3 ms·
Performance aside I was very disturbed to learn snap packages have no namespacing and no useful mandatory authorship metadata: https://forum.snapcraft.io/t/lack
by schmichael 6y ago
Performance aside I was very disturbed to learn snap packages have no namespacing and no useful mandatory authorship metadata: https://forum.snapcraft.io/t/lack-of-package-provenance-is-a-security-concern/16316 https://forum.snapcraft.io/t/lack-of-package-provenance-is-a...
tl;dr -> HashiCorp's various tools exist as snaps but none are published by HashiCorp. All are out of date. Some have incorrect metadata. Few provide any clue as to who or where the upstream is. There's usually not even a way to contact the snap author to submit patches or ask for an upstream link. eg https://snapcraft.io/nomad https://snapcraft.io/nomad
- ghthor 6y agoYep, it's a massive smell. When I looked at installing a snap I wanted to audit the build script but I couldn't find that anywhere. That's a big NO from me.