Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

addpkg(main/arti): 1.2.8 #21993

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

addpkg(main/arti): 1.2.8 #21993

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CODEOWNERS
View file
Open in desktop
Validating CODEOWNERS rules …
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,7 @@
/packages/mailutils/ @suhan-paradkar

# Packages owned by @thunder-coding
/packages/arti/ @thunder-coding
/packages/flyctl/ @thunder-coding
/packages/git-sizer/ @thunder-coding
/packages/gn/ @thunder-coding
Expand Down
36 changes: 36 additions & 0 deletions packages/arti/build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
TERMUX_PKG_HOMEPAGE=https://tpo.pages.torproject.net/core/arti/
TERMUX_PKG_DESCRIPTION="Arti is a work-in-progress project to write a full-featured Tor implementation in Rust."
TERMUX_PKG_LICENSE="Apache-2.0, MIT"
TERMUX_PKG_MAINTAINER="Yaksh Bariya <[email protected]>"
TERMUX_PKG_VERSION="1.2.8"
TERMUX_PKG_SRCURL="https://gitlab.torproject.org/tpo/core/arti/-/archive/arti-v${TERMUX_PKG_VERSION}/arti-arti-v${TERMUX_PKG_VERSION}.tar.gz"
TERMUX_PKG_SHA256=85dd949c4ac29d9b13f599c65de17dcd2b60ba6963dab27be7b5530a0bfe7675
TERMUX_PKG_DEPENDS="liblzma, libsqlite, openssl"
TERMUX_PKG_BUILD_IN_SRC=true

termux_step_pre_configure() {
termux_setup_rust
}

termux_step_make() {
cargo build --jobs $TERMUX_PKG_MAKE_PROCESSES --target $CARGO_TARGET_NAME --release --features full
}

termux_step_make_install() {
install -Dm755 -t $TERMUX_PREFIX/bin target/${CARGO_TARGET_NAME}/release/arti
install -Dm640 -t $TERMUX_PREFIX/etc/arti.d/arti.toml crates/arti/src/arti-example-config.toml
}

termux_step_create_debscripts() {
cat <<- EOF > ./postinst
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need some review especially for this post install script

echo
echo "-------------------------WARNING-------------------------"
echo
echo "Arti is an EXPERIMENTAL implementation of existing CTor."
echo
echo "It is not recommended to use Arti unless you know what you are doing. It may not be up to mark with existing ctor in terms of stability, performance and MOST IMPORTANTLY SECURITY. Use Arti only if you want to help find bugs in the software"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe something like:

Suggested change
echo "It is not recommended to use Arti unless you know what you are doing. It may not be up to mark with existing ctor in terms of stability, performance and MOST IMPORTANTLY SECURITY. Use Arti only if you want to help find bugs in the software"
echo "It is not recommended to use Arti unless you have previous experience with Tor."
echo "It may not be up to parity with existing ctor in terms of stability, performance and MOST IMPORTANTLY SECURITY."
echo "Treat Arti moreso as an experimental package provided to find bugs in the project."

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's not nearly strong enough. The warning here is that this implementation is WIP and may wildly fail to provide the guarantees you're expecting of tor.

@thunder-coding I can offer some tweaks to the language, but first: tor is probably the closest thing we ship to safety-critical software. People do things that risk physical harm using tor because they believe it's trustworthy. The devs of this implementation are extremely clear that you should not be using it yet unless you are actively developing tor. Presumably, you felt the loudly repeat that in a postinst because you are aware that packaging something implies a high degree of out-of-the-box readiness.

If the only people who should be using this are developers, why do you want to package this, and is it a good idea to do so? My immediate read on this situation is "heck no".

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, converting this PR to draft. Will keep on updating versions of arti as they come. Will start shipping this when Tor devs announce about declaring arti to be stable enough!

echo
echo "---------------------------------------------------------"
echo
EOF
}