[tahoe-lafs-trac-stream] [tahoe-lafs] #2055: Building tahoe safely is non-trivial

[tahoe-lafs]

#2055: Building tahoe safely is non-trivial
-------------------------+-----------------------------------
     Reporter:  leif     |      Owner:  daira
         Type:  defect   |     Status:  new
     Priority:  normal   |  Milestone:  undecided
    Component:  unknown  |    Version:  1.10.0
   Resolution:           |   Keywords:  install security eggs
Launchpad Bug:           |
-------------------------+-----------------------------------

Comment (by leif):

 Thanks, killyourtv. I feel kind of terrible now, as your comment made me
 realize that even after my careful research writing this ticket I actually
 just published a script that was still unsafely installing tahoe. :(

 I did much of the testing in an environment with Tor configured to refuse
 all connections on port 80, but in the first version of
 [https://github.com/leif/tahoe-tails-utils/blob/master/bootstrap.sh my
 tails bootstrap script] which I published a couple hours ago I was
 foolishly operating under the assumption that setup.py on Tails wasn't
 able to connect to the internet because I saw some "Connection refused"
 lines. It turns out, Tails 0.19 sets the http_proxy environment variable
 but NOT https_proxy, so the errors I was seeing were only about the https
 connections. And, tahoe's setup.py only prints URLs when they fail. :(

 To anyone who ran that first version of the script, I apologize. Hopefully
 there aren't malicious Tor exits serving higher-numbered versions of Tahoe
 dependencies than tahoe-deps.tar.gz has. :(

-- 
Ticket URL: <https://tahoe-lafs.org/trac/tahoe-lafs/ticket/2055#comment:5>
tahoe-lafs <https://tahoe-lafs.org>
secure decentralized storage