March 2012 - Pacman-dev - lists.archlinux.org

[pacman-dev] [GIT] The official pacman repository branch, maint, updated. v4.0.2-20-g1a8c3e5
by dan＠archlinux.org 09 Mar '12

09 Mar '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, maint has been updated via 1a8c3e52d70bfa21ba108aa77179adf90401949d (commit) via 1fe6cabc4d3868510427e32b60c9aa869886acab (commit) from 4ffa0401d22347332d663f1d400e182d5a181ea2 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 1a8c3e52d70bfa21ba108aa77179adf90401949d Author: Dave Reisner <dreisner(a)archlinux.org> Date: Fri Mar 2 19:25:15 2012 -0500 makepkg: exit via default signal handler in trap_exit Similar to how we manage receipt of SIGINT in pacman's internal downloader, catch the signal and invoke our own trap handler before unsetting it and calling the default. This requires a slight modification to the arguments passed to trap_exit so we can pass the raised signal to trap_exit (note that we substitue USR1 for ERR since the latter is unique to bash). Fixes FS#28491. Signed-off-by: Dave Reisner <dreisner(a)archlinux.org> Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 1fe6cabc4d3868510427e32b60c9aa869886acab Author: Pierre Schmitz <pierre(a)archlinux.de> Date: Sun Mar 4 13:25:56 2012 +0100 pacman-key: Remove useless signature verification in --populate command Verifing the keyring at this point is useless as a malicious package is already installed and as such has several options to bypass this check anyway. Signed-off-by: Pierre Schmitz <pierre(a)archlinux.de> Signed-off-by: Dan McGee <dan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: doc/pacman-key.8.txt | 5 ----- scripts/makepkg.sh.in | 13 +++++++++---- scripts/pacman-key.sh.in | 39 --------------------------------------- 3 files changed, 9 insertions(+), 48 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [PATCH] pacman-optimize: standardize on openssl usage, only touch local/
by Dan McGee 08 Mar '12

08 Mar '12

The rest of our scripts have been using `openssl dgst` rather than tools like `md5sum` for some time, so convert this one too. We also make the following other adjustments: * Use a `find -print0 | xargs -0` pipeline so paths with spaces and or newlines don't totally kill us. * Ensure the files we write out contain only paths relative to the database root, where we know the filenames should all be sane. * Remove use of `diff`, this was the only time we used it in scripts and we can get a cheap substitute by comparing file checksums instead. * Only touch the local/ part of the database. It makes little sense to do anything to the sync/ directory anymore as they are compressed single files that should be regularly written out in full and won't be fragmented on any sane filesystem. Signed-off-by: Dan McGee <dan(a)archlinux.org> --- scripts/pacman-optimize.sh.in | 45 +++++++++++++++++++++-------------------- 1 file changed, 23 insertions(+), 22 deletions(-) diff --git a/scripts/pacman-optimize.sh.in b/scripts/pacman-optimize.sh.in index d80435c..4a84c0b 100644 --- a/scripts/pacman-optimize.sh.in +++ b/scripts/pacman-optimize.sh.in @@ -88,9 +88,8 @@ if [[ -n $1 ]]; then dbroot="$1" fi -# make sure diff is installed -if ! type diff >/dev/null 2>&1; then - die "$(gettext "diff tool was not found, please install diffutils.")" +if ! type -p openssl >/dev/null; then + die "$(gettext "Cannot find the %s binary required for verifying integrity.")" "openssl" fi if [[ ! -d $dbroot || ! -d $dbroot/local ]]; then @@ -103,8 +102,8 @@ fi # strip any trailing slash from our dbroot dbroot="${dbroot%/}" -# form the path to our lockfile location lockfile="${dbroot}/db.lck" +localdb="${dbroot}/local" # make sure pacman isn't running if [[ -f $lockfile ]]; then @@ -118,37 +117,39 @@ workdir=$(mktemp -d "${TMPDIR:-/tmp}/pacman-optimize.XXXXXXXXXX") || # step 1: sum the old db msg "$(gettext "MD5sum'ing the old database...")" -find "$dbroot" -type f | sort | xargs md5sum > "$workdir/pacsums.old" +(cd "$localdb" && find . -type f -print0 | \ + xargs -0 openssl dgst -md5 | sort > "$workdir/pacsums.old") # step 2: tar it up -msg "$(gettext "Tar'ing up %s...")" "$dbroot" -bsdtar -czf "$workdir/pacman-db.tar.gz" -C "$dbroot" ./ +msg "$(gettext "Tar'ing up %s...")" "$localdb" +bsdtar -czf "$workdir/pacman-db.tar.gz" -C "$localdb" ./ if (( $? )); then rm -rf "$workdir" - die_r "$(gettext "Tar'ing up %s failed.")" "$dbroot" + die_r "$(gettext "Tar'ing up %s failed.")" "$localdb" fi # step 3: make and sum the new db side-by-side with the old msg "$(gettext "Making and MD5sum'ing the new database...")" -mkdir "$dbroot.new" -bsdtar -xpf "$workdir/pacman-db.tar.gz" -C "$dbroot.new" +mkdir "$localdb.new" +bsdtar -xpf "$workdir/pacman-db.tar.gz" -C "$localdb.new" if (( $? )); then rm -rf "$workdir" - die_r "$(gettext "Untar'ing %s failed.")" "$dbroot" + die_r "$(gettext "Untar'ing %s failed.")" "$localdb" fi # immediate sync following extraction should get it written continuously on HDD msg "$(gettext "Syncing database to disk...")" sync -find "$dbroot.new" -type f | sort | \ - xargs md5sum | sed 's#.new##' > "$workdir/pacsums.new" +(cd "$localdb.new" && find . -type f -print0 | \ + xargs -0 openssl dgst -md5 | sort > "$workdir/pacsums.new") # step 4: compare the sums msg "$(gettext "Checking integrity...")" -diff "$workdir/pacsums.old" "$workdir/pacsums.new" >/dev/null 2>&1 -if (( $? )); then +read -ra old_dgst < <(openssl dgst -md5 < "$workdir/pacsums.old") +read -ra new_dgst < <(openssl dgst -md5 < "$workdir/pacsums.new") +if [[ ${old_dgst[@]:(-1)} != ${new_dgst[@]:(-1)} ]]; then # failed # leave our pacman-optimize tmpdir for checking to see what doesn't match up - rm -rf "$dbroot.new" + rm -rf "$localdb.new" die_r "$(gettext "Integrity check FAILED, reverting to old database.")" fi @@ -156,15 +157,15 @@ fi msg "$(gettext "Rotating database into place...")" fail=0 -mv "$dbroot" "$dbroot.old" || fail=1 -mv "$dbroot.new" "$dbroot" || fail=1 -chmod --reference="$dbroot.old" "$dbroot" || fail=1 -chown --reference="$dbroot.old" "$dbroot" || fail=1 +mv "$localdb" "$localdb.old" || fail=1 +mv "$localdb.new" "$localdb" || fail=1 +chmod --reference="$localdb.old" "$localdb" || fail=1 +chown --reference="$localdb.old" "$localdb" || fail=1 if (( fail )); then # failure with our directory shuffle - die_r "$(gettext "New database substitution failed. Check for $dbroot,\n$dbroot.old, and $dbroot.new directories.")" + die_r "$(gettext "New database substitution failed. Check for %s, %s, and %s directories.")" "$localdb" "$localdb.old" "$localdb.new" fi -rm -rf "$dbroot.old" +rm -rf "$localdb.old" # remove the lock file and our working directory with sums and tarfile rm -f "$lockfile" -- 1.7.9.3

1 0

[pacman-dev] [PATCH 1/2] Allow alpm_depend_t to have a description
by Dan McGee 08 Mar '12

08 Mar '12

This is the first step in parsing and handling optdepends. There is no behavior change introduced in this commit; however, depends that contain a ": " string will now be parsed as having a description and it will be stored in the depend structure. Later patches will utilize this new field as appropriate. This is heavily based on the work of Benedikt, who did something similar but introduced a new type for this rather than only a new field to the existing type. Heavily-influenced-by: Benedikt Morbach <benedikt.morbach(a)googlemail.com> Signed-off-by: Dan McGee <dan(a)archlinux.org> --- lib/libalpm/alpm.h | 1 + lib/libalpm/deps.c | 44 +++++++++++++++++++++++++++++++------------- 2 files changed, 32 insertions(+), 13 deletions(-) diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index 5f587d3..8a418dc 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -136,6 +136,7 @@ typedef struct __alpm_trans_t alpm_trans_t; typedef struct _alpm_depend_t { char *name; char *version; + char *desc; unsigned long name_hash; alpm_depmod_t mod; } alpm_depend_t; diff --git a/lib/libalpm/deps.c b/lib/libalpm/deps.c index eda0648..6069f5e 100644 --- a/lib/libalpm/deps.c +++ b/lib/libalpm/deps.c @@ -39,6 +39,7 @@ void _alpm_dep_free(alpm_depend_t *dep) { FREE(dep->name); FREE(dep->version); + FREE(dep->desc); FREE(dep); } @@ -409,7 +410,7 @@ int _alpm_depcmp(alpm_pkg_t *pkg, alpm_depend_t *dep) alpm_depend_t *_alpm_splitdep(const char *depstring) { alpm_depend_t *depend; - const char *ptr, *version; + const char *ptr, *version, *desc; size_t deplen; if(depstring == NULL) { @@ -417,7 +418,17 @@ alpm_depend_t *_alpm_splitdep(const char *depstring) } MALLOC(depend, sizeof(alpm_depend_t), return NULL); - deplen = strlen(depstring); + + /* Note the extra space in ": " to avoid matching the epoch */ + if((desc = strstr(depstring, ": ")) != NULL) { + STRDUP(depend->desc, desc + 2, return NULL); + deplen = desc - depstring; + } else { + /* no description- point desc at NULL at end of string for later use */ + depend->desc = NULL; + deplen = strlen(depstring); + desc = depstring + deplen; + } /* Find a version comparator if one exists. If it does, set the type and * increment the ptr accordingly so we can copy the right strings. */ @@ -442,21 +453,18 @@ alpm_depend_t *_alpm_splitdep(const char *depstring) depend->mod = ALPM_DEP_MOD_EQ; version = ptr + 1; } else { - /* no version specified, leave ptr NULL and set version to NULL */ + /* no version specified, set ptr to end of string and version to NULL */ + ptr = depstring + deplen; depend->mod = ALPM_DEP_MOD_ANY; depend->version = NULL; version = NULL; } /* copy the right parts to the right places */ - if(ptr) { - STRNDUP(depend->name, depstring, ptr - depstring, return NULL); - } else { - STRDUP(depend->name, depstring, return NULL); - } + STRNDUP(depend->name, depstring, ptr - depstring, return NULL); depend->name_hash = _alpm_hash_sdbm(depend->name); if(version) { - STRDUP(depend->version, version, return NULL); + STRNDUP(depend->version, version, desc - version, return NULL); } return depend; @@ -468,8 +476,9 @@ alpm_depend_t *_alpm_dep_dup(const alpm_depend_t *dep) CALLOC(newdep, 1, sizeof(alpm_depend_t), return NULL); STRDUP(newdep->name, dep->name, return NULL); - newdep->name_hash = dep->name_hash; STRDUP(newdep->version, dep->version, return NULL); + STRDUP(newdep->desc, dep->desc, return NULL); + newdep->name_hash = dep->name_hash; newdep->mod = dep->mod; return newdep; @@ -792,7 +801,7 @@ int _alpm_resolvedeps(alpm_handle_t *handle, alpm_list_t *localpkgs, */ char SYMEXPORT *alpm_dep_compute_string(const alpm_depend_t *dep) { - const char *name, *opr, *ver; + const char *name, *opr, *ver, *desc_delim, *desc; char *str; size_t len; @@ -834,12 +843,21 @@ char SYMEXPORT *alpm_dep_compute_string(const alpm_depend_t *dep) ver = ""; } + if(dep->desc) { + desc_delim = ": "; + desc = dep->desc; + } else { + desc_delim = ""; + desc = ""; + } + /* we can always compute len and print the string like this because opr * and ver will be empty when ALPM_DEP_MOD_ANY is the depend type. the * reassignments above also ensure we do not do a strlen(NULL). */ - len = strlen(name) + strlen(opr) + strlen(ver) + 1; + len = strlen(name) + strlen(opr) + strlen(ver) + + strlen(desc_delim) + strlen(desc) + 1; MALLOC(str, len, return NULL); - snprintf(str, len, "%s%s%s", name, opr, ver); + snprintf(str, len, "%s%s%s%s%s", name, opr, ver, desc_delim, desc); return str; } -- 1.7.9.3

1 1

[pacman-dev] Mirroring with Deltas - Established Procedure
by Brendan Hide 06 Mar '12

06 Mar '12

Hi all Is there an established procedure to add deltas to an existing rsync-maintained mirror server? The tools that come with pacman (pkgdelta and repo-add) appear to be aimed at maintaining your own repository rather than with mirroring an existing repository. -- __________ Brendan Hide Mobile: +27 83 448 3867 Web Africa - Internet Business Solutions http://www.webafrica.co.za/?AFF1E97

2 2

[pacman-dev] [GIT] The official pacman repository branch, maint, updated. v4.0.2-18-g4ffa040
by dan＠archlinux.org 05 Mar '12

05 Mar '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, maint has been updated via 4ffa0401d22347332d663f1d400e182d5a181ea2 (commit) via cb64fbeac41308ee8c46384a126195a1fd75a361 (commit) via ea7fc8962a819a04237876995140363a818202d4 (commit) via fbfcd8665086f71b65370e919105194111b4b5f1 (commit) via 986e99a613605985f64f0e3e4c2635717931f77d (commit) via 4b384b7f0b0e840e09e3bffd2dbb59b88bdd4864 (commit) via d1151b5ab9c407732ded462a0fe0259dea8dcc2a (commit) from 78adb71f20ee335dff49e34d33f04817a40002b6 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 4ffa0401d22347332d663f1d400e182d5a181ea2 Author: Dan McGee <dan(a)archlinux.org> Date: Thu Feb 23 10:35:38 2012 -0600 Translation updates from Transifex * it updates to all translations * minor fr, pt_BR, de, lt, sk and uk updates * add new strings in pacman translation catalog Signed-off-by: Dan McGee <dan(a)archlinux.org> commit cb64fbeac41308ee8c46384a126195a1fd75a361 Author: Allan McRae <allan(a)archlinux.org> Date: Fri Feb 24 21:40:20 2012 +1000 Do not dereference symlinks when calculating size Passing the "-L" flag to stat means we get the size of the file being pointed to for symlinks instead of the size of the symlink. Keep "-L" usage in repo-add as we want the actual size of the package/delta/signature there. Signed-off-by: Allan McRae <allan(a)archlinux.org> commit ea7fc8962a819a04237876995140363a818202d4 Author: Florian Pritz <bluewind(a)xinu.at> Date: Sun Mar 4 19:23:25 2012 +0100 makepkg: fix false error with multiple libdeps With multiple items in $libdepends this check only worked for the first one, everything after this returned an error. This was probably an issue with \s being treated wrong. Fix-by: Dave Reisner <dreisner(a)archlinux.org> Signed-off-by: Florian Pritz <bluewind(a)xinu.at> commit fbfcd8665086f71b65370e919105194111b4b5f1 Author: Florian Pritz <bluewind(a)xinu.at> Date: Sun Mar 4 19:17:21 2012 +0100 makepkg: fix extraction of soname in find_libdepends libperl.so results in soname="libperl.so.so" which is wrong. This returns the correct string: "libperl.so" Fix-by: Dave Reisner <dreisner(a)archlinux.org> Signed-off-by: Florian Pritz <bluewind(a)xinu.at> commit 986e99a613605985f64f0e3e4c2635717931f77d Author: Dan McGee <dan(a)archlinux.org> Date: Wed Feb 29 16:47:39 2012 -0600 Fix a potential memory leak in filelist creation If we begin to create a file list when loading a package, but abort because of an error to one of our goto labels, the memory used to create the file list will leak. This is because we use a set of local variables to hold the data, and thus _alpm_pkg_free() cannot clean up for us. Use the file list struct on the package object as much as possible to keep state when building the file list, thus allowing _alpm_pkg_free() to clean up any partially built data. Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 4b384b7f0b0e840e09e3bffd2dbb59b88bdd4864 Author: Dan McGee <dan(a)archlinux.org> Date: Wed Feb 29 16:33:21 2012 -0600 Fix a memory leak when loading an invalid package This is easily triggered via a `pacman -Sc` operation when it attempts to open a delta file as a package- we end up leaking loads of memory due to us never freeing the archive object. When you have upwards of 1200 delta files in your sync database directory, this results in a memory leak of nearly 1.5 MiB. Also fix another memory leak noticed at the same time- we need to call the internal _alpm_pkg_free() function, as without the origin data being set the public free function will do nothing. Signed-off-by: Dan McGee <dan(a)archlinux.org> commit d1151b5ab9c407732ded462a0fe0259dea8dcc2a Author: Dan McGee <dan(a)archlinux.org> Date: Wed Feb 29 15:51:54 2012 -0600 Database cleanup enhancements Ensure we give database signatures special treatment like we already did for package signatures. Attempt to parse the database name out of them before taking the proper steps to handle their existence. This fixes FS#28714. We also add an unlink_verbose() helper method that displays any errors that occur when unlinking, optionally opting to skip any ENOENT errors from being fatal. Finally, the one prompt per unknown database has been removed, this has no real sound purpose and we don't do this for packages. Simply kill databases we don't know about; other programs shouldn't have random data in this directory anyway. Signed-off-by: Dan McGee <dan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: configure.ac | 6 +- lib/libalpm/be_package.c | 38 ++++++---- lib/libalpm/po/it.po | 76 ++++++++++--------- scripts/makepkg.sh.in | 5 +- scripts/po/it.po | 185 +++++++++++++++++++++------------------------- scripts/po/sk.po | 10 +- scripts/po/uk.po | 23 +++--- scripts/repo-add.sh.in | 6 +- src/pacman/po/de.po | 42 ++++++----- src/pacman/po/en_GB.po | 41 ++++++---- src/pacman/po/fi.po | 18 ++--- src/pacman/po/fr.po | 45 ++++++------ src/pacman/po/it.po | 127 +++++++++++++++++-------------- src/pacman/po/lt.po | 171 ++++++++++++++++++++++--------------------- src/pacman/po/pacman.pot | 22 ++--- src/pacman/po/pt_BR.po | 62 ++++++++-------- src/pacman/po/uk.po | 41 +++++----- src/pacman/sync.c | 71 +++++++++++------- 18 files changed, 514 insertions(+), 475 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] Why need keyrings to be signed?
by Pierre Schmitz 04 Mar '12

04 Mar '12

Hi all, while working on our keyring package again I am still stuck at this question. pacman-key --populate checks if the files to import are signed. The man page tell us: This prevents a potentially malicious repository adding keys to the pacman keyring without the users knowledge. But I don't get the reasoning here at all. If I install a malicious package, it's install function is run as root and can do anything; including bypassing the --populate function and call gpg directly. If I miss anything here please let me know as I couldn't find out. Removing this check would safe me from reinventing the wheel and I don't have to create a script which does exactly what --populate does but without the check. This check prevents us from a simple bootstrap; and we gain no improved security if we let the user do it manually. (think about what a malicious package would do) In details this means removing the call to verify_keyring_input in pacman-key and then remove the now unused functions verify_keyring_input and validate_with_gpg. Greetings, Pierre -- Pierre Schmitz, http://pierre-schmitz.com

2 2

[pacman-dev] Arguments for alpm_initialize
by Zameer Manji 01 Mar '12

01 Mar '12

Hello, This is my first time posting on this list, so my apologies if this is the incorrect place to ask for help. I've been trying to create a wrapper around libalpm for my own uses and I'm trying to get the project off the ground with a simple program: #include <alpm.h> #include <stdio.h> int main(void) { enum _alpm_errno_t errno = 0; alpm_handle_t* t = alpm_initialize("/", "/var/lib/pacman", &errno); if(t == NULL) { printf("Got APLM handle"); } else { printf("No Handle"); if(errno == 0) { printf("No Error Code Given"); } } alpm_release(t); return 0; } Currently the program outputs "No Handle" and "No Error Code Given". What can I do inorder to either get the handle correctly or get an error code so I can investigate further? -- - Zameer Manji

2 1