Stop using code in other repos #141

New issue

Open

opened 2018-12-13 16:52:57 -08:00 by luciusbono · 0 comments

luciusbono commented

2018-12-13 16:52:57 -08:00

(Migrated from github.com)

We do two sketchy things in our build. We pull down python scripts from forked repos, pin their commit hashes and execute them via curl:

mozilla/dinobuildr@b58ee985a4/repo/dock-config.sh (L17-L27)

mozilla/dinobuildr@b58ee985a4/repo/wallpaper.sh (L48-L53)

While this is "safe" enough for our purposes, since the repos are forked and we hash pin, we should stop doing this altogether because we can't lint these scripts.

Of course, we also can't lint binaries that we pull down for our build, but this seems like a thing we could stop doing and it would make the build easier to understand. I believe the best solution is to simply pull these scripts into dinobuildr, and make dinobuildr understand how to natively execute python.

We do two sketchy things in our build. We pull down python scripts from forked repos, pin their commit hashes and execute them via curl: https://github.com/mozilla/dinobuildr/blob/b58ee985a4a3fb93cbcdbc346c135abb4531deb1/repo/dock-config.sh#L17-L27 https://github.com/mozilla/dinobuildr/blob/b58ee985a4a3fb93cbcdbc346c135abb4531deb1/repo/wallpaper.sh#L48-L53 While this is "safe" enough for our purposes, since the repos are forked and we hash pin, we should stop doing this altogether because we can't lint these scripts. Of course, we also can't lint binaries that we pull down for our build, but this seems like a thing we could stop doing and it would make the build easier to understand. I believe the best solution is to simply pull these scripts into dinobuildr, and make dinobuildr understand how to natively execute python.