July 2009 - Pacman-dev - lists.archlinux.org

[pacman-dev] makepkg security
by Thomas Bächler 11 Jul '09

11 Jul '09

This continues a thread on arch-general: Thomas Bächler schrieb: >>> I agree. The question is not about makepkg security, but about sudo >>> security. And frankly, sudo is a security desaster in its default >>> configuration. >> >> Any suggestions for changing / shipping a better default config file? >> I know little about the security implications of this, but I think we >> should ship a decent default if possible. > > Our policy is usually to ship whatever upstream ships. IMO, a good > default would be to set sudo to require the root password (not the user > password) and not cache any passwords at all. > > Also, I think instead of using sudo in makepkg, we should use su by > default (with an option to enable sudo). su always has a good default > configuration requiring the root password (it's also possible to set it > to allow password-less su in the pam configuration, but everyone who > does that is crazy anyway). The original complaint was that when using makepkg -sic, the sudo password is cached after dependency installation and malicious sudo commands might be executed during build() as the password is cached. My opinion on this is that we should not encourage people to use sudo, Aaron suggested to move it here for further discussion. What do you think?

5 4

[pacman-dev] [PATCH] Quote values in the arch array in example PKGBUILD
by Allan McRae 09 Jul '09

09 Jul '09

Signed-off-by: Allan McRae <allan(a)archlinux.org> --- doc/PKGBUILD-example.txt | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/doc/PKGBUILD-example.txt b/doc/PKGBUILD-example.txt index 0477cb1..7245228 100644 --- a/doc/PKGBUILD-example.txt +++ b/doc/PKGBUILD-example.txt @@ -4,7 +4,7 @@ pkgname=patch pkgver=2.5.4 pkgrel=3 pkgdesc="A utility to apply patch files to original sources" -arch=(i686 x86_64) +arch=('i686' 'x86_64') url="http://www.gnu.org/software/patch/patch.html" license=('GPL') groups=('base-devel') -- 1.6.3.3

2 3

[pacman-dev] [PATCH] New sync070.py pactest
by Nagy Gabor 09 Jul '09

09 Jul '09

From cfcaa50b83d6ce09a026e8275f19ce0665365e31 Mon Sep 17 00:00:00 2001 From: Nagy Gabor <ngaba(a)bibl.u-szeged.hu> Date: Wed, 2 Jul 2008 17:04:29 +0200 Subject: [PATCH] New sync070.py pactest This pactest tests the cooperation between front-end and back-end in case of "-S provision" operation. Signed-off-by: Nagy Gabor <ngaba(a)bibl.u-szeged.hu> --- pactest/tests/sync070.py | 15 +++++++++++++++ 1 files changed, 15 insertions(+), 0 deletions(-) create mode 100644 pactest/tests/sync070.py diff --git a/pactest/tests/sync070.py b/pactest/tests/sync070.py new file mode 100644 index 0000000..2177ea7 --- /dev/null +++ b/pactest/tests/sync070.py @@ -0,0 +1,15 @@ +self.description = "Advanced -S provision test" + +sp1 = pmpkg("pkg", "1.0-1") +self.addpkg2db("sync2", sp1) + +sp2 = pmpkg("pkg", "2.0-1") +sp2.provides = [ "provision" ] +sp2.conflicts = [ "pkg1=1.0-1" ] +self.addpkg2db("sync1", sp2) + +self.args = "-S provision" + +self.addrule("PACMAN_RETCODE=0") +self.addrule("PKG_EXIST=pkg") +self.addrule("PKG_VERSION=pkg|2.0-1") -- 1.5.6.1

2 6

[pacman-dev] Idea: Merge -U and -S (half universal transaction)?
by Nagy Gabor 09 Jul '09

09 Jul '09

Hi! After killing pmsyncpkg_t, there is not much difference between -S and -U transactions. The only difference is that trans->packages come from pkgcache (-S) or they are loaded from file (-U). And of course, with -S we have an extra step, we have to actually download the packages. However, -U is much more "stupid" than -S atm. Now the removes field is attached to pmpkg_t, so we could implement FS#3492 without pain, the conflict resolving part from sync.c can be reused without any modification*. Or if we allow "mixed" trans->packages list (pkg->origin can indicate that we have a file[-U] or repo[-S] package), even the implementaion of FS#5798 should be also straightforward. The only difference between PKG_FROM_CACHE and PKG_FROM_FILE packages, that PKG_FROM_CACHE needs to be downloaded. Then -U would become a sync transaction (internally), and add_commit would be a helper function only. *: I started to work on the implementation of mixed target list, and I realised that the most annoying "difference" is that PKG_FROM_CACHE packages are not duplicated, so they are mustn't be freed (the new _alpm_pkg_free_trans should be used), but PKG_FROM_FILE packages must be freed. How much memory can we spare by not duplicating sync packages (not calling _alpm_pkg_dup when adding them to transaction target)? The whole base repo is <0.5 MB atm. Does this hack "worth"? With the old behaviour, implementing this idea (and so FS#3492 and FS#5798) would be really nice. With the new behaviour it would not. (And I don't really like the need for _alpm_pkg_free_trans neither.) Bye

3 3

[pacman-dev] MirrorBrain for mirrors?
by Tim G 03 Jul '09

03 Jul '09

Hey everyone, I am not sure if it has been brought up before, but has anyone thought about providing a MirrorBrain http repository? OpenSUSE has one at http://download.opensuse.org/ and it works quite well. If we are able to provide something like this, it would mean that we could provide transparent mirroring. MirrorBrain even looks after creating mirror lists http://download.opensuse.org/distribution/11.1/iso/openSUSE-11.1-KDE4-LiveCD -i686.iso?mirrorlist Anyways, have a look at it, http://mirrorbrain.org/features -- Tim Groeneveld (Application Developer) Digital Pacific www.digitalpacific.com.au <http://www.digitalpacific.com.au/>

5 5

[pacman-dev] [PATCH] makepkg: check for package functions when package splitting
by Allan McRae 03 Jul '09

03 Jul '09

Makes sure the required package functions are present when using package splitting. Also moves setting of pkgbase variable outside the check_sanity function to somewhere more appropriate. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- scripts/makepkg.sh.in | 14 +++++++++++--- 1 files changed, 11 insertions(+), 3 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 922187a..66287d0 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -1134,9 +1134,6 @@ check_sanity() { if [ "$arch" = 'any' ]; then CARCH='any' fi - - pkgbase=${pkgbase:-${pkgname[0]}} - if ! in_array $CARCH ${arch[@]}; then if [ "$IGNOREARCH" -eq 0 ]; then error "$(gettext "%s is not available for the '%s' architecture.")" "$pkgbase" "$CARCH" @@ -1178,6 +1175,15 @@ check_sanity() { return 1 fi + if [ "${#pkgname[@]}" -gt "1" ]; then + for pkg in ${pkgname[@]}; do + if [ "$(type -t package_${pkg})" != "function" ]; then + error "$(gettext "missing package function for split package '%s'")" "$pkg" + return 1 + fi + done + fi + return 0 } @@ -1653,6 +1659,8 @@ if [ "${#pkgname[@]}" -gt "1" ]; then SPLITPKG=1 fi +pkgbase=${pkgbase:-${pkgname[0]}} + if [ "$SPLITPKG" -eq 0 ]; then if [ -f "$PKGDEST/${pkgname}-${pkgver}-${pkgrel}-${CARCH}${PKGEXT}" \ -a "$FORCE" -eq 0 -a "$SOURCEONLY" -eq 0 -a "$NOBUILD" -eq 0 ]; then -- 1.6.3.3

1 0

[pacman-dev] [PATCH] makepkg: fix pkgdesc restoration with split packaging
by Allan McRae 03 Jul '09

03 Jul '09

A pkgdesc with spaces in it would get restored to an array and thus only the first word would be restored (FS#15210). Convert that array back to a string. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- Not sure if there is a better way to do this? scripts/makepkg.sh.in | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 34c92c7..922187a 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -1280,6 +1280,11 @@ restore_package_variables() { unset ${var} fi done + + # pkgdesc gets restored as an array - convert back to a string + local pkgdesc_backup="${pkgdesc[@]}" + unset pkgdesc + pkgdesc=${pkgdesc_backup} } # getopt like parser -- 1.6.3.3

1 0

[pacman-dev] [PATCH] makepkg: Exit on failure within build() or package() functions
by Allan McRae 03 Jul '09

03 Jul '09

Errors in build() functions were only fatal, if "--log" was enabled. Errors in package() functions were never fatal. Piping these functions through "cat -" triggers error trapping. This prevents the need for "|| return 1" usage in PKGBUILDs. Original-patch-by: Juergen Hoetzel <juergen(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> --- scripts/makepkg.sh.in | 8 +++++--- 1 files changed, 5 insertions(+), 3 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 91e2518..34c92c7 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -717,8 +717,10 @@ run_build() { build 2>&1 | tee "$BUILDLOG"; ret=${PIPESTATUS[0]} else - build 2>&1 || ret=$? + # piping to cat ensures makepkg fails on any build error + build 2>&1 | cat -; ret=${PIPESTATUS[0]} fi + # reset our shell options eval "$shellopts" @@ -771,12 +773,12 @@ run_package() { exec 3>&1 tee "$BUILDLOG" < "$logpipe" & exec 1>"$logpipe" 2>"$logpipe" - $pkgfunc 2>&1 || ret=$? + $pkgfunc 2>&1 | cat -; ret=${PIPESTATUS[0]} sync exec 1>&3 2>&3 3>&- rm "$logpipe" else - $pkgfunc 2>&1 || ret=$? + $pkgfunc 2>&1 | cat -; ret=${PIPESTATUS[0]} fi if [ $ret -gt 0 ]; then -- 1.6.3.3

1 0

[pacman-dev] [PATCH] Ensure build failure if a single build() command fails
by Jürgen Hötzel 03 Jul '09

03 Jul '09

Hi, I doubt this was by intention: errors in build() functions are only fatal, if "--log" is enabled. I just made a buggy pkg because some "install ..." commands where not handled by "|| return 1". Our PKGBUILDs are cluttert full of "|| return 1". Failing commands in build functions should always result in an build error. Signed-off-by: Juergen Hoetzel <juergen(a)archlinux.org> --- scripts/makepkg.sh.in | 7 ++++--- 1 files changed, 4 insertions(+), 3 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index f46b7f8..84d4599 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -703,6 +703,7 @@ run_build() { local ret=0 if [ "$LOGGING" -eq 1 ]; then BUILDLOG="${startdir}/${pkgbase}-${pkgver}-${pkgrel}-${CARCH}-build.log" + BUILDLOG_CMD="tee $BUILDLOG" if [ -f "$BUILDLOG" ]; then local i=1 while true; do @@ -714,11 +715,11 @@ run_build() { done mv "$BUILDLOG" "$BUILDLOG.$i" fi - - build 2>&1 | tee "$BUILDLOG"; ret=${PIPESTATUS[0]} else - build 2>&1 || ret=$? + BUILDLOG_CMD="cat -" fi + + build 2>&1 | ${BUILDLOG_CMD}; ret=${PIPESTATUS[0]} # reset our shell options eval "$shellopts" -- 1.6.3.2

4 7

[pacman-dev] Patches for srcpac
by Loui Chang 03 Jul '09

03 Jul '09

This seems like the most appropriate mailing list for this. Cheers!

3 7