search

sharplispers / cormanlisp

Corman Lisp
MIT License
570 stars 78 forks source link

Don't connect to cormanlisp.com's servers looking for patches #5

Closed luismbo closed 9 years ago

binghe commented 9 years ago

The whole auto update facility is implemented in Sys\auto-update.lisp, the parameter auto-update-enabled is a switch to control it. And the patch server URL entry is something like this:

http://www.cormanlisp.com/CormanLisp/patches/3_01f1/CormanLisp_3_01_patch_index.lisp

Then the downloaded index file will be analyzed for further download of other files.

I think maybe the idea of auto-update is still useful, because it's really convenient. By changing the patch server URL to Github, and add a similar "patches" directory into our code base, I say we're the first open source CL implementation which supports auto updates. What do you think @luismbo @xach?

binghe commented 9 years ago

Or, maybe common-lisp.net is a better place as the patch server.

xach commented 9 years ago

I would like the idea more if patches were fetched securely and verified as authentic before loading. Until that's done, I think it's better to remove the checking.

luismbo commented 9 years ago

I produce the occasional patch at work and find that maintenance strategy to be a royal PITA. These days it should be easier to download the whole binary, maybe use binary diffs if necessary, than having to produce custom patches.

binghe commented 9 years ago

OK, make sense, this is a security hole. Then let me push a fix to disable the auto-updates by default.

binghe commented 9 years ago

Auto update is disabled by default. I hope we preserve the related code and not delete them.