Re: [libvirt PATCH 15/28] build: add nft to the list of binaries we attempt to locate

On 5/4/23 4:33 AM, Andrea Bolognani wrote: Are we? What's the huge list of "optional programs" in meson.build then? I don't have any problem with doing all binary-location at runtime, as long as we don't think there's any potential security problem / bug that could arise from having a different binary with the same name added in some place earlier in $PATH (is that why we started canonicalizing binary paths during the build?) Thanks to the way g_find_program_in_path() was written, code later in this series that checks to see which binaries are available will work properly, whether or not the binary name was canonicalized during build, so making such a change won't have any effect on that. I was being ultra-conservative about the change, making it opt-in for the distros for now at least. But I'm also fine with making it opt-out Yeah, *somebody* has to start pulling the plug on it (actually firewalld has had nftables support for a long time, and I think it's probably the default although I haven't checked). It is really amazing how many people still automatically talk about iptables when they talk about filtering network traffic :-/