3 ms·
I agree very much with this. Something that annoys me is how much information tar files leak. Like, you don't need to know the username or groupname of the pe
by jrockway 3y ago
I agree very much with this. Something that annoys me is how much information tar files leak. Like, you don't need to know the username or groupname of the person that originally owned the files. You don't need to copy around any mode bit other than "executable". You definitely don't need "last modified" timestamps, which exist only to make builds that produce archives non-hermetic.
Frankly, I don't even want any of these things on my mounted filesystem either.
> The problem is that people would have to download an unpacker.
Your archive format just needs to be an executable that runs on every platform. https://github.com/jart/cosmopolitan https://github.com/jart/cosmopolitan is something that could help with that. ("Who would execute an archive? It could do anything," I hear you scream. Well, tell that to anyone who has run "curl | bash".)
- theamk 3y agoI know it may not seem this way, but a lot of people don't ever run "curl | bash", or if they do, they do so in throwaway VM (or container if source is mostly trusted)
- wakawaka28 3y agoIt's really a bad idea most of the time to have an archive that doubles as an executable. It's not possible to cover every possible platform, and in the distant future those self-extracting archives may be impossible to extract without the required host system.
- Symbiote 3y agotar --create --owner=0 --group=0 --mtime='2000-01-01 00:00:00' \ --mode='go-rwxst' --file test.tar /bin/dash /etc/hosts tar --list --verbose --file test.tar -rwx------ root/root 125688 2000-01-01 00:00 bin/dash -rw------- root/root 1408 2000-01-01 00:00 etc/hosts
- wruza 3y agoIn most common scenarios, curl | bash is no different from apt-add-repository && apt install. Running a completely non-curated executable is very different.