Re: gEDA-user: Garchive utility

[sdb@cloud9.net (Stuart Brorson)]

> > 3.  Do a "make && make install" in your scripts directory.  You should
> > now be ready to use garchive.
> 
> I did run in to this problem:
> =20
> /opt/gEDA/bin/garchive: /usr/local/bin/python: bad interpreter: No such fil=
> e=20
> or directory

Fixed now in the source available on the website.

> >Garchive automatically archives gschemrc and garchiverc (or the equivalent
> >specified by the -f flag on the command line).  If these files are missing,
> >garchive will be confused.

> Could it not just assume they exists in that case?  I don't like the idea
> of adding yet more files to maintain.

That's an interesting idea.  In both cases, the prog should first
check to see if they are there, and if they are not, the prog could
create them.  They would start off as just empty files.  

Note that gschemrc *should* already exist if you've been running
gschem in that directory.  Garchiverc is another matter.

I will probably make this change the next time I update garchive.py
(i.e. "Real Soon Now").

> Also the run states "file created in /tmp".  Any security risks there?

I thought about that a little bit while crafting the prog.  Lots of
progs create temporary files in the /tmp directory; that's why it is
there.  All users have rwx permission in the /tmp directory, at least
for files which they own.  I decided to let garchive create/copy all
files to archive to /tmp before tar'ring them all up in order to avoid
trashing things in your local directory.   

As for security, I couldn't think of any way garchive could be used to
comprimise a system.  Three points:

1.  It's not a daemon which runs continually, so hackers can't find it
running on your system & exploit it.

2.  It doesn't run with root permission, so it isn't able to do
anything powerful, or mess with anybody else's files or directories.

3.  It's a Python script, so it is as secure as your Python
interpreter.  Since Python is a user-level app, you can't really do
anything bad with it.  Anyway, if you were a malicious hacker, and
you had access to garchive, you'd also be able to write your own
Python scripts.  In that case, I'd expect that you'd rather just write
your own hacking scripts instead of messing around with a weenie
archive app for hardware geeks  :-)

Stuart