> On Feb 4, 2019, at 1:27 AM, Alain D D Williams <a...@phcomp.co.uk> wrote:
>
> On Mon, Feb 04, 2019 at 10:23:46AM +0100, Frank H. Ellenberger wrote:
>>
>>
>> Am 04.02.19 um 09:40 schrieb Christian Stimming:
>>> Thanks for the pointer. I've copied this script into our git at
>>> ./util/obfuscate.pl
>>
>> While for most gnc-fq-* scripts we us
>> #!@-PERL-@
>> and adjust them while building.
>>
>> In utils all perl scripts are hardcoded to
>> #! /usr/bin/perl
>> Wouldn't it make sense to have them also configurable?
No, because gnc-fq-* are build products and util/*.pl are build tools. Since
obfuscate.pl isn't a build tool it doesn't belong in util; if we're going to
distribute it for users (and if we're not why put it in the repo at all?) then
it needs to go somewhere Cmake can find it and install it to
$CMAKE_INSTALL_PREFIX/bin or libexec and it needs to be renamed to
"gnc-xml-obfuscate".
>
> How about going:
>
> #! /usr/bin/env perl
That's widely regarded as a security hole, though it's also widely used. Since
it's trivial to override the shebang by calling the perl of your choice and
passing the script as $1 it's kind of pointless.
While we're on the topic of shebangs remember that they don't work on Windows.
Remember too that running this obfuscate script on Windows will require the
user to install perl. They might already have done so for Finance::Quote, but
lots of users don't use F::Q.
Regards,
John Ralls
_______________________________________________
gnucash-devel mailing list
gnucash-devel@gnucash.org
https://lists.gnucash.org/mailman/listinfo/gnucash-devel
