apt-package-safelist

Hey Josh, An unrelated request: We’ve been waiting for a response to https://github.com/travis-ci/apt-package-whitelist/issues/19... for almost 2.5 years now, and no human ever looked at it. Is there anything we missed? Anywhere we should’ve also registered this request? Thanks

Even disregarding CPU bugs, Travis CI is a security disaster. Keep your secrets far away from it. * They use 32-bit id to retrieve an OpenPGP key (meaning that anybody can get their key added to the APT keyring): https://github.com/travis-ci/travis-build/pull/1269 * Here they are identifying OpenPGP keys with HTTP URLs (sometimes with 32-bit id, too): https://github.com/travis-ci/apt-source-whitelist/blob/maste... * But none of the above matters much, because they use APT with the --force-yes, which among other things, disables package authentication: https://github.com/travis-ci/travis-build/commit/c4d15425f7b... [I reported the --force-yes bug to the security team in October 2017, but AFAICS nothing changed nice then.] * https://github.com/travis-ci/apt-package-whitelist is just bizarre. They try to to detect "malicious or goofy bits" w

Travis is still on Ubuntu 14.04, but that ships with clang 3.4 and gcc 4.8, both of which support C++11 just fine, so yeah, I'm confused why 'ksherlock needs macOS. clang 3.4 even supports C++14 (gcc needs version 5; also you might want gcc 5 for the C++11 ABI changes to std::string and std::list). 'ksherlock, if you really want a newer compiler, I'd use http://apt.llvm.org/ . Specifically do something like sudo: required before_install: - curl https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add - - echo "deb http://apt.llvm.org/trusty/ llvm-toolchain-trusty main" | sudo tee /etc/apt/sources.list.d/llvm.list - sudo apt-get update - sudo apt-get install clang-6.0 which will get you the latest nightly build of the not-yet-released clang 6. Alternatively I think you can do it like this