APT whitelist request for cvs

[henryju]

Needed to run ITs for https://github.com/SonarCommunity/sonar-scm-cvs

[BanzaiMan]

Ran tests and found setuid bits. See https://travis-ci.org/travis-ci/apt-whitelist-checker/builds/72229229.

[henryju]

I may be wrong but I feel this is not blocker:
http://arthurdejong.org/cvsd/faq.html#setgid

If my understanding is correct, under some situations cvs may try to use setuid. I guess it will fail in travis container for security reason. If this occurs I think this can be solved on user side by using appropriate configuration... Is there a way to do a test?

[tarzanek]

I'd need cvs for {OpenGrok, too
https://travis-ci.org/tarzanek/OpenGrok/builds/72817104
tia!
L

[tarzanek]

@BanzaiMan can this be added?
per your run it seems setguid behaviour here will properly be ignored, if no permissions were given ...
so I'd say it looks safe, @henryju already explained the details and they basically fit the code found by your checkers ...

[ustuehler]

cvs is also required for https://github.com/ustuehler/git-cvs. What's keeping it from being whitelisted? No setgid bit is set on the installed binaries:

$ ls -ld `dpkg -L cvs` | grep bin/
-rwxr-xr-x    1 root root 816368 Feb 17  2014 /usr/bin/cvs
-rwxr-xr-x    1 root root   2527 Feb 17  2014 /usr/bin/cvs-switchroot

[travisbot]

This is an automated comment.

Ran tests and found setuid bits by purely textual search. Further analysis is required.

If these are found to be benign, examine http://github.com/travis-ci/apt-package-whitelist/compare/test-apt-package-whitelist-153 and its PR.

Packages found: cvs

See https://travis-ci.org/travis-ci/apt-whitelist-checker/builds/440489549 for details.