Re: [PATCH 7/8] Makefile: don't delete dist tarballs directly by name

From: Junio C Hamano <gitster@pobox.com>
Date: Nov 5, 2020, 22:01 UTC
Message-ID: <xmqqr1p7h38t.fsf@gitster.c.googlers.com>
In-Reply-To: <48fdd198-93ad-7282-27e6-9a0c6de93067@ramsayjones.plus.com>

Ramsay Jones <ramsay@ramsayjones.plus.com> writes:

Show 21 quoted lines

> diff --git a/.gitignore b/.gitignore
> index 6232d33924..425b8cc2a4 100644
> --- a/.gitignore
> +++ b/.gitignore
> @@ -191,6 +191,7 @@
>  /gitweb/static/gitweb.min.*
>  /config-list.h
>  /command-list.h
> +/dist-tars
>  *.tar.gz
>  *.dsc
>  *.deb
> diff --git a/Makefile b/Makefile
> index 90e91a2185..bc9ce28bc3 100644
> --- a/Makefile
> +++ b/Makefile
> @@ -3083,6 +3083,7 @@ dist: git-archive$(X) configure
>  		--prefix=$(GIT_TARNAME)/ HEAD^{tree} > $(GIT_TARNAME).tar
>  	@$(RM) -r .dist-tmp-dir
>  	gzip -f -9 $(GIT_TARNAME).tar
> +	@echo $(GIT_TARNAME).tar.gz >>dist-tars

Sorry, but I'd rather not to see such a longer-term "list of files to be removed" on the filesystem. This invites attackers to write a rogue test addition that writes into ../../dist-tars something like "~/.gitconfig" and wait for me to say "make clean".