Add 'no-resolved-manifest' option#406
Add 'no-resolved-manifest' option#406GeorgesStavracas wants to merge 1 commit intoflatpak:masterfrom
Conversation
e2e2eda to
b702deb
Compare
|
I really don't know if this is enough to prevent the creation of |
b702deb to
a26168c
Compare
Some applications have security tokens passed by their build system. In these cases, having the resolved manifest file distributed with the sandbox is a security issue. Add an option to not create the resolved manifest file.
a26168c to
eb1d03d
Compare
|
I think this is a bit heavy handed disabling the entire manifest. Maybe we could just have a |
|
Would some sort of "secret sources" have a slightly lower risk of ending up embedded inside? (I'd hope random build tasks aren't embedding the entire environment, but I have unfortunately seen that before...) |
Hm, could you please expand this idea? Specifically, how would it be propagated to the compile flags of a specific module? |
Well its an env var, so Obviously you still need to have secure build infra that doesn't leak build logs and such. |
Some applications have security tokens passed by their build system. In these cases, having the resolved manifest file distributed with the sandbox is a security issue.
Add an option to not create the resolved manifest file.