Re: [Chicken-hackers] [patch] disallow slashes in egg names, ignore . and ..

[Peter Bex]

On Fri, Feb 24, 2012 at 09:33:22PM -0500, John Cowan wrote:
> Peter Bex scripsit:
> 
> > Let's not build complete omniscience of all crufty things of all OSes
> > Chicken runs on into chicken-install; 
> 
> No, no.  I'm referring to the server side.

Is it an issue at all?  Did you test it?

The locate-egg/local procedure in setup-download.scm contains
various checks like whether the target directory exists and
actually is a directory.  I'm pretty sure that crapload of
reserved names Windows has are mostly device aliases, which
means they're not directories.  Hence, it will already DTRT.

If you managed to get a local copy of an egg with a particular name,
by definition it means that that name is allowed under your OS;
it doesn't make sense to check that against a blacklist (which
by definition will always be incomplete).  Also, what if Redmond
decides to fix their OS and get rid of these reserved names?
We'd be stuck with their shitty legacy ~forever.

If you're saying a backslash should be disallowed just like
a regular slash, I think that's acceptable.  Other than that,
we should disallow these egg names only if it's really a problem.

> > the matter.  If there's an issue with an egg name under some OS, people
> > using that OS trying to install that egg can contact the egg author and
> > ask for a rename.
> 
> Don't forget that there are private henrietta installs, too.  At least
> I assume so from the security warning that just went out.

We don't know about that.  But since henrietta is just another egg,
that's definitely a possibility.  But again, if you managed to get
an egg with a funny name onto your system, henrietta should serve it
without complaining.

> > For example, if I release an egg which provides Scheme wrappers for
> > Unix-only functions (fork, kqueue, whatever), I wouldn't want to be
> > bothered with all the restrictions of that silly other thing that
> > calls itself an OS - my egg wouldn't even run on it in the first place!
> 
> That makes you want to call the egg "foo\:bar"?  

I might want to call it "hfs+".  You never know what someone wants to
call their egg, so let's not unneccessary restrictions.

Cheers,
Peter
-- 
http://sjamaan.ath.cx
--
"The process of preparing programs for a digital computer
 is especially attractive, not only because it can be economically
 and scientifically rewarding, but also because it can be an aesthetic
 experience much like composing poetry or music."
                                                        -- Donald Knuth