Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Performance aside I was very disturbed to learn snap packages have no namespacing and no useful mandatory authorship metadata: https://forum.snapcraft.io/t/lack-of-package-provenance-is-a...

tl;dr -> HashiCorp's various tools exist as snaps but none are published by HashiCorp. All are out of date. Some have incorrect metadata. Few provide any clue as to who or where the upstream is. There's usually not even a way to contact the snap author to submit patches or ask for an upstream link. eg https://snapcraft.io/nomad



Yep, it's a massive smell. When I looked at installing a snap I wanted to audit the build script but I couldn't find that anywhere. That's a big NO from me.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: