when we publish python package, we use pip, which will trigger setup.py to build some necessary packages.
I'm publishing a golang package, I wish when my user gets my package, it will auto trigger a makefile (some scripts to prepare environment) before installation. Is it possible?
CodePudding user response:
I wish when my user get my package, it will auto trigger an makefile (some scirpts) before installation.
That would allow you to execute arbitrary commands on my machine while I do some innocent looking go get github.com/yiw/totallyharmless
because I want to use that package.
Is it possible?
I hope not. This happened in the past (through clever cgo stuff) and was fixed as this is a major security issue.