Re: [gentoo-dev] Guidelines for dangerous USE flags

2017-08-25 Thread William Hubbs
On Thu, Aug 24, 2017 at 11:22:24AM -0400, Michael Orlitzky wrote: > On 08/22/2017 02:44 PM, Robin H. Johnson wrote: > > From a Gentoo Infrastructure team perspective, we'd strongly prefer USE > > flags, because that fits better into existing configuration management > > tools, almost none of which

Re: [gentoo-dev] Guidelines for dangerous USE flags

2017-08-24 Thread Michael Orlitzky
On 08/22/2017 02:44 PM, Robin H. Johnson wrote: > From a Gentoo Infrastructure team perspective, we'd strongly prefer USE > flags, because that fits better into existing configuration management > tools, almost none of which have handling for EXTRA_ECONF or rebuilding > after EXTRA_ECONF changes (r

Re: [gentoo-dev] Guidelines for dangerous USE flags

2017-08-22 Thread Robin H. Johnson
On Tue, Aug 22, 2017 at 01:22:51PM -0400, Michael Orlitzky wrote: > 1) require EXTRA_ECONF to enable it. > 2) hide it behind a masked USE flag. > > Both options require about the same amount of work from the user, namely > editing something under /etc/portage. What do y'all think is the best >

Re: [gentoo-dev] Guidelines for dangerous USE flags

2017-08-22 Thread Sven Vermeulen
On Tue, Aug 22, 2017 at 01:22:51PM -0400, Michael Orlitzky wrote: > The net-analyzer/nrpe package has a ./configure flag: > > --enable-command-args allows clients to specify command arguments. *** > THIS IS A SECURITY RISK! *** Read the SECURITY >

[gentoo-dev] Guidelines for dangerous USE flags

2017-08-22 Thread Michael Orlitzky
The net-analyzer/nrpe package has a ./configure flag: --enable-command-args allows clients to specify command arguments. *** THIS IS A SECURITY RISK! *** Read the SECURITY file before using this option! Back in nrpe-2.x, it was available via USE=c