Hi zimoun, On +2020-01-22 01:22:45 +0100, zimoun wrote: > Dear Bengt, > > The bug report [1] points out files with unexpected permission; based > on extension filename. > > [1] https://debbugs.gnu.org/cgi/bugreport.cgi?bug=38422 > > > It is not an security issue or the Guix packager did not carefully > check the validity of these files. > > If you are security paranoid, you *have to* check by yourself all the > files using "guix build -S" because in paranoid mode you cannot trust > Guix packagers (and Guix committers neither). > > > In normal mode, 2 options: > > a- propose a patch to change the permission for each offending package > b- report upstream > > Well, at least these 3 packages docbook-xsl, faba-icon-theme, and > moka-icon-theme comes with unexpected .png file permission. > > > On the long term, I am not convinced that adding automatic check and > permission change based on filename extension would really add Quality > Assurance. Because we are speaking about quality, not security. > > > I am inclined to close this bug. What do you think? > > All the best, > simon
Ok with me to close, thanks. -- Regards, Bengt Richter
