From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pjotr Prins Subject: Re: [PATCH] tar bombs and muscle Date: Sun, 17 Jan 2016 13:45:50 +0100 Message-ID: <20160117124550.GA18864@thebird.nl> References: <569AEE9B.6070709@uq.edu.au> <569AF3BB.7080305@uq.edu.au> <87y4bo363z.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:47266) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aKmj0-0002Kl-JI for guix-devel@gnu.org; Sun, 17 Jan 2016 07:46:31 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aKmiw-0004Zj-Hs for guix-devel@gnu.org; Sun, 17 Jan 2016 07:46:30 -0500 Content-Disposition: inline In-Reply-To: <87y4bo363z.fsf@gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: Mathieu Lirzin Cc: "guix-devel@gnu.org" On Sun, Jan 17, 2016 at 10:30:56AM +0100, Mathieu Lirzin wrote: > Hi, > > Ben Woodcroft writes: > > > There is a somewhat popular bioinformatics program muscle whose > > download tgz is a tar bomb. The bomb moniker seems especially > > appropriate here, since it made the gnu-build-system error out, and > > patching gnu-build-system requires a lot of rebuilding. In the > > attached patches > > IMO distributing a tar bomb is a bug, So I would prefer Guix not to work > around it silently. If it is rare, replacing the unpack phase manually > should be enough. However If it is common, we could add a procedure in > (guix build utils) to avoid repetition of the same chunk of code. It is rare these days.