[Scons-users] Does remote caching open up any security vulnerabilities?

[Don Baldwin]

Thanks for the quick response Bill.  When you say we’ll have “lots of issues to contend with”, what exactly are you referring to?  Is Remote Caching generally thought to be more of a headache than it’s worth?

Thanks,
Don


From: Scons-users <scons-users-bounces at scons.org> On Behalf Of Bill Deegan
Sent: Thursday, September 22, 2022 12:15 PM
To: SCons users mailing list <scons-users at scons.org>
Subject: Re: [Scons-users] Does remote caching open up any security vulnerabilities?


WARNING: This email originated from outside of Qualcomm. Please be wary of any links or attachments, and do not enable macros.


On Thu, Sep 22, 2022 at 12:03 PM Don Baldwin <donb at qti.qualcomm.com<mailto:donb at qti.qualcomm.com>> wrote:
Hi,

What precautions are in place to prevent someone from modifying a cached file to inject nefarious code into a product?

Currently there are none.
If you're building software in such an environment, you have lots of issues to contend with in addition to someone altering the cachedir files.

Generally we don't check target file modification either (assuming nothing depends on a given target file as source to another builder).
Though in that case it would just case a rebuild of the target which depends on it, not a specific notice that it had been modified.

_Bill
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist4.pair.net/pipermail/scons-users/attachments/20220923/8cca1e4f/attachment.htm>