Void-packages injecting other packages : voidlinux@lemmy.ml

submitted 2 weeks ago by 404@lemmy.zip to c/voidlinux@lemmy.ml

5 comments fedilink hide all child comments

Example: The ZLS (Zig Language Server) package installs Tracy Profiler. Wth.

sorted by: hot top controversial new old

[–] gid@piefed.blahaj.zone 3 points 2 weeks ago (1 child)

This isn't the best way to bundle that dependency, but I don't see anything malicious here.

[–] 404@lemmy.zip [S] 3 points 2 weeks ago

Good find.

This should really be cleaned up though. Optional dependencies should not be installed undisclosed like this.

parent

[–] fozid@lem.radiantfig.fyi 1 point 2 weeks ago (2 children)

Does xbps-install not prompt you to confirm you want all packages installed? So zls and Tracy?

[–] gid@piefed.blahaj.zone 1 point 2 weeks ago (1 child)

Not if a separate executable is bundled into the zls package, which is what this template does.

parent

[–] fozid@lem.radiantfig.fyi 1 point 2 weeks ago

Ah ok, didn't realise this was regards templates for source packages. 👍

parent