sbt-native-packager icon indicating copy to clipboard operation
sbt-native-packager copied to clipboard

simple-sudo-docker scripted tests asks for sudo permission

Open jroper opened this issue 5 years ago • 1 comments

I just ran the docker scripted tests on my machine, and they asked for my password for sudo access! This is the most alarming thing I've ever seen running a build, if the tests for an open source project ask me for my sudo password, my immediate assumption is this build has been compromised by someone malicious. I've since had a look, seen what the test does, etc, it's harmless, but really, I never want to give any build sudo access to my machine, and if we train sbt-native-packager contributors and maintainers to enter their password whenever they run the scripted tests, how simple is it going to be for someone to sneak in a small change to that test that does something hugely dangerous?

The test itself proves nothing. It configures native packager to run sudo docker instead of docker, but then makes no assertions that sudo docker was what was run. In travis, there's no difference whatsoever. So, since the test has no assertions that what's trying to do works, the test has no value, and I think should be deleted, especially given how alarming it is to be asked for your password for sudo during a build.

jroper avatar Mar 16 '20 23:03 jroper

I'm totally on board with you on this one :+1: Thanks for pointing this out and proving a pull request to fix this :sunglasses:

muuki88 avatar Mar 17 '20 13:03 muuki88