HelloZeroNet / HelloZeroNet/ZeroNet
please do not depend on python-pip3 - security risk - use dependencies available from distribution package repositories
- 主要言語
- JavaScript
- スター
- 18.8k
- フォーク
- 2.3k
- PR マージ指標
- 30日以内にマージされた PR はありません
説明
Instructions on Linux currently require to run `sudo python3 -m pip install -r requirements.txt`. Please consider to drop this if possible.
python pip is a security risk since it does not verify software signatures on packages it downloads. It is also a third party package manager.
Previously a bitcoin wallet was hacked that depended on a third party package manager that didn't verify software signatures.
https://bitpay.com/blog/npm-package-vulnerability-copay/
Could you please use dependencies available from distribution package repositories such as packages.debian.org?
This is also a blocker for ever getting ZeroNet accepted into official packages.debian.org.
This is also a blocker for pre-installation of ZeroNet by default in Whonix.
Related packaging issues:
https://github.com/HelloZeroNet/ZeroNet/issues/382
https://github.com/HelloZeroNet/ZeroNet/issues/241
https://github.com/HelloZeroNet/ZeroNet/issues/1786
コントリビューションガイド
このリポジトリのコントリビューションガイドは索引されていません
調査の方向性
Start by locating the Linux installation instructions that tell users to run `sudo python3 -m pip install -r requirements.txt`, then review `requirements.txt` and the related packaging issues #382, #241, and #1786. Done means the documented dependencies can be obtained from distribution package repositories instead of requiring pip, with the Linux instructions updated accordingly.
索引モデルが issue の本文から書いたものです。
評価
- 技術スタック
- python
- 領域
- build-system
- issue の種類
- 機能追加
- 難易度
- 4/5
- 見積もり時間
- 3〜5日
- 活発さ
- 停滞
- 明瞭さ
- おおむね明確
- 初心者へのやさしさ
- 25/100