app-backup/restic: add 0.14.0

[stkw0]

No description provided.

[gentoo-bot]

Pull Request assignment

Submitter: @stkw0
Areas affected: ebuilds
Packages affected: app-backup/restic

app-backup/restic: @stkw0, @gentoo/proxy-maint

Linked bugs

Bugs linked: 830936, 630244, 868021

---

In order to force reassignment and/or bug reference scan, please append [please reassign] to the pull request title.

Docs: Code of Conduct ● Copyright policy (expl.) ● Devmanual ● GitHub PRs ● Proxy-maint guide

[gentoo-repo-qa-bot]

Pull request CI report

Report generated at: 2022-09-04 20:12 UTC
Newest commit scanned: 435ac4a
Status: ✅ good

There are existing issues already. Please look into the report to make sure none of them affect the packages in question:
https://qa-reports.gentoo.org/output/gentoo-ci/65ae6a0907/output.html

[juippis]

There's something weird going on with your commits and they can't be applied. Could you also fix the 0.14 bump so it immediately uses the vendor tarball, instead of adding 1000+ lines ebuild then fixing it in the next commit? :P

Overall the commits are a bit mixed up right now, but the outcome looks good.

[stkw0]

Sorry, seems after I sent the PR fixing it someone else fixed the same thing, hence the conflict. I will update it asap to resolve the conflict.

[gentoo-repo-qa-bot]

Pull request CI report

Report generated at: 2022-09-27 19:27 UTC
Newest commit scanned: 048a2b1
Status: ✅ good

There are existing issues already. Please look into the report to make sure none of them affect the packages in question:
https://qa-reports.gentoo.org/output/gentoo-ci/18b6f683b3/output.html

[Flowdalic]

Personally, I am not really happy that a high-profile and highly security sensible project, like restic, is using a third party, that is, neither Gentoo nor upstream, to obtain its source. Please consider asking upstream to provide an official vendor or dependency tarball.

[stkw0]

I don't see much of a problem because if someone changes the content of the vendor tarball portage will complain about it. But I understand that trusting another player is not ideal, so I've opened an issue to restic, see restic/restic#3945

[Flowdalic]

I don't see much of a problem because if someone changes the content of the vendor tarball portage will complain about it.

That's not the attack vector I had in mind. The problem is that it requires an enormous effort to audit the contents of the vendored or dependency tarballs for malicious code. And I'd like to keep the parties that are able to inject code in Gentoo's restic build to a minimum, considering that backup software like restic often runs with the highest privileges, or at least with CAP_DAC_READ_SEARCH.