[OLPC Security] find_bundle, etc in util/bundle.py

[Marcus Leech]

Michael Stone wrote:
> Marcus,
>
> I'm ambivalent on this issue; in fact, the patch that I just submitted
> to @sugar for review contains some hunks explicitly designed to allow
> rainbow to launch bundles without parsing the activity.info file at all.
>   
OK, but rainbow needs to have the capabilities information *somewhere*
(passed in a DBUS message from sugar?).
  I'm still nervous about forgeries on DBUS, particularly for
security-sensitive information.
> I certainly agree that we need security records for each
> activity-version that we want to launch - but it's not clear to me that
> my initial idea that these be encoded in the activity.info file was a
> good one. In particular, the activity.info format is not particularly
> good at recording the firewall rules.
>
> More recent work on this subject is recorded at 
>
>   users/krstic/installer 
>   
Could you disambiguate this URL please? :-)

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 251 bytes
Desc: OpenPGP digital signature
Url : http://lists.laptop.org/pipermail/security/attachments/20071105/9780fc58/attachment.pgp