5 May
2023
5 May
'23
21:33
On 5/4/23 15:38, Jan Engelhardt wrote:
On Thursday 2023-05-04 23:18, Jim Fehlig via openSUSE Factory wrote:
The request was declined because "Services are only allowed if their mode is one of localonly, disabled, buildtime, manual". Is it possible to remove this restriction, or include modes that support server-side runs? Are server-side modes not permitted because the sources could change after filing the request?
Concern for exploitable bugs in the service code itself. For example, tar_scm calls git-clone, and git itself has some opportunities to run hooks, which, with a suitably crafted repository...
How is the exposure to such exploits different/worse than devel projects where server-side modes are allowed? Cheers, Jim