March 2011 - Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH] Add -s --sign and -v --verify to repo-add usage message.
by Ray Kohler 28 Mar '11

28 Mar '11

There were not added to the end of the list as that would mean splitting the single gettext string that contains -f and the "see the man page" message, and I wanted to do as little string damage as possible. Signed-off-by: Ray Kohler <ataraxia937(a)gmail.com> --- scripts/repo-add.sh.in | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/scripts/repo-add.sh.in b/scripts/repo-add.sh.in index 9b57ba7..3d6d0c7 100644 --- a/scripts/repo-add.sh.in +++ b/scripts/repo-add.sh.in @@ -74,6 +74,11 @@ repo-remove will update a package database by removing the package name\n\ specified on the command line from the given repo database. Multiple\n\ packages to remove can be specified on the command line.\n\n")" printf "$(gettext "\ +Use the -s/--sign flag to sign the database with GnuPG after updating.\n\n")" + printf "$(gettext "\ +Use the -v/--verify flag to verify the GnuPG signature of the database\n\ +before updating.\n\n")" + printf "$(gettext "\ Use the -q/--quiet flag to minimize output to basic messages, warnings,\n\ and errors.\n\n")" printf "$(gettext "\ -- 1.7.4.1

3 13

[pacman-dev] heads-up - master branch compile failure with gcc-4.6
by Allan McRae 28 Mar '11

28 Mar '11

Just a heads-up that the upcoming gcc-4.6 release will cause a build failure when building with --enable-debug (which sets -Werror...) be_package.c: In function 'pkg_load': be_package.c:257:7: error: variable 'ret' set but not used [-Werror=unused-but-set-variable] cc1: all warnings being treated as errors Clearly something on the TODO list anyway! /* TODO: do something with ret value */ ret = _alpm_load_signature(pgpfile, &(newpkg->pgpsig)); Allan

2 3

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v3.5.1-89-g4a3cd36
by dan＠archlinux.org 28 Mar '11

28 Mar '11

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via 4a3cd364d00b6889b24a16542618f1e2c14b86ac (commit) via 3f269503d53811cf45037022a263f2447e427a0b (commit) via 630b7b94c39ddc60d4e2b3c80d5d9f3101049b93 (commit) via 43dacceb6bba837aceba331c31ed8d8ee7a9e1d5 (commit) via c02556e2905dc1801d751db8cc3e96ccbedb76ab (commit) via a9fb4d9d5b065560f7e42378ad1ee3d2f7b19911 (commit) via 98c8ab18ff7f48bb2074d821ad93b009fd4bac4c (commit) via 33c08ac91e32e1c1fe135c42030f1a2b64a63a54 (commit) via fd64988c8085a410a80851e2b4b6b62ea59139c2 (commit) via 55f790ebe49ebf5a7d2084682735fd75f6d4903b (commit) via 283bf7e87cab1fa187334830fe2d05dd28bc5b77 (commit) via ea216d3f5a84814c512ab51ac37a4055b82032c3 (commit) via 68701a98aff46821e7e3440d5db233adbe249770 (commit) via 3bc3999bd25647f9b64ea4b4995cad54a8066cc1 (commit) via 5a9a570dda81148fd9ce8ea46b3c57befa8535fe (commit) via c40fc6b80d4a97e3333afab6d2ce8290aaa29c46 (commit) via 7f480ccc0de9438ef499685088a49b3c5964606b (commit) via e214b260efcba299611688bdbbc02b7391632d43 (commit) from 86e7f6075671e08c456f389d8ecba47190c03f0f (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 4a3cd364d00b6889b24a16542618f1e2c14b86ac Author: Dan McGee <dan(a)archlinux.org> Date: Sun Mar 27 20:48:26 2011 -0500 Temporary fix for new warnings from gcc 4.6 Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 3f269503d53811cf45037022a263f2447e427a0b Merge: 630b7b9 ea216d3 Author: Dan McGee <dan(a)archlinux.org> Date: Sun Mar 27 20:41:23 2011 -0500 Merge branch 'maint' Conflicts: lib/libalpm/deps.c commit 630b7b94c39ddc60d4e2b3c80d5d9f3101049b93 Author: Ray Kohler <ataraxia937(a)gmail.com> Date: Fri Mar 25 19:25:38 2011 -0400 Sign database even if empty Move the create_signature() call outside the case of non-empty databases, so it will be called regardless. Signed-off-by: Ray Kohler <ataraxia937(a)gmail.com> Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 43dacceb6bba837aceba331c31ed8d8ee7a9e1d5 Author: Ray Kohler <ataraxia937(a)gmail.com> Date: Fri Mar 25 21:32:21 2011 -0400 makepkg: allow PKGEXT and SRCEXT to be overridden by env variables Signed-off-by: Ray Kohler <ataraxia937(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> Signed-off-by: Dan McGee <dan(a)archlinux.org> commit c02556e2905dc1801d751db8cc3e96ccbedb76ab Author: Dave Reisner <d(a)falconindy.com> Date: Thu Mar 24 10:10:05 2011 -0400 Rely on the return value of type instead of its output Signed-off-by: Dave Reisner <d(a)falconindy.com> Signed-off-by: Dan McGee <dan(a)archlinux.org> commit a9fb4d9d5b065560f7e42378ad1ee3d2f7b19911 Author: Dave Reisner <d(a)falconindy.com> Date: Fri Mar 25 09:15:30 2011 -0400 lib/dload: abstract out helper function to set utimes This greatly simplifies the cleanup fallthrough in our download function and we'll be able to reuse this for signatures. Signed-off-by: Dave Reisner <d(a)falconindy.com> Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 98c8ab18ff7f48bb2074d821ad93b009fd4bac4c Author: Dave Reisner <d(a)falconindy.com> Date: Fri Mar 25 08:49:13 2011 -0400 lib/dload: remove proxy debug output Signed-off-by: Dave Reisner <d(a)falconindy.com> Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 33c08ac91e32e1c1fe135c42030f1a2b64a63a54 Author: Dave Reisner <d(a)falconindy.com> Date: Fri Mar 25 08:45:54 2011 -0400 lib/dload: code simplification Based on the fact that localf always points to the same file, there's no need to code in multiple fopen calls with varying results. Instead, track the desired file open mode and make a single call to fopen. Signed-off-by: Dave Reisner <d(a)falconindy.com> Signed-off-by: Dan McGee <dan(a)archlinux.org> commit fd64988c8085a410a80851e2b4b6b62ea59139c2 Author: Dave Reisner <d(a)falconindy.com> Date: Fri Mar 25 08:37:02 2011 -0400 lib/dload: merge get_{destfile,tempfile} into get_fullpath Create a more general function that allows appending a suffix to a filepath. Signed-off-by: Dave Reisner <d(a)falconindy.com> Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 55f790ebe49ebf5a7d2084682735fd75f6d4903b Author: Dave Reisner <d(a)falconindy.com> Date: Thu Mar 17 18:33:34 2011 -0400 pacman/pacman.c: fix setting of useragent string libcurl doesn't natively honor the HTTP_USER_AGENT environment variable. Signed-off-by: Dave Reisner <d(a)falconindy.com> Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 283bf7e87cab1fa187334830fe2d05dd28bc5b77 Author: Dave Reisner <d(a)falconindy.com> Date: Mon Mar 21 16:54:00 2011 -0400 lib/dload: pass a struct with filename and size to curl_progress This lets us determine the real size of the file on disk so that we can properly bump the progress bar when we're resuming a download. Signed-off-by: Dave Reisner <d(a)falconindy.com> Signed-off-by: Dan McGee <dan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: contrib/pacscripts.in | 2 +- lib/libalpm/be_package.c | 5 +- lib/libalpm/db.c | 1 + lib/libalpm/deps.c | 176 ++++++++++++++++++++------------------- lib/libalpm/deps.h | 6 -- lib/libalpm/dload.c | 135 +++++++++++++++--------------- lib/libalpm/dload.h | 6 ++ lib/libalpm/package.c | 16 ++-- scripts/makepkg.sh.in | 8 ++- scripts/pacman-db-upgrade.sh.in | 6 +- scripts/repo-add.sh.in | 7 +- src/pacman/pacman.c | 17 ++-- test/util/vercmptest.sh | 2 +- 13 files changed, 201 insertions(+), 186 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [GIT] The official pacman repository branch, maint, updated. v3.5.1-10-gea216d3
by dan＠archlinux.org 28 Mar '11

28 Mar '11

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, maint has been updated via ea216d3f5a84814c512ab51ac37a4055b82032c3 (commit) via 68701a98aff46821e7e3440d5db233adbe249770 (commit) via 3bc3999bd25647f9b64ea4b4995cad54a8066cc1 (commit) via 5a9a570dda81148fd9ce8ea46b3c57befa8535fe (commit) via c40fc6b80d4a97e3333afab6d2ce8290aaa29c46 (commit) via 7f480ccc0de9438ef499685088a49b3c5964606b (commit) via e214b260efcba299611688bdbbc02b7391632d43 (commit) from c37c9c5dcae06c1585b4da4c0b838f5b44e1498e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit ea216d3f5a84814c512ab51ac37a4055b82032c3 Author: Dan McGee <dan(a)archlinux.org> Date: Sun Mar 27 20:03:08 2011 -0500 Clarify error message in pacman-db-upgrade Addresses FS#23451. Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 68701a98aff46821e7e3440d5db233adbe249770 Author: Dan McGee <dan(a)archlinux.org> Date: Fri Mar 25 15:37:18 2011 -0500 Ensure reported missing dependencies show correct version comparison This addresses FS#23424. The -dd backend code was introduced in commit b6ec9019d77, and unfortunately the munged depend used for comparison did not carry through to the eventual display of this version. To fix this, we undo some of the depcmp_tolerant() business introduced, and instead make a new pmdepend_t object if necessary when the no dependency version flag is set. This results in the correct depend being copied to the missing depend passed onto the frontend. Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 3bc3999bd25647f9b64ea4b4995cad54a8066cc1 Author: Dan McGee <dan(a)archlinux.org> Date: Fri Mar 25 14:45:42 2011 -0500 Mark various functions in deps.c static Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 5a9a570dda81148fd9ce8ea46b3c57befa8535fe Author: Dan McGee <dan(a)archlinux.org> Date: Fri Mar 25 14:38:39 2011 -0500 Move alpm_find_dbs_satisfier() function down in deps.c This will make sense for a later commit when static/non-static properties of other functions are changed. Signed-off-by: Dan McGee <dan(a)archlinux.org> commit c40fc6b80d4a97e3333afab6d2ce8290aaa29c46 Author: Dan McGee <dan(a)archlinux.org> Date: Fri Mar 25 15:34:39 2011 -0500 Rework find_requiredby() to not use _alpm_dep_edge() And move the sort after the final loop; we don't need to sort once for each database we look at. Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 7f480ccc0de9438ef499685088a49b3c5964606b Author: Dan McGee <dan(a)archlinux.org> Date: Fri Mar 25 14:51:31 2011 -0500 Don't include version in dep string if mod == ANY Signed-off-by: Dan McGee <dan(a)archlinux.org> commit e214b260efcba299611688bdbbc02b7391632d43 Author: Dan McGee <dan(a)archlinux.org> Date: Fri Mar 25 13:47:27 2011 -0500 Update usage instruction strings * Address FS#23433 by documenting -d vs. -dd * Drop the useless "as well", "also", "too", and "that won't break packages" strings from -R usage * Fix alignment of multiline strings in source (no string change) Signed-off-by: Dan McGee <dan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: lib/libalpm/deps.c | 176 ++++++++++++++++++++------------------- lib/libalpm/deps.h | 6 -- lib/libalpm/package.c | 16 ++-- scripts/pacman-db-upgrade.sh.in | 6 +- src/pacman/pacman.c | 17 ++-- 5 files changed, 113 insertions(+), 108 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] inconsistent behaviour in handle.c
by Rémy Oudompheng 27 Mar '11

27 Mar '11

Hello, The functions defined in handle.c seem to have an inconsistent behaviour. Many of them check that handle is not NULL before acting, and set pm_errno to PM_ERR_HANDLE_NULL if so. But others do not, and segfault if used before alpm_initialize() is called. Is there a rationale behind that or should it be patched? Regards, Rémy.

2 1

[pacman-dev] [namcap] Released version 3.0.3
by Rémy Oudompheng 27 Mar '11

27 Mar '11

Hello, I have released and packaged namcap 3.0.3. It includes Dan's patches for the PKGBUILD analysis and a fix for the dangling symlink detection. I hope this will be the last bugfix release before the move from [testing] to [extra]. Regards, Rémy.

3 3

[pacman-dev] [RFC] Replacing wget with curl in makepkg
by Dave Reisner 27 Mar '11

27 Mar '11

The attached patch proposes to replace wget with curl as the default DLAGENT in makepkg for http, https, and ftp. This seems like the sane choice given our switch from fetch to curl. dave

3 2

[pacman-dev] pacman-key imports and key trust levels
by Ray Kohler 26 Mar '11

26 Mar '11

So, after a couple of days of messing around (and fixing random things here and there), I was able to go end-to-end, verifying a signed repo DB, and then installing a signed package from that repo. Very nice! I ended up testing out the failure case on verifying signatures a bit more than I wanted, though, as I something surprised me: When importing keys with pacman-key, they keys themselves are imported fine, but they are not marked as sufficiently trusted that the signatures are worth anything. I just imported my "real" GPG pubring (which has nothing in it but my own key) with "pacman-key -a ~/.gnupg/pubring.gpg", and used that same key to sign a package and add that package to a signed repo. GPGme returns "unknown key" when asked to verify these sigs, so pacman flunks them as "invalid signature". After editing the trustdb to mark this key as "ultimate" (hey, it's my own key after all), everything worked. So, my question is, where does the fault lie? Did I make some wrong assumption? Should pacman-key set high levels of trust on keys it imports? Should alpm configure GPGme with trust-level=always? While I'm talking about signing stuff - I noticed an open question on what to do with the downloaded DB if sig verification fails. I suggest it be deleted, and the sig be deleted also. These are generally small files, and it feels really wrong to keep a file "live" on my disk which has been declared untrustworthy.

4 4

[pacman-dev] [PATCH] Renamed --trust to --edit-key
by Richard Alex Hofer 26 Mar '11

26 Mar '11

Hi, I'm very new here, but hope this saves someone a minute or two. Fixes the first thing on the TODO list "TODO: rename the --trust option to --edit-key". Tried sending this before, but I think I messed something up. Also, looks like the date is way off. From fb1fe43baa5e46de09d102a29669de250bd4d065 Mon Sep 17 00:00:00 2001 From: Richard A Hofer <atomic.quark(a)gmail.com> Date: Fri, 25 Mar 2011 17:39:30 -0400 Subject: [PATCH] Renamed --trust to --edit-key and -t to -k (for Key) --- scripts/pacman-key.sh.in | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 5746e64..bb05429 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -66,7 +66,7 @@ usage() { echo "$(gettext " -h, --help This help")" echo "$(gettext " -l, --list List keys")" echo "$(gettext " -r, --receive <keyserver> <keyid(s)> Fetch the specified keyids")" - echo "$(gettext " -t, --trust <keyid(s)> Set the trust level of the given keyids")" + echo "$(gettext " -k, --edit-key <keyid(s)> Set the trust level of the given keyids")" echo "$(gettext " -u, --updatedb Update the trustdb of pacman")" echo "$(gettext " -V, --version Show program version")" echo "$(gettext " --adv <params> Use pacman's keyring with advanced gpg commands")" @@ -290,7 +290,7 @@ case "${command}" in shift ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys "$@" ;; - -t|--trust) + -k|--edit-key) if (( $# == 0 )); then error "$(gettext "You need to specify at least one key identifier")" exit 1 -- 1.7.4.1

3 2

[pacman-dev] [PATCH] makepkg: command line options for signing packages
by Allan McRae 26 Mar '11

26 Mar '11

From: Denis A. Altoé Falqueto <denisfalqueto(a)gmail.com> Three new command line options were added: --sign: forces the generation of a signature for the resulting package, taking precedence over the value in makepkg.conf --nosign: do not sign the resulting package --key <key>: use a different key than the user's default for signing the package. A check is performed to ensure the user has (provided) a valid gpg for signing. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- This is a patch originially supplied by Denis a few weeks back that got a bit lost with preparing for release of pacman-3.5. I made some minor changes: 1) removed the short option for --sign. This is overriding the default set in makepkg.conf so no need for a short option 2) changed --signwithkey to just --key as I found the longer option name too long 3) simplified the checking for if we need to sign the package @Denis: I'm sure you would have made these changes if I had asked, but with the delay from me in re-review this patch, I figured it was only fair for me to make the small changes and get it done! scripts/makepkg.sh.in | 41 ++++++++++++++++++++++++++++++++++++----- 1 files changed, 36 insertions(+), 5 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 5742c49..c8ac6a4 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -28,7 +28,7 @@ # makepkg uses quite a few external programs during its execution. You # need to have at least the following installed for makepkg to function: # awk, bsdtar (libarchive), bzip2, coreutils, fakeroot, file, find (findutils), -# gettext, grep, gzip, openssl, sed, tput (ncurses), xz +# gettext, gpg, grep, gzip, openssl, sed, tput (ncurses), xz # gettext initialization export TEXTDOMAIN='pacman' @@ -75,6 +75,7 @@ CHECKFUNC=0 PKGFUNC=0 SPLITPKG=0 PKGLIST=() +SIGNPKG='' # Forces the pkgver of the current PKGBUILD. Used by the fakeroot call # when dealing with svn/cvs/etc PKGBUILDs. @@ -1106,7 +1107,7 @@ create_package() { } create_signature() { - if [[ $(check_buildenv sign) != "y" ]]; then + if [[ $SIGNPKG != 'y' ]]; then return fi local ret=0 @@ -1116,7 +1117,15 @@ create_signature() { error "$(gettext "Cannot find the gpg binary! Is gnupg installed?")" exit 1 # $E_MISSING_PROGRAM fi - gpg --detach-sign --use-agent "$filename" || ret=$? + + local SIGNWITHKEY="" + if [[ -n $SIGNKEY ]]; then + SIGNWITHKEY="-u ${SIGNKEY}" + fi + # The signature will be generated directly in ascii-friendly format + gpg --detach-sign --use-agent ${SIGNWITHKEY} "$filename" &>/dev/null || ret=$? + + if (( ! ret )); then msg2 "$(gettext "Created signature file %s.")" "$filename.sig" else @@ -1615,8 +1624,11 @@ usage() { printf "$(gettext " --check Run the check() function in the %s")\n" "$BUILDSCRIPT" printf "$(gettext " --config <file> Use an alternate config file (instead of '%s')")\n" "$confdir/makepkg.conf" printf "$(gettext " --holdver Prevent automatic version bumping for development %ss")\n" "$BUILDSCRIPT" + echo "$(gettext " --key <key> Specify a key to use for gpg signing instead of the default")" printf "$(gettext " --nocheck Do not run the check() function in the %s")\n" "$BUILDSCRIPT" + echo "$(gettext " --nosign Do not create a signature for the package")" echo "$(gettext " --pkg <list> Only build listed packages from a split package")" + echo "$(gettext " --sign Sign the resulting package with gpg")" echo "$(gettext " --skipinteg Do not fail when integrity checks are missing")" echo "$(gettext " --source Generate a source-only tarball without downloaded sources")" echo @@ -1653,8 +1665,8 @@ ARGLIST=("$@") OPT_SHORT="AcCdefFghiLmop:rRsV" OPT_LONG="allsource,asroot,ignorearch,check,clean,cleancache,nodeps" OPT_LONG+=",noextract,force,forcever:,geninteg,help,holdver" -OPT_LONG+=",install,log,nocolor,nobuild,nocheck,pkg:,rmdeps" -OPT_LONG+=",repackage,skipinteg,source,syncdeps,version,config:" +OPT_LONG+=",install,key:,log,nocolor,nobuild,nocheck,nosign,pkg:,rmdeps" +OPT_LONG+=",repackage,skipinteg,sign,source,syncdeps,version,config:" # Pacman Options OPT_LONG+=",noconfirm,noprogressbar" OPT_TEMP="$(parse_options $OPT_SHORT $OPT_LONG "$@" || echo 'PARSE_OPTIONS FAILED')" @@ -1688,15 +1700,18 @@ while true; do -g|--geninteg) GENINTEG=1 ;; --holdver) HOLDVER=1 ;; -i|--install) INSTALL=1 ;; + --key) shift; SIGNKEY=$1 ;; -L|--log) LOGGING=1 ;; -m|--nocolor) USE_COLOR='n' ;; --nocheck) RUN_CHECK='n' ;; + --nosign) SIGNPKG='n' ;; -o|--nobuild) NOBUILD=1 ;; -p) shift; BUILDFILE=$1 ;; --pkg) shift; PKGLIST=($1) ;; -r|--rmdeps) RMDEPS=1 ;; -R|--repackage) REPKG=1 ;; --skipinteg) SKIPINTEG=1 ;; + --sign) SIGNPKG='y' ;; --source) SOURCEONLY=1 ;; -s|--syncdeps) DEP_BIN=1 ;; @@ -1927,6 +1942,22 @@ if [[ -n "${PKGLIST[@]}" ]]; then pkgname=("${PKGLIST[@]}") fi +# check if gpg signature is to be created and if signing key is valid +if [[ -z "$SIGNPKG" && $(check_buildenv sign) == 'y' ]]; then + SIGNPKG='y' +fi +if [[ $SIGNPKG == 'y' ]]; then + if ! gpg --list-key ${SIGNKEY} &>/dev/null; then + if [[ ! -z $SIGNKEY ]]; then + error "$(gettext "The key ${SIGNKEY} does not exist in your keyring.")" + else + error "$(gettext "There is no key in your keyring.")" + fi + exit 1 + fi +fi + + if (( ! SPLITPKG )); then fullver=$(get_full_version $epoch $pkgver $pkgrel) if [[ -f $PKGDEST/${pkgname}-${fullver}-${CARCH}${PKGEXT} \ -- 1.7.4.1

1 0