November 2010 - Pacman-dev - lists.archlinux.org

[pacman-dev] Status of package signing work
by Allan McRae 23 Nov '10

23 Nov '10

Hi, I just rebased the gpg work on top of my working branch and pulled in a couple of patches to do with the pacman-key tool so I thought it would be a good time to get a summary of where we are on this. Here is my take on the current status. I would like to keep this list up-to-date so we can track progress, so feel free to reply adding anything I have missed. pacman-key: - tool to manage pacman keyring - TODO: man page needs tidying/clarification makepkg: - will sign packages and produce detached signature if the "sign" option is enabled in makepkg.conf - split packages, PKGDEST etc all handled - TODO: allow selection of key used for signing (patch: http://mailman.archlinux.org/pipermail/pacman-dev/2010-July/011435.html) - TODO: documentation (patch: http://mailman.archlinux.org/pipermail/pacman-dev/2010-July/011436.html) repo-add: - adds package signature (base64) to repos if available when adding package - has option to sign a repo after creation and verify current signature before making changes - TODO: check signature used to verify is not only good but is also in a list of accepted keys (???) - TODO: allow selection of key used for signing (patch: http://mailman.archlinux.org/pipermail/pacman-dev/2010-July/011435.html) - TODO: documentation (patch: http://mailman.archlinux.org/pipermail/pacman-dev/2010-July/011436.html) pacman: - reads in keys from repo-db and decodes them when needed - reads in .sig files when beside a package being loaded from the filesystem - integrated gpgme into pacman for signature verification - provide options to control signature verification on a per repo basis - verifies signatures of packages when installing from repo - TODO: create directories needed for keyring during "make install" - TODO: verify signatures for packages installed from filesystem (???) - TODO: download and verify signatures of dbs (patches: http://mailman.archlinux.org/pipermail/pacman-dev/2010-July/011433.html http://mailman.archlinux.org/pipermail/pacman-dev/2010-July/011434.html) I think the very last TODO there is the only thing stopping us from getting some actual testing of this work underway. I think I have my head around what the two patches are doing now, but I am not sure I like the "how" of that doing. So I will make an attempt into hacking them as I see fit in the next few days... Then I will publish a signed repo with a pacman-git and we can see how this all goes! Allan

2 5

[pacman-dev] makepkg: gpg signature verification?
by Florian Pritz 23 Nov '10

23 Nov '10

I'd like to add $gpgsource (urls to gpg signatures of the sources) to PKGBUILDs and when building check the signatures, but I'm not sure what to do when the check fails. If the user doesn't have the key in his keyring or doesn't trust it my idea would be to display an error message and exit, but that doesn't seem practical although I think it's the right way. I also have no idea how to handle chroots. I really can't expect users to copy their keyring into the chroot, but I could add an option to makepkg.conf so you can disable the checking and wrapper scripts could then do that before chrooting (using a new --verify option maybe). C&C please. -- Florian Pritz -- {flo,bluewind}(a)server-speed.net

2 1

[pacman-dev] [PATCH 2/2] Download and verify package database signatures
by Allan McRae 22 Nov '10

22 Nov '10

If signature verification is needed, attempt to download a signature file for a repo when it is updated. Return an error if unable to download signature only when checking is mandatory, or if signature is invalid. TODO: At the moment the database signature is only checked on download. Should we do anything with a database if it fails to be verified to prevent its future usage? Signed-off-by: Allan McRae <allan(a)archlinux.org> --- lib/libalpm/be_sync.c | 41 ++++++++++++++++++++++++++++++++++++----- 1 files changed, 36 insertions(+), 5 deletions(-) diff --git a/lib/libalpm/be_sync.c b/lib/libalpm/be_sync.c index d3399b2..1cf6727 100644 --- a/lib/libalpm/be_sync.c +++ b/lib/libalpm/be_sync.c @@ -104,23 +104,54 @@ int SYMEXPORT alpm_db_update(int force, pmdb_t *db) sprintf(syncpath, "%s%s", dbpath, "sync/"); ret = _alpm_download_single_file(dbfile, db->servers, syncpath, force); - free(dbfile); - free(syncpath); if(ret == 1) { /* files match, do nothing */ pm_errno = 0; - return(1); + goto cleanup; } else if(ret == -1) { /* pm_errno was set by the download code */ _alpm_log(PM_LOG_DEBUG, "failed to sync db: %s\n", alpm_strerrorlast()); - return(-1); + goto cleanup; + } + + /* Download and check the signature of the database if needed */ + if(db->pgp_verify != PM_PGP_VERIFY_NEVER) { + char *sigfile; + int sigret; + + len = strlen(dbfile) + 5; + MALLOC(sigfile, len, RET_ERR(PM_ERR_MEMORY, -1)); + sprintf(sigfile, "%s.sig", dbfile); + + sigret = _alpm_download_single_file(sigfile, db->servers, syncpath, 1); + free(sigfile); + + if(sigret == -1 && db->pgp_verify == PM_PGP_VERIFY_ALWAYS) { + _alpm_log(PM_LOG_ERROR, _("Failed to download signature for db: %s\n"), + alpm_strerrorlast()); + pm_errno = PM_ERR_SIG_INVALID; + ret = -1; + goto cleanup; + } + + sigret = alpm_db_check_pgp_signature(db); + if((db->pgp_verify == PM_PGP_VERIFY_ALWAYS && sigret != 0) || + (db->pgp_verify == PM_PGP_VERIFY_OPTIONAL && sigret == 1)) { + /* pm_errno was set by the checking code */ + /* TODO: should we just leave the unverified database */ + ret = -1; + goto cleanup; + } } /* Cache needs to be rebuilt */ _alpm_db_free_pkgcache(db); - return(0); +cleanup: + free(dbfile); + free(syncpath); + return(ret); } int _alpm_sync_db_populate(pmdb_t *db) -- 1.7.3.2

1 0

[pacman-dev] [PATCH 1/2] Add functions for verifying db signature
by Allan McRae 22 Nov '10

22 Nov '10

Add a pmpgpsig_t struct to the database entry struct and functions for the lazy loading of database signatures. Add a function for checking database signatures, reusing (and generalizing) the code currently used for checking package signatures. TODO: The code for reading in signature files from the filesystem is duplicated for local packages and database and needs refactored. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- lib/libalpm/alpm.h | 1 + lib/libalpm/db.c | 56 +++++++++++++++++++++++++++++++++++++++++++++ lib/libalpm/db.h | 7 +++++- lib/libalpm/package.h | 11 +-------- lib/libalpm/signing.c | 61 ++++++++++++++++++++++++++++++------------------ lib/libalpm/signing.h | 12 +++++++++- 6 files changed, 113 insertions(+), 35 deletions(-) diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index 9dd222d..74598ef 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -253,6 +253,7 @@ alpm_list_t *alpm_pkg_unused_deltas(pmpkg_t *pkg); */ int alpm_pkg_check_pgp_signature(pmpkg_t *pkg); +int alpm_db_check_pgp_signature(pmdb_t *db); /* GPG signature verification option */ typedef enum _pgp_verify_t { diff --git a/lib/libalpm/db.c b/lib/libalpm/db.c index 9fd918a..a7718d5 100644 --- a/lib/libalpm/db.c +++ b/lib/libalpm/db.c @@ -409,6 +409,62 @@ pmdb_t *_alpm_db_new(const char *treename, int is_local) return(db); } +static int load_pgpsig(pmdb_t *db) { + size_t len; + const char *dbfile; + char *sigfile; + + dbfile = _alpm_db_path(db); + len = strlen(dbfile) + 5; + MALLOC(sigfile, len, RET_ERR(PM_ERR_MEMORY, -1)); + sprintf(sigfile, "%s.sig", dbfile); + + if(access(sigfile, R_OK) == 0) { + FILE *f; + long bytes; + size_t bytes_read; + f = fopen(sigfile, "rb"); + fseek(f, 0L, SEEK_END); + bytes = ftell(f); + fseek(f, 0L, SEEK_SET); + CALLOC(db->pgpsig.rawdata, bytes, sizeof(char), + goto error); + bytes_read = fread(db->pgpsig.rawdata, sizeof(char), bytes, f); + if(bytes_read == bytes) { + db->pgpsig.rawlen = bytes; + _alpm_log(PM_LOG_DEBUG, + "loaded database .sig file, location %s\n", sigfile); + } else { + _alpm_log(PM_LOG_WARNING, _("Failed reading PGP signature file for %s"), + dbfile); + } + fclose(f); + } else { + _alpm_log(PM_LOG_DEBUG, "no database signature file found\n"); + } + + return(0); + +error: + FREE(db->pgpsig.rawdata); + db->pgpsig.rawlen = 0; + return(1); +} + +const pmpgpsig_t *_alpm_db_pgpsig(pmdb_t *db) +{ + ALPM_LOG_FUNC; + + /* Sanity checks */ + ASSERT(db != NULL, return(NULL)); + + if(db->pgpsig.rawdata == NULL) { + load_pgpsig(db); + } + + return &(db->pgpsig); +} + void _alpm_db_free(pmdb_t *db) { ALPM_LOG_FUNC; diff --git a/lib/libalpm/db.h b/lib/libalpm/db.h index ab896b9..1372b0d 100644 --- a/lib/libalpm/db.h +++ b/lib/libalpm/db.h @@ -22,7 +22,6 @@ #ifndef _ALPM_DB_H #define _ALPM_DB_H -#include "alpm.h" #include <limits.h> #include <time.h> @@ -30,6 +29,9 @@ #include <archive.h> #include <archive_entry.h> +#include "alpm.h" +#include "signing.h" + /* Database entries */ typedef enum _pmdbinfrq_t { INFRQ_BASE = 1, @@ -58,6 +60,8 @@ struct __pmdb_t { alpm_list_t *pkgcache; alpm_list_t *grpcache; alpm_list_t *servers; + /* do not access directly, use _alpm_db_pgpsig(db) for lazy access */ + pmpgpsig_t pgpsig; pgp_verify_t pgp_verify; struct db_operations *ops; @@ -73,6 +77,7 @@ pmdb_t *_alpm_db_register_local(void); pmdb_t *_alpm_db_register_sync(const char *treename); void _alpm_db_unregister(pmdb_t *db); pmdb_t *_alpm_db_new(const char *treename, int is_local); +const pmpgpsig_t *_alpm_db_pgpsig(pmdb_t *db); /* be_*.c, backend specific calls */ int _alpm_local_db_populate(pmdb_t *db); diff --git a/lib/libalpm/package.h b/lib/libalpm/package.h index be5ce32..7c11e38 100644 --- a/lib/libalpm/package.h +++ b/lib/libalpm/package.h @@ -29,6 +29,7 @@ #include "alpm.h" #include "db.h" +#include "signing.h" typedef enum _pmpkgfrom_t { PKG_FROM_FILE = 1, @@ -90,16 +91,6 @@ struct pkg_operations { */ extern struct pkg_operations default_pkg_ops; -struct __pmpgpsig_t { - /* we will either store the encoded data or the raw data- - * this way we can decode on an as-needed basis since most - * operations won't require the overhead of base64 decodes - * on all packages in a sync repository. */ - char *encdata; - size_t rawlen; - unsigned char *rawdata; -}; - struct __pmpkg_t { char *filename; char *name; diff --git a/lib/libalpm/signing.c b/lib/libalpm/signing.c index 2b15528..826c34b 100644 --- a/lib/libalpm/signing.c +++ b/lib/libalpm/signing.c @@ -92,28 +92,28 @@ error: } /** - * Check the PGP package signature for the given package file. - * @param pkgpath the full path to a package file + * Check the PGP package signature for the given file. + * @param path the full path to a file * @param sig PGP signature data in raw form (already decoded) * @return a int value : 0 (valid), 1 (invalid), -1 (an error occured) */ -int _alpm_gpgme_checksig(const char *pkgpath, const pmpgpsig_t *sig) +int _alpm_gpgme_checksig(const char *path, const pmpgpsig_t *sig) { int ret = 0; gpgme_error_t err; gpgme_ctx_t ctx; - gpgme_data_t pkgdata, sigdata; + gpgme_data_t filedata, sigdata; gpgme_verify_result_t result; gpgme_signature_t gpgsig; - FILE *pkgfile = NULL, *sigfile = NULL; + FILE *file = NULL, *sigfile = NULL; ALPM_LOG_FUNC; if(!sig || !sig->rawdata) { RET_ERR(PM_ERR_SIG_UNKNOWN, -1); } - if(!pkgpath || access(pkgpath, R_OK) != 0) { - RET_ERR(PM_ERR_PKG_NOT_FOUND, -1); + if(!path || access(path, R_OK) != 0) { + RET_ERR(PM_ERR_NOT_A_FILE, -1); } if(gpgme_init()) { /* pm_errno was set in gpgme_init() */ @@ -124,13 +124,13 @@ int _alpm_gpgme_checksig(const char *pkgpath, const pmpgpsig_t *sig) /* create our necessary data objects to verify the signature */ /* first the package itself */ - pkgfile = fopen(pkgpath, "rb"); - if(pkgfile == NULL) { - pm_errno = PM_ERR_PKG_OPEN; + file = fopen(path, "rb"); + if(file == NULL) { + pm_errno = PM_ERR_NOT_A_FILE; ret = -1; goto error; } - err = gpgme_data_new_from_stream(&pkgdata, pkgfile); + err = gpgme_data_new_from_stream(&filedata, file); CHECK_ERR(); /* next create data object for the signature */ @@ -138,7 +138,7 @@ int _alpm_gpgme_checksig(const char *pkgpath, const pmpgpsig_t *sig) CHECK_ERR(); /* here's where the magic happens */ - err = gpgme_op_verify(ctx, sigdata, pkgdata, NULL); + err = gpgme_op_verify(ctx, sigdata, filedata, NULL); CHECK_ERR(); result = gpgme_op_verify_result(ctx); gpgsig = result->signatures; @@ -161,34 +161,34 @@ int _alpm_gpgme_checksig(const char *pkgpath, const pmpgpsig_t *sig) if(gpgsig->summary & GPGME_SIGSUM_VALID) { /* good signature, continue */ - _alpm_log(PM_LOG_DEBUG, _("Package %s has a valid signature.\n"), - pkgpath); + _alpm_log(PM_LOG_DEBUG, _("File %s has a valid signature.\n"), + path); } else if(gpgsig->summary & GPGME_SIGSUM_GREEN) { /* 'green' signature, not sure what to do here */ - _alpm_log(PM_LOG_WARNING, _("Package %s has a green signature.\n"), - pkgpath); + _alpm_log(PM_LOG_WARNING, _("File %s has a green signature.\n"), + path); } else if(gpgsig->summary & GPGME_SIGSUM_KEY_MISSING) { pm_errno = PM_ERR_SIG_UNKNOWN; - _alpm_log(PM_LOG_WARNING, _("Package %s has a signature from an unknown key.\n"), - pkgpath); + _alpm_log(PM_LOG_WARNING, _("File %s has a signature from an unknown key.\n"), + path); ret = -1; } else { /* we'll capture everything else here */ pm_errno = PM_ERR_SIG_INVALID; - _alpm_log(PM_LOG_ERROR, _("Package %s has an invalid signature.\n"), - pkgpath); + _alpm_log(PM_LOG_ERROR, _("File %s has an invalid signature.\n"), + path); ret = 1; } error: gpgme_data_release(sigdata); - gpgme_data_release(pkgdata); + gpgme_data_release(filedata); gpgme_release(ctx); if(sigfile) { fclose(sigfile); } - if(pkgfile) { - fclose(pkgfile); + if(file) { + fclose(file); } if(err != GPG_ERR_NO_ERROR) { _alpm_log(PM_LOG_ERROR, _("GPGME error: %s\n"), gpgme_strerror(err)); @@ -211,4 +211,19 @@ int SYMEXPORT alpm_pkg_check_pgp_signature(pmpkg_t *pkg) alpm_pkg_get_pgpsig(pkg))); } +/** + * Check the PGP package signature for the given database. + * @param db the database to check + * @return a int value : 0 (valid), 1 (invalid), -1 (an error occured) + */ +int SYMEXPORT alpm_db_check_pgp_signature(pmdb_t *db) +{ + ALPM_LOG_FUNC; + ASSERT(db != NULL, return(0)); + + return(_alpm_gpgme_checksig(_alpm_db_path(db), + _alpm_db_pgpsig(db))); +} + + /* vim: set ts=2 sw=2 noet: */ diff --git a/lib/libalpm/signing.h b/lib/libalpm/signing.h index c004697..8fbb25d 100644 --- a/lib/libalpm/signing.h +++ b/lib/libalpm/signing.h @@ -21,7 +21,17 @@ #include "alpm.h" -int _alpm_gpgme_checksig(const char *pkgpath, const pmpgpsig_t *sig); +struct __pmpgpsig_t { + /* we will either store the encoded data or the raw data- + * this way we can decode on an as-needed basis since most + * operations won't require the overhead of base64 decodes + * on all packages in a sync repository. */ + char *encdata; + size_t rawlen; + unsigned char *rawdata; +}; + +int _alpm_gpgme_checksig(const char *path, const pmpgpsig_t *sig); #endif /* _ALPM_SIGNING_H */ -- 1.7.3.2

1 0

[pacman-dev] Appendix to signature patchset
by Denis A. Altoé Falqueto 20 Nov '10

20 Nov '10

Guys, This is a last patch for that series. It is a new patch, as Allan asked, so you can apply it in an already patched branch. The description on the patch itself is self explanatory. This is just to justify the new patch without poluting its description. Any sugestions or criticisms are always welcome. -- Denis Falqueto

2 9

[pacman-dev] Warn about using -Sy
by Evangelos Foutras 18 Nov '10

18 Nov '10

Oftentimes, I come across people using `pacman -Sy <name>' to install new packages. This installs the latest version of a package, while leaving any required libraries at their old version. The introduction of an incompatibility between a package and its dependencies is highly possible. A recent example of this issue is [1]. Could you please review the attached tiny patch for code structure, language used, and overall approach? -- [1] http://mailman.archlinux.org/pipermail/arch-general/2010-November/017198.ht…

7 12

[pacman-dev] Disk space checking branch "complete"
by Allan McRae 17 Nov '10

17 Nov '10

Hi, I have "finished" the disk space checking implementation. The only TODO left is to add the statvfs version of getmntinfo code path (NetBSD), but otherwise I consider this done. The calculations done are quite good but it is near impossible to be exact (e.g. adding/removing a block for directories but only once across the transaction, .pacsave/.pacnew files, filelist db files). I suppose I could add a block for those and not remove blocks to get an upper limit. However, the difference will likely be orders of magnitude smaller than the transaction size so I am not sure it is worth further effort... As far as the interface goes, the check is performed only when the CheckSpace option is given in pacman.conf. We also get a nice progress bar in pacman while the check is being performed (think of what is displayed during file conflict checking). See the work here: http://projects.archlinux.org/users/allan/pacman.git/diff/?h=diskspace&id2=… I need to rebase that branch into useful commit(s), but the overall changes are rather small (12 files changed, 447 insertions, 2 deletions - with 365 of those additions being in two new files). So I think code review can happen now. I am looking for comments on code correctness and very specific implementation details only. Anything other than that needs to be submitted in patch form... Allan

6 16

[pacman-dev] [PATCH 1/2] dirent usage cleanup
by Dan McGee 17 Nov '10

17 Nov '10

We were including the header in a lot of places it is no longer used. Additionally, use the correct autoconf macro for determining whether d_type is available as a member: HAVE_STRUCT_DIRENT_D_TYPE. Signed-off-by: Dan McGee <dan(a)archlinux.org> --- configure.ac | 1 + lib/libalpm/be_local.c | 2 +- lib/libalpm/be_sync.c | 1 - lib/libalpm/db.c | 1 - lib/libalpm/sync.c | 1 - src/pacman/callback.c | 1 - 6 files changed, 2 insertions(+), 5 deletions(-) diff --git a/configure.ac b/configure.ac index 6f601f4..e8541d2 100644 --- a/configure.ac +++ b/configure.ac @@ -179,6 +179,7 @@ AC_TYPE_PID_T AC_TYPE_SIZE_T AC_STRUCT_TM AC_TYPE_UID_T +AC_STRUCT_DIRENT_D_TYPE # Checks for library functions. AC_FUNC_FORK diff --git a/lib/libalpm/be_local.c b/lib/libalpm/be_local.c index 2212752..988248d 100644 --- a/lib/libalpm/be_local.c +++ b/lib/libalpm/be_local.c @@ -340,7 +340,7 @@ static int checkdbdir(pmdb_t *db) static int is_dir(const char *path, struct dirent *entry) { -#ifdef DT_DIR +#ifdef HAVE_STRUCT_DIRENT_D_TYPE return(entry->d_type == DT_DIR); #else char buffer[PATH_MAX]; diff --git a/lib/libalpm/be_sync.c b/lib/libalpm/be_sync.c index e1c7663..bec6abe 100644 --- a/lib/libalpm/be_sync.c +++ b/lib/libalpm/be_sync.c @@ -21,7 +21,6 @@ #include "config.h" #include <errno.h> -#include <dirent.h> #include <ctype.h> #include <locale.h> diff --git a/lib/libalpm/db.c b/lib/libalpm/db.c index 79d20d4..1e7d3a2 100644 --- a/lib/libalpm/db.c +++ b/lib/libalpm/db.c @@ -29,7 +29,6 @@ #include <errno.h> #include <string.h> #include <sys/stat.h> -#include <dirent.h> #include <regex.h> #include <time.h> diff --git a/lib/libalpm/sync.c b/lib/libalpm/sync.c index 1e73b8b..2fd79ea 100644 --- a/lib/libalpm/sync.c +++ b/lib/libalpm/sync.c @@ -31,7 +31,6 @@ #include <stdint.h> /* intmax_t */ #include <unistd.h> #include <time.h> -#include <dirent.h> /* libalpm */ #include "sync.h" diff --git a/src/pacman/callback.c b/src/pacman/callback.c index 32dafb5..925f1fc 100644 --- a/src/pacman/callback.c +++ b/src/pacman/callback.c @@ -26,7 +26,6 @@ #include <sys/time.h> #include <sys/types.h> /* off_t */ #include <unistd.h> -#include <dirent.h> #include <wchar.h> #include <alpm.h> -- 1.7.3.2

1 1

[pacman-dev] Checking free space before transaction
by Allan McRae 14 Nov '10

14 Nov '10

Hi, I have implemented some basic disk space checking in pacman. The code is still a bit rough and there are some TODOs in there (especially related to output). But the basics are all there, so it seems time to get some comments. See my diskspace branch: http://projects.archlinux.org/users/allan/pacman.git/log/?h=diskspace Obviously I need to do some rebasing there, so it is probably easiest to look at the diff between that and my working branch: http://projects.archlinux.org/users/allan/pacman.git/diff/?h=diskspace&id2=… Here are some basic examples of what is implemented so far: > sudo src/pacman/pacman -S grub --dbpath /home/allan/tmp/db/ ... (1/1) checking for file conflicts [######################] 100% Partition: / - blocks needed: 112 - blocks free: 2635828 Partition: /boot - blocks needed: 1 - blocks free: 109046 (1/1) installing grub [######################] 100% > sudo src/pacman/pacman -S grub --dbpath /home/allan/tmp/db/ ... (1/1) checking for file conflicts [######################] 100% Partition: / - blocks needed: 0 - blocks free: 2635684 Partition: /boot - blocks needed: 0 - blocks free: 109044 (1/1) upgrading grub [######################] 100% It also handles the space freed by removing conflicts etc. Obviously the space calculations could be improved, e.g. - for /boot on installing grub, the /boot/grub directory should require a block in addition to the one used by the menu.lst file - directories get counted for removal even when they are not being removed... and that multiplies across packages - .PKGINFO etc count towards / (rather than to dbpath ???) - space for .pacnew/.pacsave files is ignored But it is close enough... In its current form the calculations should catch major stupidity. Allan

4 27

[pacman-dev] Versioned packages on the command line.
by Xyne 11 Nov '10

11 Nov '10

Hi, If two repos (obviously not both official) provide the same binary package, pacman will install the package from the repo that is listed first in pacman.conf, if specified on the command line, e.g. "pacman -S foo". If another package depends on "foo", the same thing happens, but if it instead depends on "foo=1.4" and only the second repo provides it, then pacman will correctly skip over the first repo and install it from the second. If so, would you consider making it possible to specify versions directly on the command line, e.g. "pacman -S foo=1.4". I know that it's possible to first do a search for the package to see which repos contain it, then prepend the repo, e.g. "pacman -S second-repo/foo", but it would be more useful sometimes to be able to just specify the version using "=", "<=", etc. This would ideally also work for detecting providers too, e.g. if "bar" provides "foo=1.4" then "pacman -S foo=1.4" would install bar (or bring up the provider selection dialogue once that's included... I really like that idea btw... considered doing that in powerpill at some point) For a possible use of this, see the following post on the arch-haskell mailing list: http://www.haskell.org/pipermail/arch-haskell/2010-November/000740.html Regards, Xyne

2 2