[bug#53765] [PATCH 12/17] gnu: Add clojure-com-cognitect-http-client.

[Maxime Devos <maximedevos@telenet.be>]

[-- Attachment #1: Type: text/plain, Size: 864 bytes --]

Reily Siegel schreef op ma 07-02-2022 om 13:06 [-0500]:
> This code is taken directly from Maven, as are many Java packages. This
> relies on whatever authentication Maven does to ensure packages are not
> forgeries.

I took a look at <https://maven.apache.org> and AFAICT Maven does not
have any process in place to prevent forgeries or malicious code;
there does not appear to be any vetting process, though perhaps
I haven't looked far enough.

A web page from cognitect telling ‘grab source code from Maven
(com/cognitect/http-client)’, combined with going over the source
code to sniff things like ’Send ~/.gnupg to evil.com’ should be
sufficient.

For the damage the absence of a vetting process can do,
see e.g. <https://lwn.net/Articles/694830/>.  The same issue
appears to hold for PyPI, RubyGems and npm.

Greetings,
Maxime.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 260 bytes --]