
 help / color / mirror / Atom feed
From: Yann E. MORIN <yann.morin.1998@free.fr>
To: buildroot@busybox.net
Subject: [Buildroot] [PATCH v5 3/3] package/nodejs: taint the build on external modules
Date: Sun, 9 Sep 2018 09:49:08 +0200	[thread overview]
Message-ID: <20180909074908.GD2841@scaer> (raw)
In-Reply-To: <1536186133-9933-4-git-send-email-angelo.compagnucci@gmail.com>

Angelo, All,

On 2018-09-06 00:22 +0200, Angelo Compagnucci spake thusly:
> This patch enables the tainting of the build when an
> external module is added.
> 
> Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
> Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
> ---
>  package/nodejs/nodejs.mk | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/package/nodejs/nodejs.mk b/package/nodejs/nodejs.mk
> index e2c94ba..322a1ec 100644
> --- a/package/nodejs/nodejs.mk
> +++ b/package/nodejs/nodejs.mk
> @@ -160,6 +160,7 @@ NPM = $(TARGET_CONFIGURE_OPTS) \
>  # We can only call NPM if there's something to install.
>  #
>  ifneq ($(NODEJS_MODULES_LIST),)
> +NODEJS_TAINTS = YES

That is not even true.

If I have a Buildroot .config that contains:

    BR2_PACKAGE_NODEJS_MODULES_ADDITIONAL="http://myserver/node-mods/VERSION/foo"

Then this is 100% reproducible, because *I* manage and guarantee that it
is, as this is *my* repository.

I could even have:

    BR2_PACKAGE_NODEJS_MODULES_ADDITIONAL="$(BR2_EXTERANL_MY_TREE_PATH)/mods/foo"

which is also reproducible, by way of being in my git-versioned br2-external
tree.

And if you were to have:

    BR2_PACKAGE_NODEJS_MODULES_ADDITIONAL="foo at 1.2.3"

then it would also be preproducible, because the version is specified.

So, no, we can't set the tainted flag as soon as an external set of npm
modules are used; this would be plain wrong for people that already do
the "right thing".

Regards,
Yann E. MORIN.

>  define NODEJS_INSTALL_MODULES
>  	# If you're having trouble with module installation, adding -d to the
>  	# npm install call below and setting npm_config_rollback=false can both
> -- 
> 2.7.4
> 
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

  reply	other threads:[~2018-09-09  7:49 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-09-05 22:22 [Buildroot] [PATCH v5 0/3] Add tainting support to buildroot Angelo Compagnucci
2018-09-05 22:22 ` [Buildroot] [PATCH v5 1/3] Makefile: add tainting support Angelo Compagnucci
2018-09-06  7:44   ` Thomas Petazzoni
2018-09-06  7:46     ` Angelo Compagnucci
2018-09-05 22:22 ` [Buildroot] [PATCH v5 2/3] docs/manual: adding infos about tainting Angelo Compagnucci
2018-09-09  8:00   ` Yann E. MORIN
2018-09-05 22:22 ` [Buildroot] [PATCH v5 3/3] package/nodejs: taint the build on external modules Angelo Compagnucci
2018-09-09  7:49   ` Yann E. MORIN [this message]
2018-09-09 12:17     ` Angelo Compagnucci
2018-09-09 13:01       ` Yann E. MORIN
2018-09-09 13:29         ` Angelo Compagnucci
2018-09-06  7:42 ` [Buildroot] [PATCH v5 0/3] Add tainting support to buildroot Thomas Petazzoni
2018-09-09  7:36 ` Yann E. MORIN
2018-09-09 12:10   ` Thomas Petazzoni
2018-09-09 12:25     ` Angelo Compagnucci
2018-09-09 13:33       ` Yann E. MORIN
2018-09-09 13:44         ` Angelo Compagnucci
2018-09-09 14:20           ` Yann E. MORIN
2018-09-09 16:58             ` Angelo Compagnucci
2018-09-09 18:55               ` Yann E. MORIN
2018-09-09 20:18                 ` Angelo Compagnucci
2018-09-10  7:50                   ` Angelo Compagnucci
2018-09-10 15:00                     ` Yann E. MORIN
2018-09-10 15:37                       ` Yann E. MORIN
2018-09-10 17:10                       ` Angelo Compagnucci
2018-09-10 18:07                         ` Yann E. MORIN
2018-09-10 19:17                           ` Angelo Compagnucci
2018-09-10 19:43                             ` Yann E. MORIN
2018-09-10 20:03                               ` Angelo Compagnucci
2018-09-10 20:26                                 ` Yann E. MORIN
2018-09-11  6:20                                   ` Angelo Compagnucci
2018-09-10 19:37                           ` Thomas Petazzoni
2018-09-10 19:55                             ` Angelo Compagnucci
2018-09-10 20:37                             ` Yann E. MORIN
2018-09-09 13:27     ` Yann E. MORIN
2018-11-01 12:14 ` Arnout Vandecappelle
2018-11-01 12:25   ` Yann E. MORIN

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180909074908.GD2841@scaer \
    --to=yann.morin.1998@free.fr \
    --cc=buildroot@busybox.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.