Skip to content

Add tainting support to buildroot

Yann E. MORIN buildroot 10 versions – New

Get series with b4
b4 am 20181101122514.GT28575@scaer

Versions newest first · linked by author and title

  1. v5 Latest posting 10/100 of 3 patches 0 repliesNew
  2. v5 posting 9/100 of 3 patches 0 repliesSuperseded
  3. v5 posting 8/100 of 3 patches 0 repliesSuperseded
Earlier versions · 7
VersionPostedPatchesRepliesStatus
v5 posting 7/100 of 3 patches0 repliesSuperseded
v5 posting 6/100 of 3 patches0 repliesSuperseded
v5 posting 5/100 of 3 patches0 repliesSuperseded
v5 posting 4/100 of 3 patches0 repliesSuperseded
v5 posting 3/100 of 3 patches0 repliesSuperseded
v5 posting 2/100 of 3 patches0 repliesSuperseded
v5 posting 1/103 patches0 repliesSuperseded

Patches in v5 posting 10/10 No applies recorded yet

None of the 3 patches the cover letter announces are in this archive.

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v5 yet.

Read the v5 thread

Cover letter [Buildroot] [PATCH v5 0/3] Add tainting support to buildroot

Arnout, Angelo,

On 2018-11-01 13:14 +0100, Arnout Vandecappelle spake thusly:

Quoted 19 lines · Angelo Compagnucci
Quoted 9 lines

Packages that need to resolve dependencies internally and use a package manager would harm the reproducibility of a build, moreover they escape the legal infrastructure not giving enough informations on licensing.

This patch adds a tainting mechanism in the form of a variable FOO_TAINTS that can be used to signal that a package harms the reproducibility or licensing under certain conditions.

We had a discussion about this at the BR developer meeting, and we decided that
the taints mechanism is not worth it. As noted by Yann, it can only ever be used for a warning, not to block anything, because there are ways to do the right thing for e.g. BR2_REPRODUCIBLE.

And if it is just a warning, then it can just be included in the help text of
the Config.in option. Or, if we want to make it stronger, a conditional comment.

Quoted 7 lines
Quoted 2 lines

This opens the door to include per language dependency managers in buildroot.

To be honest (not discussed, so purely my personal opinion), maybe we should
just relax our opposition against language package managers. Yes, there are those 7 points (which I still haven't added to the documentation, shame on me) but that doesn't mean it's entirely blocking.

I thought we did discuss it, at least informally, and came to the conclusion that we should not block them, indeed.

Quoted 1 line

I hope I haven't opened a box of Pandora by saying this :-)

It was already opened! ;-)

Regards,
Yann E. MORIN.

Quoted 6 lines

Regards,
Arnout
_______________________________________________
buildroot mailing list
buildroot at busybox.net
http://lists.busybox.net/mailman/listinfo/buildroot

Signature · 6 lines
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

Read the cover letter in its thread