Talk about how the Invirtibuilder is insecure.

[invirt/packages/invirt-dev.git] / invirt-submit-build

diff --git a/invirt-submit-build b/invirt-submit-build
index caa949f..42446b0 100755 (executable)
--- a/invirt-submit-build
+++ b/invirt-submit-build
@@ -35,7 +35,7 @@ def main():
                                      uuid.uuid4()))
 
     try:
-        validateBuild(pocket, package, commit)
+        b.validateBuild(pocket, package, commit)
     except b.InvalidBuild, e:
         print >>sys.stderr, "E: %s" % e
         sys.exit(1)
@@ -43,9 +43,10 @@ def main():
     # To keep from triggering the Invirtibuilder before we've actually
     # written the file out, first write the queue entry to a temporary
     # file, and then move it into the queue directory.
-    q = tempfile.NamedTemporaryFile(delete=False)
+    q_fd, q_name = tempfile.mkstemp()
+    q = os.fdopen(q_fd, 'r+')
     print >>q, "%s %s %s %s" % (pocket, package, commit, principal)
-    os.rename(q.name, q_path)
+    os.rename(q_name, q_path)
 
 
 if __name__ == '__main__':