sbt-pgp
sbt-pgp copied to clipboard
sbt
How to bootstrap and verify sbt plugins?
There should be a tutorial on how to download and verify sbt-pgp and another other build plugins before sbt runs (and a malicious plugin stops sbt-pgp from working)
Good question. I think it may be (barely) possible for us to do that. We would actually need to include ourselves VERY EARLY in the sbt load process, and even then we wouldn't be guaranteed to catch everything....
Cc. @eed3si9n
Imagine all the people living life in peace (using sbt-pgp as part of mothership instead of a plugin).
I imagine this being a tar.gz that directly patches sbt or is integrated directly. On 12 May 2016 8:19 pm, "Josh Suereth" [email protected] wrote:
Good question. I think it may be (barely) possible for us to do that. We would actually need to include ourselves VERY EARLY in the sbt load process, and even then we wouldn't be guaranteed to catch everything....
Cc. @eed3si9n https://github.com/eed3si9n
— You are receiving this because you authored the thread. Reply to this email directly or view it on GitHub https://github.com/sbt/sbt-pgp/issues/91#issuecomment-218858644
What's sbt mothership? On 12 May 2016 8:42 pm, "Thomas Grainger" [email protected] wrote:
I imagine this being a tar.gz that directly patches sbt or is integrated directly. On 12 May 2016 8:19 pm, "Josh Suereth" [email protected] wrote:
Good question. I think it may be (barely) possible for us to do that. We would actually need to include ourselves VERY EARLY in the sbt load process, and even then we wouldn't be guaranteed to catch everything....
Cc. @eed3si9n https://github.com/eed3si9n
— You are receiving this because you authored the thread. Reply to this email directly or view it on GitHub https://github.com/sbt/sbt-pgp/issues/91#issuecomment-218858644
It's a term I use sometimes to refer to sbt, as opposed to the plugins. I've been an advocate for that for a while. See https://groups.google.com/d/msg/simple-build-tool/1Zq1Xa5_Ge4/Fikn3qJDVDQJ for example.
The signature verification parts of sbt-pgp only make sense if they can verify plugins before they are loaded and as such cannot work without being patched into sbt or included in 'mothership' On 12 May 2016 8:55 pm, "eugene yokota" [email protected] wrote:
It's a term I use sometimes to refer to sbt, as opposed to the plugins. I've been an advocate for that for a while. See https://groups.google.com/d/msg/simple-build-tool/1Zq1Xa5_Ge4/Fikn3qJDVDQJ for example.
— You are receiving this because you authored the thread. Reply to this email directly or view it on GitHub https://github.com/sbt/sbt-pgp/issues/91#issuecomment-218867347
You could create a new addSbtPlugin function eg addSbtPlugin(plugin: Plugin, pgp: PgpFingerPrint)
That does the validation.
But you would still need to patch sbt before the plugins.sbt loaded.
Thomas Grainger
On 12 May 2016 at 21:05, Thomas Grainger [email protected] wrote:
The signature verification parts of sbt-pgp only make sense if they can verify plugins before they are loaded and as such cannot work without being patched into sbt or included in 'mothership' On 12 May 2016 8:55 pm, "eugene yokota" [email protected] wrote:
It's a term I use sometimes to refer to sbt, as opposed to the plugins. I've been an advocate for that for a while. See https://groups.google.com/d/msg/simple-build-tool/1Zq1Xa5_Ge4/Fikn3qJDVDQJ for example.
— You are receiving this because you authored the thread. Reply to this email directly or view it on GitHub https://github.com/sbt/sbt-pgp/issues/91#issuecomment-218867347
I guess you could import sbt-pgp after manually adding it to your classpath.
Thomas Grainger
On 12 May 2016 at 22:08, Thomas Grainger [email protected] wrote:
You could create a new addSbtPlugin function eg addSbtPlugin(plugin: Plugin, pgp: PgpFingerPrint)
That does the validation.
But you would still need to patch sbt before the plugins.sbt loaded.
Thomas Grainger
On 12 May 2016 at 21:05, Thomas Grainger [email protected] wrote:
The signature verification parts of sbt-pgp only make sense if they can verify plugins before they are loaded and as such cannot work without being patched into sbt or included in 'mothership' On 12 May 2016 8:55 pm, "eugene yokota" [email protected] wrote:
It's a term I use sometimes to refer to sbt, as opposed to the plugins. I've been an advocate for that for a while. See https://groups.google.com/d/msg/simple-build-tool/1Zq1Xa5_Ge4/Fikn3qJDVDQJ for example.
— You are receiving this because you authored the thread. Reply to this email directly or view it on GitHub https://github.com/sbt/sbt-pgp/issues/91#issuecomment-218867347