mirror of
https://gitlab.alpinelinux.org/alpine/abuild.git
synced 2025-01-11 17:29:52 +00:00
Alpine build tools
297de93aef
Not allowing --allow-untrusted is obviously a good idea, but it can be trivially bypassed if --keys-dir is allowed: $ abuild-apk add foo-1-r0.apk ERROR: foo-1-r0.apk: UNTRUSTED signature $ abuild-apk --allow-untrusted add foo-1-r0.apk abuild-apk: --allow-untrusted: not allowed option $ cp -rp /etc/apk/keys /tmp/keys $ cp untrusted.pub /tmp/keys $ abuild-apk --keys-dir /tmp/keys add foo-1-r0.apk (1/1) Installing foo (1-r0) OK: 4319 MiB in 806 packages If both --allow-untrusted and --keys-dir are not allowed, then it should no longer be possible for an unprivileged member of the abuild group to add an untrusted package. $ abuild-apk --keys-dir /tmp/keys add foo-1-r0.apk abuild-apk: --keys-dir: not allowed option |
||
|---|---|---|
| .devbuildrc | ||
| .editorconfig | ||
| .gitignore | ||
| abuild-fetch.c | ||
| abuild-gzsplit.c | ||
| abuild-keygen.in | ||
| abuild-rmtemp.c | ||
| abuild-sign.in | ||
| abuild-sudo.c | ||
| abuild-tar.c | ||
| abuild.conf | ||
| abuild.in | ||
| abump.in | ||
| apkbuild-cpan.in | ||
| apkbuild-gem-resolver.in | ||
| apkbuild-pypi.in | ||
| APKBUILD.5 | ||
| apkgrel.in | ||
| bootchartd | ||
| buildlab.in | ||
| checkapk.in | ||
| config.guess | ||
| config.sub | ||
| functions.sh.in | ||
| Makefile | ||
| newapkbuild.1 | ||
| newapkbuild.in | ||
| sample.APKBUILD | ||
| sample.confd | ||
| sample.initd | ||
| sample.post-install | ||
| sample.pre-install | ||