{"action":"created","issue":{"url":"https://api.github.com/repos/travis-ci/apt-package-whitelist/issues/416","labels_url":"https://api.github.com/repos/travis-ci/apt-package-whitelist/issues/416/labels{/name}","comments_url":"https://api.github.com/repos/travis-ci/apt-package-whitelist/issues/416/comments","events_url":"https://api.github.com/repos/travis-ci/apt-package-whitelist/issues/416/events","html_url":"https://github.com/travis-ci/apt-package-whitelist/issues/416","id":97154301,"number":416,"title":"APT whitelist request for libhdf5-dev","user":{"login":"BanzaiMan","id":25666,"avatar_url":"https://avatars.githubusercontent.com/u/25666?v=3","gravatar_id":"","url":"https://api.github.com/users/BanzaiMan","html_url":"https://github.com/BanzaiMan","followers_url":"https://api.github.com/users/BanzaiMan/followers","following_url":"https://api.github.com/users/BanzaiMan/following{/other_user}","gists_url":"https://api.github.com/users/BanzaiMan/gists{/gist_id}","starred_url":"https://api.github.com/users/BanzaiMan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BanzaiMan/subscriptions","organizations_url":"https://api.github.com/users/BanzaiMan/orgs","repos_url":"https://api.github.com/users/BanzaiMan/repos","events_url":"https://api.github.com/users/BanzaiMan/events{/privacy}","received_events_url":"https://api.github.com/users/BanzaiMan/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/travis-ci/apt-package-whitelist/labels/apt-whitelist-check-run","name":"apt-whitelist-check-run","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-07-24T21:50:04Z","updated_at":"2015-10-09T14:35:54Z","closed_at":null,"body":"This replaces travis-ci/travis-ci#4480.\n\nThe original text by @cancan101 follows\n\n------\n\nhttp://packages.ubuntu.com/trusty/libhdf5-dev\n      "},"comment":{"url":"https://api.github.com/repos/travis-ci/apt-package-whitelist/issues/comments/146890102","html_url":"https://github.com/travis-ci/apt-package-whitelist/issues/416#issuecomment-146890102","issue_url":"https://api.github.com/repos/travis-ci/apt-package-whitelist/issues/416","id":146890102,"user":{"login":"eschnett","id":213514,"avatar_url":"https://avatars.githubusercontent.com/u/213514?v=3","gravatar_id":"","url":"https://api.github.com/users/eschnett","html_url":"https://github.com/eschnett","followers_url":"https://api.github.com/users/eschnett/followers","following_url":"https://api.github.com/users/eschnett/following{/other_user}","gists_url":"https://api.github.com/users/eschnett/gists{/gist_id}","starred_url":"https://api.github.com/users/eschnett/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eschnett/subscriptions","organizations_url":"https://api.github.com/users/eschnett/orgs","repos_url":"https://api.github.com/users/eschnett/repos","events_url":"https://api.github.com/users/eschnett/events{/privacy}","received_events_url":"https://api.github.com/users/eschnett/received_events","type":"User","site_admin":false},"created_at":"2015-10-09T14:35:54Z","updated_at":"2015-10-09T14:35:54Z","body":"I am interested in this package as well, so I looked at these \"suspicious bits\". I am offering my findings here:\r\n- HDF5 is a well-known package. It works completely in user space, and in particular works fine if installed in one's home directory. To my knowledge, nothing in HDF5 requires or uses setuid or setgid.\r\n- The suspicious files that are flagged are generic wrappers that wrap many POSIX functions.\r\n- Neither setuid nor setgid, nor their wrappers (which simply have an \"H5\" prefix) are used anywhere in the code.\r\n- I have installed HDF5 many times myself. Mostly, this is a library (i.e. header files and static/shared libraries). There are also a few tools installed, and neither has any special file permissions or ownerships.\r\n- (For my work, header files and static libraries would suffice; these certainly would not have setuid/setgid problems.)\r\n"}}