3 ms·
Microsoft's dpkg packages themselves do some fairly weird/annoying stuff in their maintainer scripts. e.g., azuredatastudio contains code that manages a /usr/l
by yrro 5y ago
Microsoft's dpkg packages themselves do some fairly weird/annoying stuff in their maintainer scripts.
e.g., azuredatastudio contains code that manages a /usr/local/bin/code symlink...
... and it contains code that converts a PGP key in armored form to binary form and dumps it in /etc/apt/trusted.gpg.d, even if the sysadmin already took the time to verify the PGP key and put it into their own .asc file in the same directory (ok, I guess at least they aren't force-appending their key to the old/deprecated/monolithic /etc/apt/trusted.gpg file like many others)...
... oh and in doing so they dump out microsoft.gpg to the current directory, whatever that may be... they should at least be using mktemp!
... and they are doing other things that they should be relying on debhelper to do for them, e.g. installing shared-mime-info-spec files manually rather than with dh_installmime; installing desktop-entry-spec files manually rather than relying on the triggers that already handle installation of such files...
As for teams, it has its own oddball way of monkeying with /etc/apt, and one other weirdness: it explicitly changes /usr/share/teams/chrome-sandbox to be setuid. If that file is supposed to be setuid then ship it as such... shipping it non-setuid and then modifing it in a maintainer script sets off alarm bells and breaks dpkg-statoverride...
- Nux 5y agoI have zero trust on how they handle this, judging by your post it is justified. This is why I decided to bite the bullet and go flatpak for the likes of teams, slack and other proprietary software.
- mcny 5y ago> This is why I decided to bite the bullet and go flatpak for the likes of teams, slack and other proprietary software. I always recommend this now if it is an option. Even if Microsoft does nothing wrong, it is way too easy for me to make an error and somehow enable Microsoft antivirus stuff on my Fedora machine which I still don't know how I managed to do.
- yrro 5y agoFlatpak is best iff the vendor is producing the packages. I have found all too often than I'm stuck on an outdated version of a orphaned, unofficial pacakge...
- stinos 5y agoStill I wonder if you'd author all non-proprietary packages how many of these violations you'd find. Especially in smaller projects. Don't have any examples ready since I also try to avoid anything but established software, but I'm certain in the past I've had issues like mentioned above, even persisting after removal of the package.
- swiley 5y ago>explicitly changes /usr/share/teams/chrome-sandbox to be setuid These kinds of hacks are pretty consistant with my few experiences with Microsoft (and other vendor's) closed software on Linux. It's all best avoided for community maintained solutions.
- markkrj 5y ago/etc/apt/trusted.gpg.d is being deprecated also in favour of signed-by=/usr/share/keyrings/keyfile.gpg https://www.linuxuprising.com/2021/01/apt-key-is-deprecated-how-to-add.html?m=1 https://www.linuxuprising.com/2021/01/apt-key-is-deprecated-...
- yrro 5y agoThanks for reminding me. I really wish apt-secure(8) and apt-key(8) would mention this!