clearlinux / cve-check-tool

Original Automated CVE Checking Tool
GNU General Public License v2.0
204 stars 78 forks source link

Improve or drop PKGBUILD support #24

Open ikeydoherty opened 8 years ago

ikeydoherty commented 8 years ago

PKGBUILD may offer simplicity, but in terms of being machine readable it's an absolute nightmare, and to fully parse it correctly requires execution of sub shells, thus the format in itself presents a security issue to even interact with it. (pkg_version functions and such)

Thus, we'll wait to see if anyone is interested in improving the PKGBUILD support, or drop it completely.

Primary issue is that Arch Linux is in no way interested in patch accounting [1], which makes it very difficult to have any form of support for the distribution itself.

[1] https://lists.archlinux.org/pipermail/arch-security/2015-April/000283.html