- Arch-projects - lists.archlinux.org

[arch-projects] [devtools] [GIT] The official devtools repository branch master updated. 20171108-9-g38c7a39
by bpiotrowski＠archlinux.org 23 Jan '18

23 Jan '18

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official devtools repository". The branch, master has been updated via 38c7a391b043547b946a99731a56a233458ba7a2 (commit) via 75ad2aca572d36c4df1b07153e2403534fbd89ed (commit) via aee72cae3231811058d6993d71f97e449e477d8f (commit) via 5ab8f8430a2c865656cd800c03ac21cb17a86d3c (commit) via c9e287e845973e4c04e21fc513caaea4907e604e (commit) via 48b2f8dcc49d88e60bd9e4ee97c92fea8ac90721 (commit) via 3b725b58434b92e93ff90164fae8d76c4761706a (commit) from 7a3c5085017987b6ef934cf9d9b098b4994ba21a (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 38c7a391b043547b946a99731a56a233458ba7a2 Author: Bartłomiej Piotrowski <bpiotrowski(a)archlinux.org> Date: Sun Jan 21 14:18:43 2018 +0100 makechrootpkg: make sure that makepkg.conf is always parsed as text commit 75ad2aca572d36c4df1b07153e2403534fbd89ed Author: Luke Shumaker <lukeshu(a)parabola.nu> Date: Mon Jan 15 17:57:00 2018 +0100 makechrootpkg: Adjust to work properly with `set -e` This worked properly until eab5aba. commit aee72cae3231811058d6993d71f97e449e477d8f Author: Luke Shumaker <lukeshu(a)parabola.nu> Date: Mon Jan 15 17:57:00 2018 +0100 lib/common.sh: Adjust to work properly with `set -u` Support for working with `set -u` was broken by 94160d6. Egg on my face; I'm the one who wants `set -u` support, and I'm the author of that commit! libmakepkg does not work with `set -u`; but mostly because of the include guards! So we just need to temporarily disable `set -u` (nounset) while loading libmakepkg. Instead of introducing a new variable, just store the initial nounset status in _INCLUDE_COMMON_SH; rather than a useless fixed-string "true". While we're at it, disable POSIX-mode (just in case we're running as "sh" instead of "bash"), since libmakepkg uses bash-isms that won't parse in POSIX mode. commit 5ab8f8430a2c865656cd800c03ac21cb17a86d3c Author: Luke Shumaker <lukeshu(a)parabola.nu> Date: Mon Jan 15 17:57:00 2018 +0100 arch-nspawn: Remove pointless $(echo ...) subshell commit c9e287e845973e4c04e21fc513caaea4907e604e Author: Luke Shumaker <lukeshu(a)parabola.nu> Date: Mon Jan 15 17:57:00 2018 +0100 arch-nspawn: make sure that makepkg.conf is always parsed as text https://lists.parabola.nu/pipermail/dev/2017-June/005576.html commit 48b2f8dcc49d88e60bd9e4ee97c92fea8ac90721 Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Sun Sep 3 03:53:40 2017 -0400 makechrootpkg: Fix anti-pattern when checking for enabled features Don't use error-prone logic e.g. foo=true; if $foo ... This completely fails to act as expected when the variable is unset because of unrelated bugs. While this merely causes the default behavior to be "false" rather than "true" in such cases, it is better to fail to enable explicitly requested behavior (which will be noticed by the user) than to simply upgrade to this behavior for free (which may not seem to have any obvious cause). Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> commit 3b725b58434b92e93ff90164fae8d76c4761706a Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Sun Sep 3 03:53:39 2017 -0400 makechrootpkg: Fix unconditionally running namcap Fixes regression in 2fd5931a8c67289a8a4acd327b3ce99a5d64c8c7 $run_namcap will always be set to "" `if $not_a_var; then ...; fi` is always truthful when $not_a_var is unset or equal to "" and the `then` clause will always be run. I'm not sure why global state variables need to be cloned locally for their sole explicit purpose. But for now this patch implements the minimum necessary work to properly pass the "do I want namcap" variable into prepare_chroot() according to the current logic flow. Note that I have still not thorougly tested makechrootpkg. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: arch-nspawn.in | 4 ++-- lib/common.sh | 4 +++- makechrootpkg.in | 10 +++++----- 3 files changed, 10 insertions(+), 8 deletions(-) hooks/post-receive -- The official devtools repository

1 0

[arch-projects] [devtools] [PATCH 0/7] Backports from Parabola v20180103
by Luke Shumaker 21 Jan '18

21 Jan '18

From: Luke Shumaker <lukeshu(a)parabola.nu> These are the commits in Parabola's developer tools v20180103 that are not in upstream devtools that I think are upstreamable. There's no real theme to them. Some of theme have been seen on this mailing list before. (I appologize that I waited 2 weeks to send this; I didn't send it right away, then I forgot.) Eli Schwartz (2): makechrootpkg: Fix unconditionally running namcap makechrootpkg: Fix anti-pattern when checking for enabled features Luke Shumaker (5): arch-nspawn: make sure that makepkg.conf is always parsed as text arch-nspawn: Remove pointless $(echo ...) subshell lib/common.sh: Adjust to work properly with `set -u` makechrootpkg: Adjust to work properly with `set -e` makechrootpkg: Put "keyserver-options auto-key-retrieve" in gpg.conf arch-nspawn.in | 4 ++-- lib/common.sh | 4 +++- makechrootpkg.in | 9 +++++---- 3 files changed, 10 insertions(+), 7 deletions(-) -- Happy hacking, ~ Luke Shumaker

3 15

[arch-projects] [devtools] Rebasing devtools32 to contribute upstream
by Luke Shumaker 20 Jan '18

20 Jan '18

Hi all, As the maintainer of Parabola's devtools, I know that with a merging workflow, it can be a huge pain to rebase out changes to have patchset that you can contribute upstream. If any of the Arch Linux 32 team ever decide that you want to contribute changes from devtools32 into upstream devtools, I expect that you will find the "lukeshu/rebase/archlinux32" branch of https://git.parabola.nu/packages/devtools-par.git/ to be useful. It is simply devtools32's "master" branch, rebased so that it looks like it used a rebasing workflow instead of a merging workflow. I'll generally keep it up-to-date as I keep an eye out for anything that I might want to backport into Parabola. (And indeed, there's already one such change https://lists.archlinux.org/pipermail/arch-projects/2018-January/004704.html ) -- Happy hacking, ~ Luke Shumaker

2 2

[arch-projects] [devtools] [PATCH] makechrootpkg: Do not copy the user keyring into the chroot.
by Eli Schwartz 15 Jan '18

15 Jan '18

Since commit 75fdff1811a0487f82c75b2e260da905102b4eea we no longer run integrity checks inside the chroot anyway, so this is no longer needed and will never be used. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- makechrootpkg.in | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/makechrootpkg.in b/makechrootpkg.in index 511e519..9c79171 100644 --- a/makechrootpkg.in +++ b/makechrootpkg.in @@ -180,12 +180,7 @@ prepare_chroot() { printf >>"$copydir/etc/group" 'builduser:x:%d:\n' "$builduser_gid" printf >>"$copydir/etc/passwd" 'builduser:x:%d:%d:builduser:/build:/bin/bash\n' "$builduser_uid" "$builduser_gid" - $install -d "$copydir"/{build,build/.gnupg,startdir,{pkg,srcpkg,src,log}dest} - - for x in .gnupg/pubring.{kbx,gpg}; do - [[ -r $USER_HOME/$x ]] || continue - $install -m 644 "$USER_HOME/$x" "$copydir/build/$x" - done + $install -d "$copydir"/{build,startdir,{pkg,srcpkg,src,log}dest} sed -e '/^MAKEFLAGS=/d' -e '/^PACKAGER=/d' -i "$copydir/etc/makepkg.conf" for x in BUILDDIR=/build PKGDEST=/pkgdest SRCPKGDEST=/srcpkgdest SRCDEST=/srcdest LOGDEST=/logdest \ -- 2.15.1

1 0

[arch-projects] [archweb] Licensing issues with JS code
by Adonay Felipe Nogueira 15 Jan '18

15 Jan '18

Hi all, I have an issue to report. However, please note that I'm not subscribed to this mailing list, so I'd recommend you to Cc me when replying. For a short description of the issue, see: [[https://labs.parabola.nu/issues/1405]] However, we must also note that Archweb is now newer than the Archweb release used by Parabola. Nonethless, as far as I know, each of the files still exist, although some of them don't even have license indication for the site's visitor (this is true for "visualize/static/visualize.js" and "mirrors/static/mirror_status.js"). In case of doubt, I might be able to help with some of the points described in the referenced issue. Respectfully, Adonay. -- - [[https://libreplanet.org/wiki/User:Adfeno]] - Palestrante e consultor sobre /software/ livre (não confundir com gratis). - "WhatsApp"? Ele não é livre, por isso não uso. Iguais a ele prefiro GNU Ring, ou Tox. Quer outras formas de contato? Adicione o vCard que está no endereço acima aos teus contatos. - Pretende me enviar arquivos .doc, .ppt, .cdr, ou .mp3? OK, eu aceito, mas não repasso. Entrego apenas em formatos favoráveis ao /software/ livre. Favor entrar em contato em caso de dúvida.

6 17

[arch-projects] [namcap] elffiles: Check for FULL RELRO
by Jelle van der Waa 14 Jan '18

14 Jan '18

Instead of checking for RELRO, check for FULL RELRO which is the default now. --- Namcap/rules/elffiles.py | 15 ++++++++++++--- namcap-tags | 2 +- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/Namcap/rules/elffiles.py b/Namcap/rules/elffiles.py index e2dd7f5..a336d18 100644 --- a/Namcap/rules/elffiles.py +++ b/Namcap/rules/elffiles.py @@ -137,10 +137,17 @@ class ELFGnuRelroRule(TarballRule): Introduced by FS#26435. Uses pyelftools to check for GNU_RELRO. """ - # not smart enough for full/partial RELRO (DT_BIND_NOW?) name = "elfgnurelro" - description = "Check for RELRO in ELF files." + description = "Check for FULL RELRO in ELF files." + + def has_bind_now(self, elffile): + for section in elffile.iter_sections(): + if not isinstance(section, DynamicSection): + continue + if any(tag.entry.d_tag == 'DT_BIND_NOW' for tag in section.iter_tags()): + return True + return False def analyze(self, pkginfo, tar): missing_relro = [] @@ -153,7 +160,9 @@ class ELFGnuRelroRule(TarballRule): continue elffile = ELFFile(fp) if any(seg['p_type'] == 'PT_GNU_RELRO' for seg in elffile.iter_segments()): - continue + if self.has_bind_now(elffile): + continue + missing_relro.append(entry.name) if missing_relro: diff --git a/namcap-tags b/namcap-tags index f967724..f464b9c 100644 --- a/namcap-tags +++ b/namcap-tags @@ -19,7 +19,7 @@ elffile-not-in-allowed-dirs %s :: ELF file ('%s') outside of a valid path. elffile-in-questionable-dirs %s :: ELF files outside of a valid path ('%s'). elffile-with-textrel %s :: ELF file ('%s') has text relocations. elffile-with-execstack %s :: ELF file ('%s') has executable stack. -elffile-without-relro %s :: ELF file ('%s') lacks RELRO, check LDFLAGS. +elffile-without-relro %s :: ELF file ('%s') lacks FULL RELRO, check LDFLAGS. elffile-unstripped %s :: ELF file ('%s') is unstripped. empty-directory %s :: Directory (%s) is empty error-running-rule %s :: Error running rule '%s' -- 2.15.1

1 0

[arch-projects] [namcap] elffiles: Add rule for no PIE binaries
by Jelle van der Waa 14 Jan '18

14 Jan '18

Verify if packages where build with PIE enabled by checking if it's an EY_DYN file with a DT_DEBUG entry. --- Namcap/rules/elffiles.py | 33 ++++++++++++++++++++++++++++++ Namcap/tests/package/test_elffiles.py | 38 ++++++++++++++++++++++++++++++++++- namcap-tags | 1 + 3 files changed, 71 insertions(+), 1 deletion(-) diff --git a/Namcap/rules/elffiles.py b/Namcap/rules/elffiles.py index e2dd7f5..a87c0db 100644 --- a/Namcap/rules/elffiles.py +++ b/Namcap/rules/elffiles.py @@ -194,4 +194,37 @@ class ELFUnstrippedRule(TarballRule): self.warnings = [("elffile-unstripped %s", i) for i in unstripped_binaries] +class NoPIERule(TarballRule): + """ + Checks for no PIE ELF files. + """ + + name = "elfnopie" + description = "Check for no PIE ELF files." + + def has_dt_debug(self, elffile): + for section in elffile.iter_sections(): + if not isinstance(section, DynamicSection): + continue + if any(tag.entry.d_tag == 'DT_DEBUG' for tag in section.iter_tags()): + return True + return False + + def analyze(self, pkginfo, tar): + nopie_binaries = [] + + for entry in tar: + if not entry.isfile(): + continue + fp = tar.extractfile(entry) + if not is_elf(fp): + continue + elffile = ELFFile(fp) + if elffile.header['e_type'] != 'ET_DYN' or not self.has_dt_debug(elffile): + nopie_binaries.append(entry.name) + + if nopie_binaries: + self.warnings = [("elffile-nopie %s", i) for i in nopie_binaries] + + # vim: set ts=4 sw=4 noet: diff --git a/Namcap/tests/package/test_elffiles.py b/Namcap/tests/package/test_elffiles.py index 6362a58..b11fa13 100644 --- a/Namcap/tests/package/test_elffiles.py +++ b/Namcap/tests/package/test_elffiles.py @@ -95,5 +95,41 @@ package() { ]) self.assertEqual(r.infos, []) -# vim: set ts=4 sw=4 noet: +class TestNoPieStack(MakepkgTest): + pkgbuild = """ +pkgname=__namcap_test_nopie +pkgver=1.0 +pkgrel=1 +pkgdesc="A package" +arch=('i686' 'x86_64') +url="http://www.example.com/" +license=('GPL') +depends=('glibc') +source=() +options=(!purge !zipman) +build() { + cd "${srcdir}" + echo "int main() { return 0; }" > main.c + /usr/bin/gcc -o main main.c -no-pie +} +package() { + install -D -m 644 "${srcdir}/main" "${pkgdir}/usr/bin/nopie" +} +""" + def test_nopie(self): + pkgfile = "__namcap_test_nopie-1.0-1-%(arch)s.pkg.tar" % { "arch": self.arch } + with open(os.path.join(self.tmpdir, "PKGBUILD"), "w") as f: + f.write(self.pkgbuild) + self.run_makepkg() + pkg, r = self.run_rule_on_tarball( + os.path.join(self.tmpdir, pkgfile), + Namcap.rules.elffiles.NoPIERule + ) + self.assertEqual(r.errors, []) + self.assertEqual(r.warnings, [ + ("elffile-nopie %s", + "usr/bin/nopie") + ]) + self.assertEqual(r.infos, []) +# vim: set ts=4 sw=4 noet: diff --git a/namcap-tags b/namcap-tags index f967724..420ad5c 100644 --- a/namcap-tags +++ b/namcap-tags @@ -17,6 +17,7 @@ directory-not-world-executable %s :: Directory (%s) does not have the world exec elffile-in-any-package %s :: ELF file ('%s') found in an 'any' package. elffile-not-in-allowed-dirs %s :: ELF file ('%s') outside of a valid path. elffile-in-questionable-dirs %s :: ELF files outside of a valid path ('%s'). +elffile-nopie %s :: ELF file ('%s') lacks PIE. elffile-with-textrel %s :: ELF file ('%s') has text relocations. elffile-with-execstack %s :: ELF file ('%s') has executable stack. elffile-without-relro %s :: ELF file ('%s') lacks RELRO, check LDFLAGS. -- 2.15.1

1 0

[arch-projects] [devtools] [GIT] The official devtools repository branch master updated. 20171108-2-g7a3c508
by foutrelis＠archlinux.org 27 Dec '17

27 Dec '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official devtools repository". The branch, master has been updated via 7a3c5085017987b6ef934cf9d9b098b4994ba21a (commit) from eab5aba9b027a7689acaf2382a04ff69b5b8771e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 7a3c5085017987b6ef934cf9d9b098b4994ba21a Author: Evangelos Foutras <evangelos(a)foutrelis.com> Date: Wed Dec 27 23:25:32 2017 +0200 Revert "makechrootpkg: Reopen console to assign the CTTY" This reverts commit ddd508efc083fc9beb6f2c96e2537521b31c1e6f. The underlying bug (FS#56529) was fixed in glibc 2.26-9. ----------------------------------------------------------------------- Summary of changes: makechrootpkg.in | 3 --- 1 file changed, 3 deletions(-) hooks/post-receive -- The official devtools repository

1 0

[arch-projects] [netctl] [GIT] Network control utility based on systemd branch master updated. 1.15-1-g2d7ec0b
by jouke＠archlinux.org 19 Dec '17

19 Dec '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "Network control utility based on systemd". The branch, master has been updated via 2d7ec0b8459c4d42b43da1b6727a91e701bfaadc (commit) from 196eb97585dfdbef297a7f47616f8ebed21693da (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 2d7ec0b8459c4d42b43da1b6727a91e701bfaadc Author: Jouke Witteveen <j.witteveen(a)gmail.com> Date: Tue Dec 19 14:48:35 2017 +0100 Technical documentation fixes ----------------------------------------------------------------------- Summary of changes: docs/netctl.profile.5.txt | 8 +++++--- src/lib/connections/README | 2 +- src/lib/dhcp/README | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) hooks/post-receive -- Network control utility based on systemd

1 0

[arch-projects] [devtools] [GIT] The official devtools repository branch master updated. 20171108-1-geab5aba
by anthraxx＠archlinux.org 12 Dec '17

12 Dec '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official devtools repository". The branch, master has been updated via eab5aba9b027a7689acaf2382a04ff69b5b8771e (commit) from 2a308821b3de179ca1946051d7733362ed45ed04 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit eab5aba9b027a7689acaf2382a04ff69b5b8771e Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Mon Oct 30 11:17:56 2017 -0400 Support reproducible builds Recent development versions of makepkg support reproducible builds through the environment variable SOURCE_DATE_EPOCH. Pass this variable through makechrootpkg to makepkg when available. Also initialize SOURCE_DATE_EPOCH whenever running archbuild to enforce reproducible builds for repository packages. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Levente Polyak <anthraxx(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: archbuild.in | 7 ++++++- lib/archroot.sh | 6 ++++-- makechrootpkg.in | 5 +++-- 3 files changed, 13 insertions(+), 5 deletions(-) hooks/post-receive -- The official devtools repository

1 0