kvark/mint

Source files distributed with executable bit set

silwol opened this issue · 3 comments

silwol commented

Many files in src and in the root directory published in 0.5.2 have the executable bit set. At Debian, we put the source files into a package, and the executable bit propagates into the package. Files having the executable bit set is strongly discouraged by Linux distributions due to security reasons if they aren't intended to get executed, so I got a lintian warning when attempting to package mint 0.5.2 for Debian.

kvark commented

I see. Sorry about this!
I keep it on a shared NTFS partition. I wonder what happens if one publishes on Windows - perhaps Cargo knows that no files need to be executable in this case. Perhaps, even filing a bug to cargo is needed. In the meantime, I can make sure this is published from ext4.

  • 👍1
silwol commented

I already suspected something like a shared filesystem might be the cause, because really all of the files had the executable bit (although I would have assumed a CIFS mount rather than NTFS).
I would really love to see this problem fixed at cargo level, but I think in some cases (e.g. shell scripts) it might make sense to intentionally set the executable bit, so it might be difficult to determine that in a way that is valid for all use cases. Not sure what the correct way forward would be in that case.