-
Notifications
You must be signed in to change notification settings - Fork 162
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Release zips have the tarbomb problem #517
Comments
With the launcher coming up, it's kinda "too late now," because we'd have to rezip every single update on every single platform. With it however, this isn't something that you'll have to worry about. Apologies for the inconvenience! |
I wouldn't expect you to fix old releases if that's what you mean, just the new ones. Or are you saying that the launcher is going to use these zips and expects them the way they are? I imagine you could automate redoing all the zip files if needed rather than doing it by hand. Is there somewhere I can read more about how the launcher is planned to work? I guess maybe you'd download one executable instead of an archive and then it would handle grabbing the rest of the game files over the internet or something. If that's how it worked it might be worse for portability in scenarios with no network connection, like throwing the files on a flash drive to easily set up on another machine wherever you are. |
Portable versions of YARG will still be available, however, stuff like the setlist can only be downloaded through the launcher for security, and in the future, the launcher will probably be a requirement to prevent cheating when leaderboards are added. You can see the launcher here at its current state. This probably won't be fixed, as it's probably a minor inconvenience at worst. Apologies again for said inconvenience. |
https://en.wikipedia.org/wiki/Tar_(computing)#Tarbomb
The problem: The release zip contains a bunch of "loose files" which will litter the current directory, be hard to keep track of, and can overwrite other files with the same name.
The solution: Create a directory inside the release zip files that holds all of this stuff so that if someone were to run
unzip YARG_v0.10.7-Linux-x86_64.zip
or similar, they would just get one new file, a directory containing all the stuff from the release, instead of several files. This new directory could be named the same as the release zip, likeYARG_v0.10.7-Linux-x86_64
, or it could just be something generic likeYARG
.There are workarounds to this issue implemented in stuff like 7zip where you can extract an archive to a new directory with the same name as the archive, but having to do this is not ideal, and this is not as trivial to do from the command line. You also need to know you're dealing with a tarbomb to know to do that instead of something like the "extract here" right click options, which would give you the same problem as unzipping from the CLI.
The text was updated successfully, but these errors were encountered: