From owner-freebsd-ports@freebsd.org Mon Feb 26 01:56:23 2018 Return-Path: Delivered-To: freebsd-ports@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 09ABBF03824 for ; Mon, 26 Feb 2018 01:56:23 +0000 (UTC) (envelope-from yuri@rawbw.com) Received: from shell1.rawbw.com (shell1.rawbw.com [198.144.192.42]) by mx1.freebsd.org (Postfix) with ESMTP id 92D157B92A for ; Mon, 26 Feb 2018 01:56:22 +0000 (UTC) (envelope-from yuri@rawbw.com) Received: from yv.noip.me (c-24-4-131-132.hsd1.ca.comcast.net [24.4.131.132]) (authenticated bits=0) by shell1.rawbw.com (8.15.1/8.15.1) with ESMTPSA id w1Q1uKRI014929 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO) for ; Sun, 25 Feb 2018 17:56:21 -0800 (PST) (envelope-from yuri@rawbw.com) X-Authentication-Warning: shell1.rawbw.com: Host c-24-4-131-132.hsd1.ca.comcast.net [24.4.131.132] claimed to be yv.noip.me Subject: Re: poudriere: "Permission denied" in the extract phase? To: freebsd-ports@freebsd.org References: <371FB508-F90E-41E4-8B3D-85F7DA54FFAA@adamw.org> From: Yuri Message-ID: Date: Sun, 25 Feb 2018 17:56:19 -0800 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Feb 2018 01:56:23 -0000 On 02/25/18 05:37, Marcin Cieslak wrote: > Yes, this is my private port that I am using to produce FreeBSD binaries > for node-sass. Getting binary npm modules into our ports tree is another conversation. > > The problem here is that a whole thing worked for me before for months > so I am aware of all those limitations for particular build phases > (it took me long to figure out that). npm is an extremely volatile technology. Some package might work now, and then break in a week due to a dependency package update. It continuously automatically updates files that are downloaded as dependencies. NodeJS is largely incompatible with the FreeBSD ports system because of this volatility. NodeJS is also a very insecure technology. It brings files directly from github without any vetting. So if somebody will update some github package with malware, it is extremely likely that next day this malware will end up on your production servers. There is nobody in between, you have to always trust hundreds of parties. Yuri