November 2012 - Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH 0/8] [RFC] Signature checking overhaul
by Allan McRae 07 Nov '12

07 Nov '12

The main change here is that pacman will now check the needed keys are in the keyring before doing package validation. Example output: :: Retrieving packages ... systemd-sysvcompat-... 5.4 KiB 671K/s 00:00 [######################] 100% (1/1) checking keys in keyring [######################] 100% :: Import PGP key 2048R/F56C0C53, "Dave Reisner <d(a)falconindy.com>", created: 2011-06-26? [Y/n] (1/1) checking package integrity [######################] 100% (1/1) loading package files [######################] 100% This removed the repeat validation after key downloading and made the following much easier to implement: 1) packages with bad signatures get the "pkg is corrupt, delete?" type message 2) pacman -U now downloads a signature if needed. These patches need a very good review... Allan McRae (8): Make key_in_keychain available in library Move key importing into separate function Add function to extract key id from signatures Make decode_signature available to the library Check keys are in keyring before package validation Remove retry path from signature validation Prompt to delete packages with signature fails Import key if needed when installing package from file lib/libalpm/alpm.h | 9 ++- lib/libalpm/be_package.c | 40 ++++++++++ lib/libalpm/signing.c | 197 ++++++++++++++++++++++++++++++++++++++--------- lib/libalpm/signing.h | 7 ++ lib/libalpm/sync.c | 87 ++++++++++++++++++--- src/pacman/callback.c | 9 +++ 6 files changed, 300 insertions(+), 49 deletions(-) -- 1.8.0

3 14

[pacman-dev] [PATCH 1/2] Restore ability for $PACMAN to include arguments and document it
by Martin Panter 03 Nov '12

03 Nov '12

Unmangled version: https://github.com/vadmium/pacman-arch/commit/70b1327.patch >From 70b1327c0443818d163e10b649ba882a4fd5a0f3 Mon Sep 17 00:00:00 2001 From: Martin Panter <vadmium à gmail·com> Date: Wed, 31 Oct 2012 03:05:42 +0000 Subject: [PATCH] Restore ability for $PACMAN to include arguments and document it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Judging by the “${PACMAN%% *}” incantation from revision 66c6d28 (makepkg: allow to specify an alternative pacman command), it looks like this was consciously intended. Currently, including arguments in $PACMAN means the --syncdeps operation may be attempted, but each Pacman invocation will probably fail. However in other cases the operation would be skipped if $PACMAN cannot be found. Looks like this inconsistency comes from revision 622326b (makepkg: fix sudo/su calling of pacman). --- doc/makepkg.8.txt | 3 ++- scripts/makepkg.sh.in | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/doc/makepkg.8.txt b/doc/makepkg.8.txt index 9d19e38..8b440a3 100644 --- a/doc/makepkg.8.txt +++ b/doc/makepkg.8.txt @@ -196,7 +196,8 @@ Environment Variables The command that will be used to check for missing dependencies and to install and remove packages. Pacman's -Qq, -Rns, -S, -T, and -U operations must be supported by this command. If the variable is not - set or empty, makepkg will fall back to `pacman'. + set or empty, makepkg will fall back to `pacman'. The variable may + include command arguments, separated with spaces. **PKGDEST=**"/path/to/folder":: Folder where the resulting packages will be stored. Overrides the diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index d387b7d..3b4f27f 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -873,9 +873,9 @@ source_has_signatures() { run_pacman() { local cmd if [[ ! $1 = -@(T|Qq) ]]; then - cmd=("$PACMAN" $PACMAN_OPTS "$@") + cmd=($PACMAN $PACMAN_OPTS "$@") else - cmd=("$PACMAN" "$@") + cmd=($PACMAN "$@") fi if (( ! ASROOT )) && [[ ! $1 = -@(T|Qq) ]]; then if type -p sudo >/dev/null; then -- 1.7.12

2 3

[pacman-dev] [PATCH 2/2] Save path to Pacman, which could be lost during --syncdeps operation
by Martin Panter 03 Nov '12

03 Nov '12

Unmangled version: https://github.com/vadmium/pacman-arch/commit/b984a8b.patch Turns out it wasn’t too hard to allow spaces in the path returned from “command -v”, while handling any extra arguments. >From b984a8b2cb3daa05177420d1a9d83648d6c0aa0d Mon Sep 17 00:00:00 2001 From: Martin Panter <vadmium à gmail·com> Date: Wed, 31 Oct 2012 02:45:36 +0000 Subject: [PATCH] Save path to Pacman, which could be lost during --syncdeps operation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Access to the Pacman command could be lost when /etc/profile is invoked and $PATH is reset. Tested to make sure the following scenarios behave sensibly, where “roopwn” is in ~/bin/: PACMAN="pacman --config /etc/pacman.conf" makepkg --syncdeps --install PACMAN="nonexistent --dummy" makepkg --syncdeps --install PACMAN="nonexistent --dummy" makepkg PACMAN="roopwn --verbose" makepkg --syncdeps --install --- scripts/makepkg.sh.in | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 3b4f27f..2b224b8 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -873,9 +873,9 @@ source_has_signatures() { run_pacman() { local cmd if [[ ! $1 = -@(T|Qq) ]]; then - cmd=($PACMAN $PACMAN_OPTS "$@") + cmd=("${PACMAN[@]}" $PACMAN_OPTS "$@") else - cmd=($PACMAN "$@") + cmd=("${PACMAN[@]}" "$@") fi if (( ! ASROOT )) && [[ ! $1 = -@(T|Qq) ]]; then if type -p sudo >/dev/null; then @@ -898,7 +898,7 @@ check_deps() { if (( ret == 127 )); then #unresolved deps printf "%s\n" "$pmout" elif (( ret )); then - error "$(gettext "'%s' returned a fatal error (%i): %s")" "$PACMAN" "$ret" "$pmout" + error "$(gettext "'%s' returned a fatal error (%i): %s")" "${PACMAN[*]}" "$ret" "$pmout" return "$ret" fi } @@ -920,7 +920,7 @@ handle_deps() { msg "$(gettext "Installing missing dependencies...")" if ! run_pacman -S --asdeps $deplist; then - error "$(gettext "'%s' failed to install missing dependencies.")" "$PACMAN" + error "$(gettext "'%s' failed to install missing dependencies.")" "${PACMAN[*]}" exit 1 # TODO: error code fi fi @@ -1899,9 +1899,9 @@ install_package() { (( ! INSTALL )) && return if (( ! SPLITPKG )); then - msg "$(gettext "Installing package %s with %s...")" "$pkgname" "$PACMAN -U" + msg "$(gettext "Installing package %s with %s...")" "$pkgname" "${PACMAN[*]} -U" else - msg "$(gettext "Installing %s package group with %s...")" "$pkgbase" "$PACMAN -U" + msg "$(gettext "Installing %s package group with %s...")" "$pkgbase" "${PACMAN[*]} -U" fi local fullver pkgarch pkg pkglist @@ -2457,8 +2457,9 @@ if [[ $MAKEPKG_CONF = "$confdir/makepkg.conf" && -r ~/.makepkg.conf ]]; then source_safe ~/.makepkg.conf fi -# set pacman command if not already defined -PACMAN=${PACMAN:-pacman} +# Set pacman command if not already defined. Convert to Bash array so that +# spaces can be included in the path while any arguments are retained. +PACMAN=(${PACMAN:-pacman}) # check if messages are to be printed using color unset ALL_OFF BOLD BLUE GREEN RED YELLOW @@ -2728,7 +2729,11 @@ if (( NODEPS || (NOBUILD && !DEP_BIN ) )); then if (( NODEPS )); then warning "$(gettext "Skipping dependency checks.")" fi -elif type -p "${PACMAN%% *}" >/dev/null; then +elif output="$(command -v "$PACMAN")"; then + # Save full path to Pacman in case the --syncdeps operation modifies + # the $PATH and makes it inaccessible + PACMAN="$output" + if (( RMDEPS && ! INSTALL )); then original_pkglist=($(run_pacman -Qq)) # required by remove_dep fi @@ -2757,7 +2762,7 @@ elif type -p "${PACMAN%% *}" >/dev/null; then exit 1 fi else - warning "$(gettext "%s was not found in %s; skipping dependency checks.")" "${PACMAN%% *}" "PATH" + warning "$(gettext "%s was not found in %s; skipping dependency checks.")" "$PACMAN" "PATH" fi # ensure we have a sane umask set -- 1.7.12

3 6

[pacman-dev] Tar backend for local db
by Allan McRae 01 Nov '12

01 Nov '12

I was thinking about the local database backend in pacman and how we could improve it. The tar-based backed for sync dbs have been quite a success. Ever since we did that, I have been wanting to do the same with the local database. But there were two issues: 1) tar is not designed for removing and updating files in place 2) with a directory/files per package structure, we are quite robust to corruption as a single file effects only a single package. Well... I have a cunning plan... How about we do both! Have the local database in a tarball but also extracted. All reading is done from the tarball, so -Q operations would be fast due to not require reading from lots of small files. With an operation that adds/removes/updates a package, the local database is still read from the tarball, but the modifications are done on the files backend and then the tarball is recreated at the end. We could even be efficient during the recreation and read all the old files from the old tarball and only read the new files from the filesystem (which will be in the kernel cache...). This would also give another use for "pacman -D" - an option could be added to recreate the local db tarball - in case it became corrupt or the files were manually edited. What do people think?

8 12