Alternative to Source Forge for Octave Packages (Was : Re: pdepe)

[Carlo De Falco]

On 29 May 2016, at 17:56, Carlo De Falco <address@hidden> wrote:
> ... I have been
> looking into the possibility of setting up a package distribution
> system alternative (or complementary) to OctaveForge or Agora, based
> on the example of Julia's package repository: http://pkg.julialang.org/
> 
> I think most of the features of that system are fairly easy to get,
> but I was stuck thinking at how to get the automatic test system working
> without security issues ...

On 29 May 2016, at 18:04, Nikola Yuroukov <address@hidden> wrote:
> What security issues do you anticipate with the automatic test system?

Carlo de Falco-2 wrote
> Essentially each package is an indepentent project on GitHub.
> 
> Whatever is in the project's release page is listed as the package 
> release on pkg.julialang.org.
> 
> If whatever is there is downloaded built and run for testing, 
> how can you prevent dangerous code from being run?

On 29 May 2016, at 21:13, Sebastian Schöps <address@hidden> wrote:
> I suggested exactly this idea at octconf based on my experience with
> homebrew but people did not like it.... no real releases, not free enough
> etc.

I believe an aggregator such as that used in http://pkg.julialang.org/ would 
overcome
most of those objections, also I was thinking about using BitBucket instead of 
GitHUB
to leave more choices in terms of VCS to package developrs.

Anyway, feedback from others on the list would be appreciaed on this topic so 
I'm moving
this discussion to a different thread.

c.