- doas(1) - portable version has about 500 lines of code
- doas(1) man pages - 157 lines long
- doas(1) had 2 CVEs
sudo(8)
- sudo(8) - about 120,000 lines of code (100x more)
- sudo(8) man pages - 10 000 lines long
- sudo(8) had 140 CVEs
The CVEs comparison is from 'all time' and as sudo(8) has longer history then doas(1) - it will (at least statistically) have more of these ... I expect doas(1) to have about 5-10 CVEs when they would have the same life span.
Comments
Why not just use doas(1) instead?
doas(1)
- doas(1) - portable version has about 500 lines of code
- doas(1) man pages - 157 lines long
- doas(1) had 2 CVEs
sudo(8)
- sudo(8) - about 120,000 lines of code (100x more)
- sudo(8) man pages - 10 000 lines long
- sudo(8) had 140 CVEs
The CVEs comparison is from 'all time' and as sudo(8) has longer history then doas(1) - it will (at least statistically) have more of these ... I expect doas(1) to have about 5-10 CVEs when they would have the same life span.
Regards,
vermaden