APT whitelist request for libclang-3.5-dev about apt-package-safelist HOT 9 CLOSED

I assume you handle dependencies when you add something to the whitelist? Otherwise I'll need to add more issues to cover the dependencies.

from apt-package-safelist.

Ran tests and found setuid bits. See https://travis-ci.org/travis-ci/apt-whitelist-checker/builds/72229412.

from apt-package-safelist.

What line number(s) are you talking about?

These are the headers for the clang-3.5 package, which is already on the whitelist. To the best of my knowledge, there shouldn't be any binaries here, setuid or otherwise. When I glanced through the output of the log, it looked like the references to setuid were mostly associated with compiler and library support for syscalls. But anything contained in this package should merely be the headers and/or source corresponding to the already-whitelisted clang-3.5 binaries.

from apt-package-safelist.

Ran tests and found setuid bits. See https://travis-ci.org/travis-ci/apt-whitelist-checker/builds/72284973.

from apt-package-safelist.

Rerun.

from apt-package-safelist.

Will this make it to the whitelist? I have a project that depends on this, and it's a little odd that libclang-3.4 through libclang-3.8 are all on the whitelist except for libclang-3.5

from apt-package-safelist.

I'd suggest you email support to ask and let them know you're blocked on it ([email protected]). Last time I emailed them (around late September), this is what I got:

Firstly, we do plan to continue supporting the current Precise based environment that provides sudo access until we have a full replacement for it based on Trusty, as many of our users have a variety of build needs that mean they aren't best suited for a container based build.

At this time the apt whitelist is a trade-off we make to enable us support container based builds and being able to provide the increased boot and runtime speed they can bring to many builds, while also being able to support this in a multi-tenant fashion.

We do monitor the queue and we are aware that issues for more complicated sources and packages often do take a while to get processed, as we have to review them all for any possible privilege escalation scenarios they could introduce to the container based infrastructure.

We are working to increase the turn around time on this but it ultimately comes down to manpower for a lot of it.

We understand your frustration with the current turn around time though and appreciate you taking the time to send us feedback.

Please let us know if we can answer any other questions

from apt-package-safelist.

@elliottslaughter , thanks much for forwarding this email. I didn't realize until I saw your email that the Precise-based non-container environment was still available. Switching to that unblocked me for the time being, although I would like the convenience of containers long term. I will write to them about it.

from apt-package-safelist.

This is now available for Trusty 👍

from apt-package-safelist.