[ On Thursday, October 10, 2002 at 03:11:06 (+0900), itojun@iijlab.net wrote: ]
> Subject: GNU tar
>
> >Why is this being done?  Why isn't GNU Tar being purged entirely?  It is
> >of no use on NetBSd any longer.  It can be solely an add-on package.
> 
> 	there are batch of security holes found for GNU tar, and we still
> 	don't have the replacement (like tar-compatible pax).

Yes, you do have a replacement.  The 'tar' front end to NetBSD's pax is
now compatible enough for all remaining uses of "tar" in NetBSD.  I have
built and used locally generated releases entirely without GNU Tar for
almost two years now with only minor local patches.

There's already been some past discussion about booting GNU Tar out too.

As you've found out the GNU Tar that had been used in NetBSD was very
out of date w.r.t. the maintained version anyway.

>       what do you
> 	mean by "no use"?

There is no need to use an integrated GNU Tar in NetBSD any longer.

I and others have posted minor patches to whatever things are slightly
off the beaten track, well everything but pkgsrc, but I could probably
whip up a master patch with all the tar-related changes in my pkgsrc
tree in short order.  Some get rid of uses of 'tar', and others simply
convert to explicit use of 'gtar' and add an appropriate pkg
dependency.  That won't cover everything since I don't use much more
than about 15-25% of pkgsrc, but it'll give enough of a head start that
the conversion of the remainder would be a mostly mechanical task.

>       can we ship netbsd without /usr/bin/tar?

Well really it should be /bin/tar, but that's a separate issue.  :-)

(and actually it might have to be since that's where 'pax' properly
lives anyway, and the tar front-end is just a hard link -- that's what
I've been doing since booting out GNU tar anyway)

-- 
								Greg A. Woods

+1 416 218-0098;            <g.a.woods@ieee.org>;           <woods@robohack.ca>
Planix, Inc. <woods@planix.com>; VE3TCP; Secrets of the Weird <woods@weird.com>