Open aspiers opened 6 years ago
@ethomson Can you suggest how to deal with this? Is switching from containers to Travis CI's sudo-enabled VMs the only solution?
Not sure how you want to solve this, but no, I don't think that you'll need sudo-enabled VMs. We build in the container based workflows by hosting our own .deb
: https://github.com/libgit2/libgit2/blob/master/.travis.yml#L29 - we use bintray to host it but that's not a requirement.
I'm afraid that you may have to build your own .deb
which is disappointing, but you may be able to use an existing one or backport it, then 👍
I don't understand - how is it allowed to point at your own repositories which contain your own .deb
packages? Surely this circumvents the whole security process behind the whitelist if you can install any old package into a container without audit?
🤷♂️ I’m the wrong person to ask about why it works.
It looks to me very much like your CI isn't actually using containers, and is using sudo
:
https://travis-ci.org/libgit2/libgit2/jobs/380646286#L436
My guess is that adding an apt source which isn't on the whitelist automatically disables the use of containers.
3420 requested
libgit2-24
, and the consequent Travis CI run shows that at one pointlibgit2-24
was available from the Debianunstable
repo:However it's no longer available, so presumably should be removed from the whitelist to avoid misleading people into thinking it's available.