search

pandoc-extras / pandocpm

Manage the install/update/uninstall of packages
https://pandoc-extras.github.io/pandocpm/
Apache License 2.0
7 stars 0 forks source link

Securities feature #5

Closed ickc closed 7 years ago

ickc commented 7 years ago

Split off from #2:

  1. trust 3rd party package manager (e.g. pip, cabal), because we cannot do anything about this.

  2. For simple package that pandocpm install directly, either

    1. point to a particular commit (security by SHA-1 and by our sanitization in pull request of formula)

    2. point to a centralized repo (see #8) that I might create later, under pandoc-extras. In this case it can point to the latest commit. (security by our sanitization in pull request to that repository)

Edit: It almost goes without saying: https should be required in any urls.

ickc commented 7 years ago

@sergiocorreia, I guess this is considered to be finalized? I'll close it for now and if you have objection you can reopen it.