[BIGTOP-1796] Replace puppet toolchain installation with a SANE solution, not involving unzippping of unsiged data to the root folder

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: build
• Labels: security
• Assignee: Unassigned
• Reporter: Erich Schubert
• Created: 01/Apr/15 13:12
• Updated: 14/Apr/15 11:46

Description

The way the build toolchain is installed is just INSANE.

Puppet 3.x and root required, are you serious?

It's okay if people need to install some prerequisites, but this should not involve automagic execution of lines deeply hidden like this:

'/bin/bash -c "wget http://www.scala-lang.org/files/archive/scala-2.10.3.deb ; dpkg -x ./scala-2.10.3.deb /"'

From:
https://github.com/apache/bigtop/blob/4f875876f924c17b62a6ce53249c2c31aa738602/bigtop_toolchain/manifests/scala.pp

This is SILLY

Note that "dpkg -x" EXTRACTS the contents of this UNSIGNED package to the ROOT FOLDER. Instead of actually installing the package in a way that it could be cleanly uninstalled afterwards; without executing installation scripts, but also without any signature checking. In other words, this is a security issue during build. It's NOT EVEN https, yet GPG signed.

This is a very SILLY idea

No wonder the Linux distributions don't adopt the packages into the distributions. This build process is an ugly collection of hacks!

This should be deleted, and completely rewritten from scratch, sorry to be so blunt.

Issue Links

• is related to: BIGTOP-1830 Move apache-forrest installation from bigtop_toolchain to pig compile