On Wed, Aug 13, 2008 at 09:12:01AM +0200, Aniruddha wrote: > I'm not worried about purposeful malicious intent (otherwise I would > just use a chroot). I want to prevent an accidentally badly build deb > from wrecking my system.
Seiously, this is going 'round-and'round. The true answer was given 2
days ago and still applies now.
If you don't trust the source of the deb, don't install it. Period.
There are many methods of checking what debs might do but many of them really
are you checking source. However instead of source of the program it's source
of the deb. You're pitting your knowledge and expertise against the
maintainer of the deb and, to be perfectly honest, if you cannot answer this
question nor accept the answers given after 3 days of spinning your wheels
then the chances of you catching anything other than the most obvious of
errors are nil. Obvious errors, btw, that are most likely caught by the deb
maintainer in the testing and build process.
If you are really, really, REALLY worried about the integrity of your
system and not going to take the advice of not installing debs you don't trust
here's the only answer for you.
Install VirtualBox, build a test machine, put your normal packages on
there, archive the image, get the deb and install it. If the VM isn't borked
it's clear, rearchive the updated image, install the deb on your real machine.
If it is borked, unpack the image to get back to a clean test environment.
That is the only practical way to test the stability of debs in the manner
you're looking for because it is no longer you trying to theorize what might
happen. It is now you directly observing what does happen. A far easier
thing to do.
--
Steve C. Lamb | I'm your priest, I'm your shrink, I'm your
PGP Key: 1FC01004 | main connection to the switchboard of souls.
-------------------------------+---------------------------------------------
signature.asc
Description: Digital signature
