3 ms·
A neat concept, however this doesn't give me a ton of confidence to use it. An example is this bit: https://github.com/ublue-os/bluefin/blob/main/usr/bin/ublue
by georgyo 3y ago
A neat concept, however this doesn't give me a ton of confidence to use it.
An example is this bit:
https://github.com/ublue-os/bluefin/blob/main/usr/bin/ublue-nix-install https://github.com/ublue-os/bluefin/blob/main/usr/bin/ublue-...
That runs as root not one but three bits of mutable shell scripts from the internet.
I love me some nix, but the most reproducible package manager should not be install via a hodpodge of directly running scripts from the Internet. Really nothing from my distribution should be doing that.
At the very least they should be vendored as part of the project so you can see when these scripts change.
- jcastro 3y agoThanks for the feedback we'll take a look!
- bketelsen 3y agoGood eye! Those scripts are not used anymore, they were early prototypes. You can see the comments in the PR here: https://github.com/ublue-os/bluefin/pull/606#issue-1954476210 https://github.com/ublue-os/bluefin/pull/606#issue-195447621...
- georgyo 3y agoEven if the particular script is not used, the just file there is actually much worse. Literally everything is running scripts directly from the internet, without any version pinning or check summing. There is no way to run the same build twice and have any confidence that the result was the same. https://github.com/ublue-os/bluefin/blob/41bdf294c20a3903f4a0cf72105f466bf0676291/just/custom.just#L138 https://github.com/ublue-os/bluefin/blob/41bdf294c20a3903f4a...