July 2021 - Pacman-contrib - lists.archlinux.org

[PATCH] Add pacman-syncdb: systemd service and timer for `pacman -Fy`.
by Thiago Perrotta 03 Aug '21

03 Aug '21

From: Thiago Perrotta <tbperrotta(a)gmail.com> `pacman -Fy` is a modern replacement for `pkgfile`[1]. This service/timer makes `pacman -Fy` have feature parity with `pkgfile`. The unit files were based on both pkgfile and paccache, for consistency with the existing ecosystem. Context: https://bbs.archlinux.org/viewtopic.php?pid=1981076 [1]: https://wiki.archlinux.org/title/Pacman#Search_for_a_package_that_contains_… Signed-off-by: Thiago Perrotta <tbperrotta(a)gmail.com> --- CHANGES.md | 1 + src/Makefile.am | 8 ++++++-- src/pacman-syncdb.service.in | 12 ++++++++++++ src/pacman-syncdb.timer | 10 ++++++++++ 4 files changed, 29 insertions(+), 2 deletions(-) create mode 100644 src/pacman-syncdb.service.in create mode 100644 src/pacman-syncdb.timer diff --git a/CHANGES.md b/CHANGES.md index 80f02bb..96a441b 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -6,6 +6,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0. ## [Unreleased] ### Added +- pacman-syncdb: systemd service and timer for `pacman -Fy` (https://bbs.archlinux.org/viewtopic.php?pid=1981076) ### Changed diff --git a/src/Makefile.am b/src/Makefile.am index eef0590..cbc8bd0 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -30,7 +30,8 @@ vim_syntax__DATA = \ systemd_dir = ${libdir}/systemd/system systemd__DATA = \ - paccache.service paccache.timer + paccache.service paccache.timer \ + pacman-syncdb.service pacman-syncdb.timer BASHSCRIPTS = \ checkupdates \ @@ -50,7 +51,8 @@ OURSCRIPTS = \ $(PERLSCRIPTS) OURFILES = \ - paccache.service + paccache.service \ + pacman-syncdb.service EXTRA_DIST = \ checkupdates.sh.in \ @@ -60,6 +62,8 @@ EXTRA_DIST = \ pacdiff.sh.in \ paclist.sh.in \ paclog-pkglist.sh.in \ + pacman-syncdb.service.in \ + pacman-syncdb.timer \ pacscripts.sh.in \ pacsearch.pl.in \ pacsort.c \ diff --git a/src/pacman-syncdb.service.in b/src/pacman-syncdb.service.in new file mode 100644 index 0000000..a249045 --- /dev/null +++ b/src/pacman-syncdb.service.in @@ -0,0 +1,12 @@ +[Unit] +Description=Download pacman fresh files databases from the server +RequiresMountsFor="/var/lib/pacman/sync" +After=network-online.target +Wants=network-online.target + +[Service] +Type=oneshot +ExecStart=@bindir@/pacman -Fy +Nice=19 +StandardOutput=null +StandardError=journal diff --git a/src/pacman-syncdb.timer b/src/pacman-syncdb.timer new file mode 100644 index 0000000..2562443 --- /dev/null +++ b/src/pacman-syncdb.timer @@ -0,0 +1,10 @@ +[Unit] +Description=Download pacman fresh files databases from the server weekly + +[Timer] +OnCalendar=weekly +AccuracySec=1h +Persistent=true + +[Install] +WantedBy=timers.target -- 2.32.0

4 5

[PATCH 0/4] Fixes for (M)erge mode and --sudo
by Denton Liu 28 Jul '21

28 Jul '21

The first two patches are just mailmap changes for incorrect authorship. The third patch is some documentation update. The final patch are some fixes to a bad interaction between (M)erge mode and --sudo. Denton Liu (4): .mailmap: Map Daniel Parks .mailmap: Map Denton Liu pacdiff: update --sudo usages pacdiff: Don't use $SUDO on temporary files .mailmap | 2 ++ doc/pacdiff.8.txt | 3 +++ src/pacdiff.sh.in | 18 +++++++----------- 3 files changed, 12 insertions(+), 11 deletions(-) -- 2.31.0.208.g409f899ff0

2 8

[PATCH 1/2] paccache.service.in: Harden unit
by Frederik “Freso” S. Olesen 28 Jul '21

28 Jul '21

Adds a number of sandboxing and other hardening options to the paccache.service file. Signed-off-by: Frederik “Freso” S. Olesen <freso.dk(a)gmail.com> --- src/Makefile.am | 2 ++ src/paccache.service.in | 28 ++++++++++++++++++++++++++++ 2 files changed, 30 insertions(+) diff --git a/src/Makefile.am b/src/Makefile.am index eef0590..e5af195 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -8,6 +8,7 @@ DIST_SUBDIRS = $(SUBDIRS) conffile = ${sysconfdir}/pacman.conf dbpath = ${localstatedir}/lib/pacman/ gpgdir = ${sysconfdir}/pacman.d/gnupg/ +cachedir = ${localstatedir}/cache/pacman bin_SCRIPTS = \ $(OURSCRIPTS) @@ -95,6 +96,7 @@ AM_CFLAGS = \ edit = sed \ -e 's|@bindir[@]|$(bindir)|g' \ + -e 's|@cachedir[@]|$(cachedir)|g' \ -e 's|@sysconfdir[@]|$(sysconfdir)|g' \ -e 's|@localstatedir[@]|$(localstatedir)|g' \ -e 's|@PACKAGE_VERSION[@]|$(REAL_PACKAGE_VERSION)|g' \ diff --git a/src/paccache.service.in b/src/paccache.service.in index cd28e67..0f71f5f 100644 --- a/src/paccache.service.in +++ b/src/paccache.service.in @@ -4,3 +4,31 @@ Description=Remove unused cached package files [Service] Type=oneshot ExecStart=@bindir@/paccache -r +# Sandboxing and other hardening +ProtectProc=invisible +ProcSubset=pid +NoNewPrivileges=yes +ProtectSystem=strict +ProtectHome=yes +ReadWritePaths=@cachedir@/pkg +PrivateTmp=yes +PrivateDevices=yes +PrivateNetwork=yes +PrivateIPC=yes +PrivateUsers=yes +ProtectHostname=yes +ProtectClock=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +ProtectKernelLogs=yes +ProtectControlGroups=yes +RestrictAddressFamilies=AF_UNIX +RestrictNamespaces=yes +LockPersonality=yes +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +RemoveIPC=yes +PrivateMounts=yes +SystemCallFilter=@file-system +SystemCallArchitectures=native -- 2.32.0

3 8

[pacman-contrib] [PATCH] updpkgsums: don't try to add nonexistent checksums
by Eli Schwartz 28 Jul '21

28 Jul '21

In the event there are no sources, there won't be sums either. awk won't find any to remove and replace inline, so it tries to print "" at the end of the file, and merely adds superfluous newlines. Abort early instead, since updpkgsums cannot be expected to process such a file. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- src/updpkgsums.sh.in | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/updpkgsums.sh.in b/src/updpkgsums.sh.in index 41965f5..e5dbd2b 100644 --- a/src/updpkgsums.sh.in +++ b/src/updpkgsums.sh.in @@ -99,6 +99,11 @@ newbuildfile=$(mktemp "${TMPDIR:-/tmp}/updpkgsums.XXXXXX") trap "rm -rf '$BUILDDIR' '$newbuildfile'" EXIT sumtypes=$(IFS='|'; echo "${known_hash_algos[*]}") newsums=$(makepkg -g -p "$buildfile" "${MAKEPKG_OPTS[@]}") || die 'Failed to generate new checksums' + +if [[ -z $newsums ]]; then + die "$buildfile does not contain sources to update" +fi + awk -v sumtypes="$sumtypes" -v newsums="$newsums" ' $0 ~"^[[:blank:]]*(" sumtypes ")sums(_[^=]+)?=", $0 ~ "\\)[[:blank:]]*(#.*)?$" { if (!w) { -- 2.31.1

2 1

[PATCH] Add pacman-syncdb: systemd service and timer for `pacman -Fy`.
by tbperrotta＠gmail.com 28 Jul '21

28 Jul '21

From: Thiago Perrotta <tbperrotta(a)gmail.com> `pacman -Fy` is a modern replacement for `pkgfile`[1]. This service/timer makes `pacman -Fy` have feature parity with `pkgfile`. The unit files were based on both pkgfile and paccache, for consistency with the existing ecosystem. Context: https://bbs.archlinux.org/viewtopic.php?pid=1981076 [1]: https://wiki.archlinux.org/title/Pacman#Search_for_a_package_that_contains_… --- CHANGES.md | 1 + src/Makefile.am | 8 ++++++-- src/pacman-syncdb.service.in | 12 ++++++++++++ src/pacman-syncdb.timer | 10 ++++++++++ 4 files changed, 29 insertions(+), 2 deletions(-) create mode 100644 src/pacman-syncdb.service.in create mode 100644 src/pacman-syncdb.timer diff --git a/CHANGES.md b/CHANGES.md index bd0daf5..a3fd982 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -6,6 +6,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0. ## [Unreleased] ### Added +- pacman-syncdb: systemd service and timer for `pacman -Fy` (https://bbs.archlinux.org/viewtopic.php?pid=1981076) ### Changed diff --git a/src/Makefile.am b/src/Makefile.am index eef0590..cbc8bd0 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -30,7 +30,8 @@ vim_syntax__DATA = \ systemd_dir = ${libdir}/systemd/system systemd__DATA = \ - paccache.service paccache.timer + paccache.service paccache.timer \ + pacman-syncdb.service pacman-syncdb.timer BASHSCRIPTS = \ checkupdates \ @@ -50,7 +51,8 @@ OURSCRIPTS = \ $(PERLSCRIPTS) OURFILES = \ - paccache.service + paccache.service \ + pacman-syncdb.service EXTRA_DIST = \ checkupdates.sh.in \ @@ -60,6 +62,8 @@ EXTRA_DIST = \ pacdiff.sh.in \ paclist.sh.in \ paclog-pkglist.sh.in \ + pacman-syncdb.service.in \ + pacman-syncdb.timer \ pacscripts.sh.in \ pacsearch.pl.in \ pacsort.c \ diff --git a/src/pacman-syncdb.service.in b/src/pacman-syncdb.service.in new file mode 100644 index 0000000..a249045 --- /dev/null +++ b/src/pacman-syncdb.service.in @@ -0,0 +1,12 @@ +[Unit] +Description=Download pacman fresh files databases from the server +RequiresMountsFor="/var/lib/pacman/sync" +After=network-online.target +Wants=network-online.target + +[Service] +Type=oneshot +ExecStart=@bindir@/pacman -Fy +Nice=19 +StandardOutput=null +StandardError=journal diff --git a/src/pacman-syncdb.timer b/src/pacman-syncdb.timer new file mode 100644 index 0000000..2562443 --- /dev/null +++ b/src/pacman-syncdb.timer @@ -0,0 +1,10 @@ +[Unit] +Description=Download pacman fresh files databases from the server weekly + +[Timer] +OnCalendar=weekly +AccuracySec=1h +Persistent=true + +[Install] +WantedBy=timers.target -- 2.32.0

2 1