search

ccarney16 / pterodactyl-containers

Pterodactyl Panel within a docker container
230 stars 78 forks source link

What is the yq binary and why are we supposed to trust it #105

Closed davidpanic closed 2 years ago

davidpanic commented 3 years ago

Looking through the code for this, there seems to be a random statically linked 64 bit ELF executable called yq with no documentation or source code that I could find.

What is this file and how are we supposed to know that it is trustworthy and that it won't do something like rm -rf /*.

TekExplorer commented 3 years ago

https://github.com/mikefarah/yq though perhaps bin/deploy could download it instead of having it be included to begin with?

davidpanic commented 3 years ago

Or just use the docker image as per documentation since docker is required anyway:

yq() {
  docker run --rm -i -v "${PWD}":/workdir mikefarah/yq "$@"
}
TekExplorer commented 3 years ago

that... is not a bad idea.

ccarney16 commented 3 years ago

yq is to parse yaml files, I am looking to slowly move away from the deploy script and yq and move towards something like ytt. I find it overall to be more configurable and adjustable compared to yq, and also allows injection of variables and templates. It can be used to just deploy the entire setup without writing a complex script. The binary will be removed and will opt for the user to install ytt on their system.