Re: [PATCH 7/8] Makefile: don't delete dist tarballs directly by name

From: Ramsay Jones <ramsay@ramsayjones.plus.com>
Date: Nov 6, 2020, 01:44 UTC
Message-ID: <0cbe821b-092d-a5f9-e2ab-13a3c01e9a02@ramsayjones.plus.com>
In-Reply-To: <xmqqeel7h0aj.fsf@gitster.c.googlers.com>

On 05/11/2020 23:05, Junio C Hamano wrote:

> Junio C Hamano <gitster@pobox.com> writes:

[snip]

Show 16 quoted lines

>> Sorry, but I'd rather not to see such a longer-term "list of files
>> to be removed" on the filesystem.  This invites attackers to write a
>> rogue test addition that writes into ../../dist-tars something like
>> "~/.gitconfig" and wait for me to say "make clean".
> 
> Having said that, I also think that "make clean" target should help
> your desire to keep tarballs that would not have been generated by
> the current checkout (e.g. the last release), and I do not think
> 
> 	$(RM) git-htmldocs-*.tar.gz git-manpages-*.tar.gz
> 
> is an unconditionally better alternative to what you did in this
> step.
> 
> How about moving removal of these "distribution" artifacts that are
> created by "make dist$something" targets from "clean" to "distclean"?

I did have a patch #9 that moved the removal of the tarballs from the 'clean' target to the 'distclean' target (that is move the new 'iterate over the dist-tars file' code). However, I wasn't convinced that it was a better place for it.

Also, just moving the new removal code would not alter the concerns about it that you express above. So, we need to address that either way.

Thanks.

ATB, Ramsay Jones