Re: "downloads during build" pkg fail reason

[maya%netbsd.org@localhost]

On Tue, Apr 23, 2019 at 03:20:29PM +0530, Mayuresh wrote:
> wip/py-chemlab has this:
> 
> BROKEN=                "downloads during build (distribute_setup.py)"
> 
> What do we do in such situations anyway? There may have been such packages
> before.
> 
> What are the implications (to pkgsrc build process and to security etc) if
> a package does so?
> 
> Mayuresh

We keep local copies of downloads and verify that they are the same as
the time in the commit. it poses higher risk tot he user if the files
could be modified without us noticing. there have been cases of servers
getting compromised for example.