all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
From: Danny Milosavljevic <dannym@scratchpost.org>
To: Jan Nieuwenhuizen <janneke@gnu.org>
Cc: 43851@debbugs.gnu.org
Subject: [bug#43851] [PATCH] gnu: sudo: Depend on python-minimal instead of python.
Date: Thu, 8 Oct 2020 09:03:07 +0200	[thread overview]
Message-ID: <20201008090242.56cb7083@scratchpost.org> (raw)
In-Reply-To: <87362qc6hw.fsf@gnu.org>

[-- Attachment #1: Type: text/plain, Size: 1053 bytes --]

Hi Janneke,

On Wed, 07 Oct 2020 19:04:27 +0200
Jan Nieuwenhuizen <janneke@gnu.org> wrote:

> Depending on python pulls in X11:
> 
> --8<---------------cut here---------------start------------->8---
> $ guix graph --path sudo libx11
> sudo@1.9.3p1
> python@3.8.2
> tk@8.6.10
> libx11@1.6.9
> --8<---------------cut here---------------end--------------->8---
> 
> which is unfortunate, especially for the Hurd.
> 
> However...do we really want to extend sudo with eh, a large programming
> language that has a more impressive CVE list than a lovely tiny language
> such as, say Guile? ;)

I am very much in favor of not having unnecessary dependencies in things
which are suid root.  Also, there already IS PAM support in sudo, and
PAM has modules--so why have yet another weird new mechanism?  For auditing,
there is auditd (even in Guix already).

Furthermore, it makes updating sudo more brittle.

Also, we removed when cross-compiling already, pointing to other problems.

Please remove the python dependency entirely.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

      parent reply	other threads:[~2020-10-08  7:05 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-07 17:04 [bug#43851] [PATCH] gnu: sudo: Depend on python-minimal instead of python Jan Nieuwenhuizen
2020-10-07 21:18 ` Tobias Geerinckx-Rice via Guix-patches via
2020-10-09 17:18   ` Jan Nieuwenhuizen
2020-10-09 18:15   ` Maxim Cournoyer
2020-10-09 18:48     ` Tobias Geerinckx-Rice via Guix-patches via
2020-10-09 19:26       ` zimoun
2020-10-09 19:44         ` Tobias Geerinckx-Rice via Guix-patches via
2020-10-09 19:53           ` Jan Nieuwenhuizen
2020-10-09 19:48       ` bug#43851: " Jan Nieuwenhuizen
2020-10-08  7:03 ` Danny Milosavljevic [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201008090242.56cb7083@scratchpost.org \
    --to=dannym@scratchpost.org \
    --cc=43851@debbugs.gnu.org \
    --cc=janneke@gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.