From owner-freebsd-security@FreeBSD.ORG Tue Nov 20 17:19:57 2012 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 38397CF0 for ; Tue, 20 Nov 2012 17:19:57 +0000 (UTC) (envelope-from rwmaillists@googlemail.com) Received: from mail-bk0-f54.google.com (mail-bk0-f54.google.com [209.85.214.54]) by mx1.freebsd.org (Postfix) with ESMTP id B1B3F8FC0C for ; Tue, 20 Nov 2012 17:19:56 +0000 (UTC) Received: by mail-bk0-f54.google.com with SMTP id je9so1936635bkc.13 for ; Tue, 20 Nov 2012 09:19:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=date:from:to:subject:message-id:in-reply-to:references:x-mailer :mime-version:content-type:content-transfer-encoding; bh=e34T3KpH0tCVJzSF4OW/ZCho4FiYQyCwdi6GJ5mft/E=; b=QXpYo366U8J/uUMt41EjljOynr1YB10Lh9kK4Dm6tP9H7R0/QX4hCkjoscPmxiqSzc GkQIb59tdBmq65UrmwL+7Zayku+vrhqtx8Y8KUfM7qwqAip6JHoRIzSAwBIIsRYlBJGo NErw7vX5mC2E2EgcEUcOXxyyYjbLv/t/QoCguktj9Y0PGFsNZriaR2I9ppyetr3BjgXD sUiRduaqjGTenBxYQ4oBeTtwN5lcXRRwu4SURGfFVm4WMEw7hmnSEwB99wT64waYwtHn oNrSfjiG2nvjvG4egbJ+XnCxEjFYPfo/94c/CP+soSp7RXyMp5gfZ/A6SQCmbrHWH8Zr 0mqA== Received: by 10.204.5.135 with SMTP id 7mr3522929bkv.48.1353431995618; Tue, 20 Nov 2012 09:19:55 -0800 (PST) Received: from gumby.homeunix.com (87-194-105-247.bethere.co.uk. [87.194.105.247]) by mx.google.com with ESMTPS id f24sm4854938bkv.7.2012.11.20.09.19.54 (version=SSLv3 cipher=OTHER); Tue, 20 Nov 2012 09:19:54 -0800 (PST) Date: Tue, 20 Nov 2012 17:19:51 +0000 From: RW To: freebsd-security@freebsd.org Subject: Re: Recent security announcement and csup/cvsup? Message-ID: <20121120171951.5496e29e@gumby.homeunix.com> In-Reply-To: <20121120124718.GB93826@roberto-aw.eurocontrol.fr> References: <20121117150556.GE24320@in-addr.com> <20121118180421.GF24320@in-addr.com> <20121120100148.GA93826@roberto-aw.eurocontrol.fr> <20121120124718.GB93826@roberto-aw.eurocontrol.fr> X-Mailer: Claws Mail 3.8.1 (GTK+ 2.24.6; amd64-portbld-freebsd8.3) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Nov 2012 17:19:57 -0000 On Tue, 20 Nov 2012 13:47:19 +0100 Ollivier Robert wrote: > According to Mohacsi Janos on Tue, Nov 20, 2012 at 12:45:19PM +0100: > > Dear Ollivier and all, > > I have problem with the portsnap: I maintain a private > > "repository" under the /usr/ports: There is a /usr/ports/tmp where > > I store new ports to be tested, and submitted. The portsnap is > > removing unrecognized local files. > > This is the main issue most preople have with portsnap, yes. > >... > I don't know what portsnap does with things like .svn/.hg (from > different VCS). If it does not remove them, use hg/git/svn to > "merge" from the official portsnap tree into your own. If it does, > just rsync periodically from portsnap into your /usr/ports. AFAIK portsnap only removes local files that are under port directories and only does that during an initial extract. On normal updates it doesn't delete local files at all. IMO file deletion is not a significant problem. The more serious problem is that it only updates that which has changed in the repository. csup reverts any changes, so patches can be re-applied unconditionally.