| 1 |
Zac Medico <zmedico@g.o> writes: |
| 2 |
|
| 3 |
> On 10/11/2011 10:28 PM, Mike Gilbert wrote: |
| 4 |
>> Francisco raised a possibly valid point in his original message: though |
| 5 |
>> packages may not be currently used for anything, but they could contain |
| 6 |
>> un-patched security flaws. |
| 7 |
> |
| 8 |
> If they contain something that's accessed at runtime, then they should |
| 9 |
> be in RDEPEND or PDEPEND, no exceptions. |
| 10 |
|
| 11 |
But is it not possible that the flaw in the build-time dependency causes |
| 12 |
an insecurity to be built into the dependent package and that both have |
| 13 |
to be rebuilt as part of the security fix? |
Archives