New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

This annex should be archived. Only fully qualified repo names should be supported. #4

Open

alichtman opened this issue Nov 22, 2021 · 0 comments

Member

alichtman commented Nov 22, 2021 •

edited

Loading

I have two main complaints:

On the installation of a plugin without any slashes (/) in its name the annex will query the GitHub API searching for */{the-name}, sorting on stars.

It's non-deterministic. If zsh-users/plugin1 became more popular than zdhc/plugin1 overnight, you would then be installing two different configs. This seems bad, since configuration is often not perfectly compatible.
Security risk. It's possible to attack this mechanism by using bots / compromised users to star a malicious repo with a name of a popular zinit package.

Fully qualified repo names solve both issues.

The text was updated successfully, but these errors were encountered:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment