void-linux / xbps

The X Binary Package System (XBPS)
https://voidlinux.org/xbps/
Other
821 stars 124 forks source link

[RFC] lib: don't allow xbps self-update to bypass integrity checks #597

Open oreo639 opened 7 months ago

oreo639 commented 7 months ago

cc: @Duncaen

Right now, this is just a dumb implementation of the fix to get feedback, this does not currently remove the xbps_autoupdate() mechanism. Ofc if you prefer to go a different route (e.g. static linking) please let me know.

You can test this using libhelloworld and test1 from https://github.com/void-linux/xbps/issues/580 and then having xbps depends on libhelloworld>=<helloworld_version> where helloworld_version would be 1 for the first build and 2 for the second ofc.

Closes: https://github.com/void-linux/xbps/issues/592