August 2017 - Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH] Check for all return values of _alpm_key_in_keychain
by David Phillips 24 Jan '19

24 Jan '19

This fixes a bug I encountered with a GPG keyring where the key id used to locate a key in the keyring was ambiguous within my keychain. This commit ensures that all valid return values are checked to catch this and related error cases rather than incorrectly taking an error case to mean the key was found, since this is rarely going to be the case. --- lib/libalpm/be_package.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/lib/libalpm/be_package.c b/lib/libalpm/be_package.c index 7e8b7920..1891fa5a 100644 --- a/lib/libalpm/be_package.c +++ b/lib/libalpm/be_package.c @@ -754,10 +754,21 @@ int SYMEXPORT alpm_pkg_load(alpm_handle_t *handle, const char *filename, int ful alpm_list_t *k; for(k = keys; k; k = k->next) { char *key = k->data; - if(_alpm_key_in_keychain(handle, key) == 0) { - if(_alpm_key_import(handle, key) == -1) { + switch(_alpm_key_in_keychain(handle, key)) { + case 1: + /* key is known; proceed */ + break; + case 0: + /* key is unknown; attempt to import */ + if(_alpm_key_import(handle, key) == -1) { + fail = 1; + } + break; + case -1: + /* error finding key in keychain */ + default: fail = 1; - } + break; } } FREELIST(keys); -- 2.12.2

3 3

[pacman-dev] [PATCH 0/4][WIP] makepkg test suite
by Andrew Gregory 20 Sep '18

20 Sep '18

The long-awaited makepkg test suite is finally here, or at least the start of it. The tests can be run via `make check` or they can also be run directly. Included so far are a few tests for package generation and a single libmakepkg test for some of the util/pkgbuild functions. I made some small changes to the lib in order to make it easier to use and to allow stricter error checking in the test suite (set -u). Andrew Gregory (4): util/pkgbuild: guard against unset variable util/pkgbuild: manually set extglob util/pkgbuild: fix broken indentation add basic makepkg test Makefile.am | 6 +- configure.ac | 2 + scripts/libmakepkg/util/pkgbuild.sh.in | 23 +++--- test/makepkg/Makefile.am | 9 +++ test/makepkg/README | 15 ++++ test/makepkg/test_functions.sh | 143 +++++++++++++++++++++++++++++++++ test/makepkg/tests/Makefile.am | 7 ++ test/makepkg/tests/TESTS | 4 + test/makepkg/tests/dbfiles.sh | 35 ++++++++ test/makepkg/tests/dotfiles.sh | 33 ++++++++ test/makepkg/tests/pkgbuild.sh | 53 ++++++++++++ test/makepkg/tests/util-pkgbuild.sh | 35 ++++++++ 12 files changed, 355 insertions(+), 10 deletions(-) create mode 100644 test/makepkg/Makefile.am create mode 100644 test/makepkg/README create mode 100644 test/makepkg/test_functions.sh create mode 100644 test/makepkg/tests/Makefile.am create mode 100644 test/makepkg/tests/TESTS create mode 100755 test/makepkg/tests/dbfiles.sh create mode 100755 test/makepkg/tests/dotfiles.sh create mode 100755 test/makepkg/tests/pkgbuild.sh create mode 100755 test/makepkg/tests/util-pkgbuild.sh -- 2.11.1

5 13

[pacman-dev] [PATCH 1/3] makepkg: refactor archive compression for reusability
by Eli Schwartz 19 Sep '18

19 Sep '18

This allows for more easily extending the list of allowed compression methods, as it has to be modified in only one place. Also allow the user to specify their own preferred command + options for source packages in addition to compiled packages. Currently, makepkg.conf(5) erroneously claims this is already possible. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- I'm not 100% sure how to handle this, perhaps it should encompass bsdtar/$pkg_file as well? scripts/makepkg.sh.in | 57 ++++++++++++++++++++++++++------------------------- 1 file changed, 29 insertions(+), 28 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 20e9dd7e..a5c216dd 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -698,6 +698,26 @@ list_package_files() { sed -e 's|^\./||' | tr '\n' '\0' } +# Wrapper around many stream compression formats, for use in the middle of a +# pipeline. A tar archive is passed on stdin and compressed to stdout. +compress_as() { + # $1: final archive filename extension for compression type detection + + local ext="$1" + + case "$ext" in + *tar.gz) ${COMPRESSGZ[@]:-gzip -c -f -n} ;; + *tar.bz2) ${COMPRESSBZ2[@]:-bzip2 -c -f} ;; + *tar.xz) ${COMPRESSXZ[@]:-xz -c -z -} ;; + *tar.lrz) ${COMPRESSLRZ[@]:-lrzip -q} ;; + *tar.lzo) ${COMPRESSLZO[@]:-lzop -q} ;; + *tar.Z) ${COMPRESSZ[@]:-compress -c -f} ;; + *tar) cat ;; + *) warning "$(gettext "'%s' is not a valid archive extension.")" \ + "$ext"; cat ;; + esac +} + create_package() { (( NOARCHIVE )) && return @@ -748,21 +768,8 @@ create_package() { msg2 "$(gettext "Compressing package...")" # TODO: Maybe this can be set globally for robustness shopt -s -o pipefail - # bsdtar's gzip compression always saves the time stamp, making one - # archive created using the same command line distinct from another. - # Disable bsdtar compression and use gzip -n for now. list_package_files | LANG=C bsdtar -cnf - --null --files-from - | - case "$PKGEXT" in - *tar.gz) ${COMPRESSGZ[@]:-gzip -c -f -n} ;; - *tar.bz2) ${COMPRESSBZ2[@]:-bzip2 -c -f} ;; - *tar.xz) ${COMPRESSXZ[@]:-xz -c -z -} ;; - *tar.lrz) ${COMPRESSLRZ[@]:-lrzip -q} ;; - *tar.lzo) ${COMPRESSLZO[@]:-lzop -q} ;; - *tar.Z) ${COMPRESSZ[@]:-compress -c -f} ;; - *tar) cat ;; - *) warning "$(gettext "'%s' is not a valid archive extension.")" \ - "$PKGEXT"; cat ;; - esac > "${pkg_file}" || ret=$? + compress_as "$PKGEXT" > "${pkg_file}" || ret=$? shopt -u -o pipefail @@ -843,26 +850,20 @@ create_srcpackage() { done done - local TAR_OPT - case "$SRCEXT" in - *tar.gz) TAR_OPT="-z" ;; - *tar.bz2) TAR_OPT="-j" ;; - *tar.xz) TAR_OPT="-J" ;; - *tar.lrz) TAR_OPT="--lrzip" ;; - *tar.lzo) TAR_OPT="--lzop" ;; - *tar.Z) TAR_OPT="-Z" ;; - *tar) TAR_OPT="" ;; - *) warning "$(gettext "'%s' is not a valid archive extension.")" \ - "$SRCEXT" ;; - esac - local fullver=$(get_full_version) local pkg_file="$SRCPKGDEST/${pkgbase}-${fullver}${SRCEXT}" # tar it up msg2 "$(gettext "Compressing source package...")" cd_safe "${srclinks}" - if ! LANG=C bsdtar -cL ${TAR_OPT} -f "$pkg_file" ${pkgbase}; then + + # TODO: Maybe this can be set globally for robustness + shopt -s -o pipefail + LANG=C bsdtar -cLf - ${pkgbase} | compress_as "$SRCEXT" > "${pkg_file}" || ret=$? + + shopt -u -o pipefail + + if (( ret )); then error "$(gettext "Failed to create source package file.")" exit 1 # TODO: error code fi -- 2.14.1

2 18

[pacman-dev] [PATCH] libmakepkg: Add missing vim modelines
by Eli Schwartz 03 May '18

03 May '18

This conforms with the rest of the pacman codebase. The modelines appear to have been mistakenly dropped when libmakepkg was separated out into separate files from the original monolithic makepkg script. Signed-off-by: Eli Schwartz <eschwartz93(a)gmail.com> --- scripts/libmakepkg/integrity.sh.in | 2 ++ scripts/libmakepkg/integrity/generate_checksum.sh.in | 2 ++ scripts/libmakepkg/integrity/generate_signature.sh.in | 2 ++ scripts/libmakepkg/integrity/verify_checksum.sh.in | 2 ++ scripts/libmakepkg/integrity/verify_signature.sh.in | 2 ++ scripts/libmakepkg/lint_package.sh.in | 2 ++ scripts/libmakepkg/lint_package/build_references.sh.in | 2 ++ scripts/libmakepkg/lint_package/dotfiles.sh.in | 2 ++ scripts/libmakepkg/lint_package/file_names.sh.in | 2 ++ scripts/libmakepkg/lint_package/missing_backup.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/arch.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/backup.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/changelog.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/epoch.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/install.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/optdepends.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/options.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/package_function.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/pkgbase.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/pkglist.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/pkgname.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/pkgrel.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/pkgver.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/provides.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/source.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/util.sh.in | 2 ++ scripts/libmakepkg/lint_pkgbuild/variable.sh.in | 2 ++ scripts/libmakepkg/source.sh.in | 2 ++ scripts/libmakepkg/source/bzr.sh.in | 2 ++ scripts/libmakepkg/source/file.sh.in | 2 ++ scripts/libmakepkg/source/git.sh.in | 2 ++ scripts/libmakepkg/source/hg.sh.in | 2 ++ scripts/libmakepkg/source/local.sh.in | 2 ++ scripts/libmakepkg/source/svn.sh.in | 2 ++ scripts/libmakepkg/srcinfo.sh.in | 2 ++ scripts/libmakepkg/tidy.sh.in | 2 ++ scripts/libmakepkg/tidy/docs.sh.in | 2 ++ scripts/libmakepkg/tidy/emptydirs.sh.in | 2 ++ scripts/libmakepkg/tidy/libtool.sh.in | 2 ++ scripts/libmakepkg/tidy/purge.sh.in | 2 ++ scripts/libmakepkg/tidy/staticlibs.sh.in | 2 ++ scripts/libmakepkg/tidy/strip.sh.in | 2 ++ scripts/libmakepkg/tidy/zipman.sh.in | 2 ++ scripts/libmakepkg/util.sh.in | 2 ++ scripts/libmakepkg/util/message.sh.in | 2 ++ scripts/libmakepkg/util/option.sh.in | 2 ++ scripts/libmakepkg/util/parseopts.sh.in | 2 ++ scripts/libmakepkg/util/pkgbuild.sh.in | 2 ++ scripts/libmakepkg/util/source.sh.in | 2 ++ scripts/libmakepkg/util/util.sh.in | 2 ++ 51 files changed, 102 insertions(+) diff --git a/scripts/libmakepkg/integrity.sh.in b/scripts/libmakepkg/integrity.sh.in index 3a77ef16..68177884 100644 --- a/scripts/libmakepkg/integrity.sh.in +++ b/scripts/libmakepkg/integrity.sh.in @@ -43,3 +43,5 @@ check_source_integrity() { check_pgpsigs "$@" fi } + +# vim: set noet: diff --git a/scripts/libmakepkg/integrity/generate_checksum.sh.in b/scripts/libmakepkg/integrity/generate_checksum.sh.in index 902a989e..35dbb7cc 100644 --- a/scripts/libmakepkg/integrity/generate_checksum.sh.in +++ b/scripts/libmakepkg/integrity/generate_checksum.sh.in @@ -100,3 +100,5 @@ generate_checksums() { done done } + +# vim: set noet: diff --git a/scripts/libmakepkg/integrity/generate_signature.sh.in b/scripts/libmakepkg/integrity/generate_signature.sh.in index 060ae344..732df131 100644 --- a/scripts/libmakepkg/integrity/generate_signature.sh.in +++ b/scripts/libmakepkg/integrity/generate_signature.sh.in @@ -47,3 +47,5 @@ create_signature() { warning "$(gettext "Failed to sign package file.")" fi } + +# vim: set noet: diff --git a/scripts/libmakepkg/integrity/verify_checksum.sh.in b/scripts/libmakepkg/integrity/verify_checksum.sh.in index 1a11a082..b194b9fe 100644 --- a/scripts/libmakepkg/integrity/verify_checksum.sh.in +++ b/scripts/libmakepkg/integrity/verify_checksum.sh.in @@ -128,3 +128,5 @@ verify_integrity_sums() { return 1 fi } + +# vim: set noet: diff --git a/scripts/libmakepkg/integrity/verify_signature.sh.in b/scripts/libmakepkg/integrity/verify_signature.sh.in index b5577523..2f02b337 100644 --- a/scripts/libmakepkg/integrity/verify_signature.sh.in +++ b/scripts/libmakepkg/integrity/verify_signature.sh.in @@ -267,3 +267,5 @@ source_has_signatures() { done return 1 } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_package.sh.in b/scripts/libmakepkg/lint_package.sh.in index ff0894ec..5043dc24 100644 --- a/scripts/libmakepkg/lint_package.sh.in +++ b/scripts/libmakepkg/lint_package.sh.in @@ -46,3 +46,5 @@ lint_package() { done return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_package/build_references.sh.in b/scripts/libmakepkg/lint_package/build_references.sh.in index 9183fce9..29347d2e 100644 --- a/scripts/libmakepkg/lint_package/build_references.sh.in +++ b/scripts/libmakepkg/lint_package/build_references.sh.in @@ -39,3 +39,5 @@ warn_build_references() { done return 0 } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_package/dotfiles.sh.in b/scripts/libmakepkg/lint_package/dotfiles.sh.in index 9842028c..cf6ef749 100644 --- a/scripts/libmakepkg/lint_package/dotfiles.sh.in +++ b/scripts/libmakepkg/lint_package/dotfiles.sh.in @@ -36,3 +36,5 @@ check_dotfiles() { done return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_package/file_names.sh.in b/scripts/libmakepkg/lint_package/file_names.sh.in index 0b8e7a03..657489bd 100644 --- a/scripts/libmakepkg/lint_package/file_names.sh.in +++ b/scripts/libmakepkg/lint_package/file_names.sh.in @@ -40,3 +40,5 @@ lint_file_names() { return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_package/missing_backup.sh.in b/scripts/libmakepkg/lint_package/missing_backup.sh.in index 934dd12f..bb2f3f3e 100644 --- a/scripts/libmakepkg/lint_package/missing_backup.sh.in +++ b/scripts/libmakepkg/lint_package/missing_backup.sh.in @@ -37,3 +37,5 @@ warn_missing_backup() { done return 0 } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild.sh.in b/scripts/libmakepkg/lint_pkgbuild.sh.in index d3a1a083..c126c662 100644 --- a/scripts/libmakepkg/lint_pkgbuild.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild.sh.in @@ -44,3 +44,5 @@ lint_pkgbuild() { return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/arch.sh.in b/scripts/libmakepkg/lint_pkgbuild/arch.sh.in index ddc2f29e..79377f36 100644 --- a/scripts/libmakepkg/lint_pkgbuild/arch.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/arch.sh.in @@ -62,3 +62,5 @@ lint_arch() { return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/backup.sh.in b/scripts/libmakepkg/lint_pkgbuild/backup.sh.in index 5b37b4e9..9ead0a8d 100644 --- a/scripts/libmakepkg/lint_pkgbuild/backup.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/backup.sh.in @@ -49,3 +49,5 @@ lint_backup() { return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/changelog.sh.in b/scripts/libmakepkg/lint_pkgbuild/changelog.sh.in index 264ea105..d7c5f1ca 100644 --- a/scripts/libmakepkg/lint_pkgbuild/changelog.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/changelog.sh.in @@ -45,3 +45,5 @@ lint_changelog() { return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/epoch.sh.in b/scripts/libmakepkg/lint_pkgbuild/epoch.sh.in index cc11d975..7c56b77b 100644 --- a/scripts/libmakepkg/lint_pkgbuild/epoch.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/epoch.sh.in @@ -35,3 +35,5 @@ lint_epoch() { return 1 fi } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/install.sh.in b/scripts/libmakepkg/lint_pkgbuild/install.sh.in index 3e268923..1435ec95 100644 --- a/scripts/libmakepkg/lint_pkgbuild/install.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/install.sh.in @@ -44,3 +44,5 @@ lint_install() { return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/optdepends.sh.in b/scripts/libmakepkg/lint_pkgbuild/optdepends.sh.in index f5fdbb90..7fc2d98e 100644 --- a/scripts/libmakepkg/lint_pkgbuild/optdepends.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/optdepends.sh.in @@ -62,3 +62,5 @@ lint_optdepends() { return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/options.sh.in b/scripts/libmakepkg/lint_pkgbuild/options.sh.in index ffcd19e3..d5b0bd48 100644 --- a/scripts/libmakepkg/lint_pkgbuild/options.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/options.sh.in @@ -55,3 +55,5 @@ lint_options() { return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/package_function.sh.in b/scripts/libmakepkg/lint_pkgbuild/package_function.sh.in index 14398217..f1c97279 100644 --- a/scripts/libmakepkg/lint_pkgbuild/package_function.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/package_function.sh.in @@ -49,3 +49,5 @@ lint_package_function() { return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/pkgbase.sh.in b/scripts/libmakepkg/lint_pkgbuild/pkgbase.sh.in index 911e1128..e697d813 100644 --- a/scripts/libmakepkg/lint_pkgbuild/pkgbase.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/pkgbase.sh.in @@ -48,3 +48,5 @@ lint_pkgbase() { return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/pkglist.sh.in b/scripts/libmakepkg/lint_pkgbuild/pkglist.sh.in index 8c09ad5b..64d76d92 100644 --- a/scripts/libmakepkg/lint_pkgbuild/pkglist.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/pkglist.sh.in @@ -42,3 +42,5 @@ lint_pkglist() { return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/pkgname.sh.in b/scripts/libmakepkg/lint_pkgbuild/pkgname.sh.in index b66eda68..bb749f37 100644 --- a/scripts/libmakepkg/lint_pkgbuild/pkgname.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/pkgname.sh.in @@ -60,3 +60,5 @@ lint_pkgname() { return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/pkgrel.sh.in b/scripts/libmakepkg/lint_pkgbuild/pkgrel.sh.in index b5cdfcf1..8c7a9bdd 100644 --- a/scripts/libmakepkg/lint_pkgbuild/pkgrel.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/pkgrel.sh.in @@ -40,3 +40,5 @@ lint_pkgrel() { return 1 fi } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/pkgver.sh.in b/scripts/libmakepkg/lint_pkgbuild/pkgver.sh.in index 0ec6584c..727f054c 100644 --- a/scripts/libmakepkg/lint_pkgbuild/pkgver.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/pkgver.sh.in @@ -49,3 +49,5 @@ lint_pkgver() { check_pkgver $pkgver } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/provides.sh.in b/scripts/libmakepkg/lint_pkgbuild/provides.sh.in index f521d0f5..ab3cd9b0 100644 --- a/scripts/libmakepkg/lint_pkgbuild/provides.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/provides.sh.in @@ -60,3 +60,5 @@ lint_provides() { return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/source.sh.in b/scripts/libmakepkg/lint_pkgbuild/source.sh.in index 052b9d54..c9cbe9f3 100644 --- a/scripts/libmakepkg/lint_pkgbuild/source.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/source.sh.in @@ -37,3 +37,5 @@ lint_source() { return 1 fi } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/util.sh.in b/scripts/libmakepkg/lint_pkgbuild/util.sh.in index e8a35933..1eb1eb74 100644 --- a/scripts/libmakepkg/lint_pkgbuild/util.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/util.sh.in @@ -39,3 +39,5 @@ check_files_exist() { return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/lint_pkgbuild/variable.sh.in b/scripts/libmakepkg/lint_pkgbuild/variable.sh.in index 1e749638..78df84a5 100644 --- a/scripts/libmakepkg/lint_pkgbuild/variable.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/variable.sh.in @@ -105,3 +105,5 @@ lint_variable() { return $ret } + +# vim: set noet: diff --git a/scripts/libmakepkg/source.sh.in b/scripts/libmakepkg/source.sh.in index 234e35e4..42e70d67 100644 --- a/scripts/libmakepkg/source.sh.in +++ b/scripts/libmakepkg/source.sh.in @@ -111,3 +111,5 @@ extract_sources() { esac done } + +# vim: set noet: diff --git a/scripts/libmakepkg/source/bzr.sh.in b/scripts/libmakepkg/source/bzr.sh.in index 97206714..69529f4b 100644 --- a/scripts/libmakepkg/source/bzr.sh.in +++ b/scripts/libmakepkg/source/bzr.sh.in @@ -104,3 +104,5 @@ extract_bzr() { popd &>/dev/null } + +# vim: set noet: diff --git a/scripts/libmakepkg/source/file.sh.in b/scripts/libmakepkg/source/file.sh.in index 1d85ea9b..5e724249 100644 --- a/scripts/libmakepkg/source/file.sh.in +++ b/scripts/libmakepkg/source/file.sh.in @@ -145,3 +145,5 @@ extract_file() { chown -R 0:0 "$srcdir" fi } + +# vim: set noet: diff --git a/scripts/libmakepkg/source/git.sh.in b/scripts/libmakepkg/source/git.sh.in index 6d7e0a67..8129a717 100644 --- a/scripts/libmakepkg/source/git.sh.in +++ b/scripts/libmakepkg/source/git.sh.in @@ -120,3 +120,5 @@ extract_git() { popd &>/dev/null } + +# vim: set noet: diff --git a/scripts/libmakepkg/source/hg.sh.in b/scripts/libmakepkg/source/hg.sh.in index 4e6ebad9..6a3e863d 100644 --- a/scripts/libmakepkg/source/hg.sh.in +++ b/scripts/libmakepkg/source/hg.sh.in @@ -102,3 +102,5 @@ extract_hg() { popd &>/dev/null } + +# vim: set noet: diff --git a/scripts/libmakepkg/source/local.sh.in b/scripts/libmakepkg/source/local.sh.in index 8104141a..bfb93f8e 100644 --- a/scripts/libmakepkg/source/local.sh.in +++ b/scripts/libmakepkg/source/local.sh.in @@ -40,3 +40,5 @@ download_local() { exit 1 # $E_MISSING_FILE fi } + +# vim: set noet: diff --git a/scripts/libmakepkg/source/svn.sh.in b/scripts/libmakepkg/source/svn.sh.in index 6cb78235..2fafadfe 100644 --- a/scripts/libmakepkg/source/svn.sh.in +++ b/scripts/libmakepkg/source/svn.sh.in @@ -91,3 +91,5 @@ extract_svn() { cp -au "$dir" "$srcdir" } + +# vim: set noet: diff --git a/scripts/libmakepkg/srcinfo.sh.in b/scripts/libmakepkg/srcinfo.sh.in index 99f5628a..f627f88d 100644 --- a/scripts/libmakepkg/srcinfo.sh.in +++ b/scripts/libmakepkg/srcinfo.sh.in @@ -125,3 +125,5 @@ write_srcinfo() { write_srcinfo_header write_srcinfo_content } + +# vim: set noet: diff --git a/scripts/libmakepkg/tidy.sh.in b/scripts/libmakepkg/tidy.sh.in index 856f2394..ce7d879d 100644 --- a/scripts/libmakepkg/tidy.sh.in +++ b/scripts/libmakepkg/tidy.sh.in @@ -50,3 +50,5 @@ tidy_install() { $func done } + +# vim: set noet: diff --git a/scripts/libmakepkg/tidy/docs.sh.in b/scripts/libmakepkg/tidy/docs.sh.in index 0919f201..31617c81 100644 --- a/scripts/libmakepkg/tidy/docs.sh.in +++ b/scripts/libmakepkg/tidy/docs.sh.in @@ -35,3 +35,5 @@ tidy_docs() { rm -rf -- ${DOC_DIRS[@]} fi } + +# vim: set noet: diff --git a/scripts/libmakepkg/tidy/emptydirs.sh.in b/scripts/libmakepkg/tidy/emptydirs.sh.in index 2b16afdf..9acf7f0f 100644 --- a/scripts/libmakepkg/tidy/emptydirs.sh.in +++ b/scripts/libmakepkg/tidy/emptydirs.sh.in @@ -37,3 +37,5 @@ tidy_emptydirs() { find . -depth -type d -exec rmdir '{}' \; 2>/dev/null fi } + +# vim: set noet: diff --git a/scripts/libmakepkg/tidy/libtool.sh.in b/scripts/libmakepkg/tidy/libtool.sh.in index b844c792..3690e7bc 100644 --- a/scripts/libmakepkg/tidy/libtool.sh.in +++ b/scripts/libmakepkg/tidy/libtool.sh.in @@ -36,3 +36,5 @@ tidy_libtool() { find . ! -type d -name "*.la" -exec rm -f -- '{}' + fi } + +# vim: set noet: diff --git a/scripts/libmakepkg/tidy/purge.sh.in b/scripts/libmakepkg/tidy/purge.sh.in index 5d37ded5..9c32e34d 100644 --- a/scripts/libmakepkg/tidy/purge.sh.in +++ b/scripts/libmakepkg/tidy/purge.sh.in @@ -43,3 +43,5 @@ tidy_purge() { done fi } + +# vim: set noet: diff --git a/scripts/libmakepkg/tidy/staticlibs.sh.in b/scripts/libmakepkg/tidy/staticlibs.sh.in index 643932dd..df0bb4ed 100644 --- a/scripts/libmakepkg/tidy/staticlibs.sh.in +++ b/scripts/libmakepkg/tidy/staticlibs.sh.in @@ -41,3 +41,5 @@ tidy_staticlibs() { done < <(find . ! -type d -name "*.a" -print0) fi } + +# vim: set noet: diff --git a/scripts/libmakepkg/tidy/strip.sh.in b/scripts/libmakepkg/tidy/strip.sh.in index 76562808..29218c4d 100644 --- a/scripts/libmakepkg/tidy/strip.sh.in +++ b/scripts/libmakepkg/tidy/strip.sh.in @@ -134,3 +134,5 @@ tidy_strip() { done fi } + +# vim: set noet: diff --git a/scripts/libmakepkg/tidy/zipman.sh.in b/scripts/libmakepkg/tidy/zipman.sh.in index ff82d43c..ca30118a 100644 --- a/scripts/libmakepkg/tidy/zipman.sh.in +++ b/scripts/libmakepkg/tidy/zipman.sh.in @@ -59,3 +59,5 @@ tidy_zipman() { -exec @INODECMD@ '{}' + 2>/dev/null) fi } + +# vim: set noet: diff --git a/scripts/libmakepkg/util.sh.in b/scripts/libmakepkg/util.sh.in index b7b56d34..7c8f9c98 100644 --- a/scripts/libmakepkg/util.sh.in +++ b/scripts/libmakepkg/util.sh.in @@ -26,3 +26,5 @@ LIBRARY=${LIBRARY:-'@libmakepkgdir@'} for lib in "$LIBRARY/util/"*.sh; do source "$lib" done + +# vim: set noet: diff --git a/scripts/libmakepkg/util/message.sh.in b/scripts/libmakepkg/util/message.sh.in index 33808de7..49ce025d 100644 --- a/scripts/libmakepkg/util/message.sh.in +++ b/scripts/libmakepkg/util/message.sh.in @@ -67,3 +67,5 @@ error() { local mesg=$1; shift printf "${RED}==> $(gettext "ERROR:")${ALL_OFF}${BOLD} ${mesg}${ALL_OFF}\n" "$@" >&2 } + +# vim: set noet: diff --git a/scripts/libmakepkg/util/option.sh.in b/scripts/libmakepkg/util/option.sh.in index 8cf0039b..2892cdfb 100644 --- a/scripts/libmakepkg/util/option.sh.in +++ b/scripts/libmakepkg/util/option.sh.in @@ -140,3 +140,5 @@ check_buildoption() { # not found return 127 } + +# vim: set noet: diff --git a/scripts/libmakepkg/util/parseopts.sh.in b/scripts/libmakepkg/util/parseopts.sh.in index a7638cf1..bd018cc8 100644 --- a/scripts/libmakepkg/util/parseopts.sh.in +++ b/scripts/libmakepkg/util/parseopts.sh.in @@ -171,3 +171,5 @@ parseopts() { return 0 } + +# vim: set noet: diff --git a/scripts/libmakepkg/util/pkgbuild.sh.in b/scripts/libmakepkg/util/pkgbuild.sh.in index 2a4bd3af..7f431394 100644 --- a/scripts/libmakepkg/util/pkgbuild.sh.in +++ b/scripts/libmakepkg/util/pkgbuild.sh.in @@ -218,3 +218,5 @@ get_integlist() { printf "%s\n" "${INTEGRITY_CHECK[@]}" fi } + +# vim: set noet: diff --git a/scripts/libmakepkg/util/source.sh.in b/scripts/libmakepkg/util/source.sh.in index 238d1f58..aeeca00a 100644 --- a/scripts/libmakepkg/util/source.sh.in +++ b/scripts/libmakepkg/util/source.sh.in @@ -169,3 +169,5 @@ get_downloadclient() { printf "%s\n" "$agent" } + +# vim: set noet: diff --git a/scripts/libmakepkg/util/util.sh.in b/scripts/libmakepkg/util/util.sh.in index d676249d..45070bea 100644 --- a/scripts/libmakepkg/util/util.sh.in +++ b/scripts/libmakepkg/util/util.sh.in @@ -83,3 +83,5 @@ cd_safe() { exit 1 fi } + +# vim: set noet: -- 2.11.0

4 8

[pacman-dev] [PATCH] hooks: warn if reassignment overwrites previous setting
by Stefan Klinger 14 Mar '18

14 Mar '18

In hook definition files, repeated assignment to Description, Exec, Type, and When silently overwrote previous settings. This yields a warning now. Signed-off-by: Stefan Klinger <git(a)stefan-klinger.de> --- lib/libalpm/hook.c | 15 ++++++++++++++- test/pacman/tests/TESTS | 4 ++++ test/pacman/tests/hook-description-reused.py | 23 +++++++++++++++++++++++ test/pacman/tests/hook-exec-reused.py | 22 ++++++++++++++++++++++ test/pacman/tests/hook-type-reused.py | 22 ++++++++++++++++++++++ test/pacman/tests/hook-when-reused.py | 22 ++++++++++++++++++++++ 6 files changed, 107 insertions(+), 1 deletion(-) create mode 100644 test/pacman/tests/hook-description-reused.py create mode 100644 test/pacman/tests/hook-exec-reused.py create mode 100644 test/pacman/tests/hook-type-reused.py create mode 100644 test/pacman/tests/hook-when-reused.py diff --git a/lib/libalpm/hook.c b/lib/libalpm/hook.c index ccde225e..51e74484 100644 --- a/lib/libalpm/hook.c +++ b/lib/libalpm/hook.c @@ -267,6 +267,7 @@ static int _alpm_hook_parse_cb(const char *file, int line, struct _alpm_hook_t *hook = ctx->hook; #define error(...) _alpm_log(handle, ALPM_LOG_ERROR, __VA_ARGS__); return 1; +#define warning(...) _alpm_log(handle, ALPM_LOG_WARNING, __VA_ARGS__); if(!section && !key) { error(_("error while reading hook %s: %s\n"), file, strerror(errno)); @@ -296,6 +297,9 @@ static int _alpm_hook_parse_cb(const char *file, int line, error(_("hook %s line %d: invalid value %s\n"), file, line, value); } } else if(strcmp(key, "Type") == 0) { + if(t->type != 0) { + warning(_("hook %s line %d: overwriting previous definition of Type\n"), file, line); + } if(strcmp(value, "Package") == 0) { t->type = ALPM_HOOK_TYPE_PACKAGE; } else if(strcmp(value, "File") == 0) { @@ -312,6 +316,9 @@ static int _alpm_hook_parse_cb(const char *file, int line, } } else if(strcmp(section, "Action") == 0) { if(strcmp(key, "When") == 0) { + if(hook->when != 0) { + warning(_("hook %s line %d: overwriting previous definition of When\n"), file, line); + } if(strcmp(value, "PreTransaction") == 0) { hook->when = ALPM_HOOK_PRE_TRANSACTION; } else if(strcmp(value, "PostTransaction") == 0) { @@ -320,6 +327,9 @@ static int _alpm_hook_parse_cb(const char *file, int line, error(_("hook %s line %d: invalid value %s\n"), file, line, value); } } else if(strcmp(key, "Description") == 0) { + if(hook->desc != NULL) { + warning(_("hook %s line %d: overwriting previous definition of Description\n"), file, line); + } STRDUP(hook->desc, value, return 1); } else if(strcmp(key, "Depends") == 0) { char *val; @@ -330,7 +340,10 @@ static int _alpm_hook_parse_cb(const char *file, int line, } else if(strcmp(key, "NeedsTargets") == 0) { hook->needs_targets = 1; } else if(strcmp(key, "Exec") == 0) { - if((hook->cmd = _alpm_wordsplit(value)) == NULL) { + if(hook->cmd != NULL) { + warning(_("hook %s line %d: overwriting previous definition of Exec\n"), file, line); + } + if((hook->cmd = _alpm_wordsplit(value)) == NULL) { if(errno == EINVAL) { error(_("hook %s line %d: invalid value %s\n"), file, line, value); } else { diff --git a/test/pacman/tests/TESTS b/test/pacman/tests/TESTS index 2d877962..4329ca90 100644 --- a/test/pacman/tests/TESTS +++ b/test/pacman/tests/TESTS @@ -53,6 +53,8 @@ TESTS += test/pacman/tests/fileconflict030.py TESTS += test/pacman/tests/fileconflict031.py TESTS += test/pacman/tests/fileconflict032.py TESTS += test/pacman/tests/hook-abortonfail.py +TESTS += test/pacman/tests/hook-description-reused.py +TESTS += test/pacman/tests/hook-exec-reused.py TESTS += test/pacman/tests/hook-exec-with-arguments.py TESTS += test/pacman/tests/hook-file-change-packages.py TESTS += test/pacman/tests/hook-file-remove-trigger-match.py @@ -63,7 +65,9 @@ TESTS += test/pacman/tests/hook-pkg-postinstall-trigger-match.py TESTS += test/pacman/tests/hook-pkg-remove-trigger-match.py TESTS += test/pacman/tests/hook-pkg-upgrade-trigger-match.py TESTS += test/pacman/tests/hook-target-list.py +TESTS += test/pacman/tests/hook-type-reused.py TESTS += test/pacman/tests/hook-upgrade-trigger-no-match.py +TESTS += test/pacman/tests/hook-when-reused.py TESTS += test/pacman/tests/ignore001.py TESTS += test/pacman/tests/ignore002.py TESTS += test/pacman/tests/ignore003.py diff --git a/test/pacman/tests/hook-description-reused.py b/test/pacman/tests/hook-description-reused.py new file mode 100644 index 00000000..5826a30e --- /dev/null +++ b/test/pacman/tests/hook-description-reused.py @@ -0,0 +1,23 @@ +self.description = "Hook using multiple Description's" + +self.add_hook("hook", + """ + [Trigger] + Type = Package + Operation = Install + Target = foo + + [Action] + Description = lala + Description = foobar + When = PreTransaction + Exec = /bin/date + """); + +sp = pmpkg("foo") +self.addpkg2db("sync", sp) + +self.args = "-S foo" + +self.addrule("PACMAN_RETCODE=0") +self.addrule("PACMAN_OUTPUT=warning.*overwriting previous definition of Description") diff --git a/test/pacman/tests/hook-exec-reused.py b/test/pacman/tests/hook-exec-reused.py new file mode 100644 index 00000000..6fe53151 --- /dev/null +++ b/test/pacman/tests/hook-exec-reused.py @@ -0,0 +1,22 @@ +self.description = "Hook using multiple Exec's" + +self.add_hook("hook", + """ + [Trigger] + Type = Package + Operation = Install + Target = foo + + [Action] + When = PostTransaction + Exec = /bin/date + Exec = /bin/date + """); + +sp = pmpkg("foo") +self.addpkg2db("sync", sp) + +self.args = "-S foo" + +self.addrule("PACMAN_RETCODE=0") +self.addrule("PACMAN_OUTPUT=warning.*overwriting previous definition of Exec") diff --git a/test/pacman/tests/hook-type-reused.py b/test/pacman/tests/hook-type-reused.py new file mode 100644 index 00000000..8c4dfd0f --- /dev/null +++ b/test/pacman/tests/hook-type-reused.py @@ -0,0 +1,22 @@ +self.description = "Hook using multiple Type's" + +self.add_hook("hook", + """ + [Trigger] + Type = Package + Type = File + Operation = Install + Target = foo + + [Action] + When = PostTransaction + Exec = /bin/date + """); + +sp = pmpkg("foo") +self.addpkg2db("sync", sp) + +self.args = "-S foo" + +self.addrule("PACMAN_RETCODE=0") +self.addrule("PACMAN_OUTPUT=warning.*overwriting previous definition of Type") diff --git a/test/pacman/tests/hook-when-reused.py b/test/pacman/tests/hook-when-reused.py new file mode 100644 index 00000000..07c3bc5e --- /dev/null +++ b/test/pacman/tests/hook-when-reused.py @@ -0,0 +1,22 @@ +self.description = "Hook using multiple When's" + +self.add_hook("hook", + """ + [Trigger] + Type = Package + Operation = Install + Target = foo + + [Action] + When = PreTransaction + Exec = /bin/date + When = PostTransaction + """); + +sp = pmpkg("foo") +self.addpkg2db("sync", sp) + +self.args = "-S foo" + +self.addrule("PACMAN_RETCODE=0") +self.addrule("PACMAN_OUTPUT=warning.*overwriting previous definition of When") -- 2.11.0

7 20

[pacman-dev] [PATCH] Allow query of file owners to work with non-existing files
by Vladimir Panteleev 05 Jan '18

05 Jan '18

Previously, attempting to query the owner of a file owned by some package but absent from the filesystem would fail. This could lead to a small annoyance - if a user or misbehaving software accidentally deleted a file owned by some package, and the user wishes to know which package it belonged to so that it can be restored, pacman would refuse to provide this information if the file no longer exists. Thus, allow file owner query to continue if the file does not exist. Print a warning in this situation and continue lookup using the exact user-provided path. Add test for this functionality accordingly. Signed-off-by: Vladimir Panteleev <archlinux(a)thecybershadow.net> --- src/pacman/query.c | 14 +++++++++++--- test/pacman/tests/TESTS | 1 + test/pacman/tests/query013.py | 10 ++++++++++ 3 files changed, 22 insertions(+), 3 deletions(-) create mode 100644 test/pacman/tests/query013.py diff --git a/src/pacman/query.c b/src/pacman/query.c index 024d3e21..bc27df8e 100644 --- a/src/pacman/query.c +++ b/src/pacman/query.c @@ -180,9 +180,16 @@ static int query_fileowner(alpm_list_t *targets) goto targcleanup; } } else { - pm_printf(ALPM_LOG_ERROR, _("failed to read file '%s': %s\n"), - filename, strerror(errno)); - goto targcleanup; + if (errno == ENOENT) { + pm_printf(ALPM_LOG_WARNING, _("file '%s' does not exist, not canonicalizing\n"), + filename); + strcpy(rpath, filename); + goto noent; + } else { + pm_printf(ALPM_LOG_ERROR, _("failed to read file '%s': %s\n"), + filename, strerror(errno)); + goto targcleanup; + } } } @@ -192,6 +199,7 @@ static int query_fileowner(alpm_list_t *targets) goto targcleanup; } +noent: if(strncmp(rpath, root, rootlen) != 0) { /* file is outside root, we know nothing can own it */ pm_printf(ALPM_LOG_ERROR, _("No package owns %s\n"), filename); diff --git a/test/pacman/tests/TESTS b/test/pacman/tests/TESTS index 309eb17e..344b1b49 100644 --- a/test/pacman/tests/TESTS +++ b/test/pacman/tests/TESTS @@ -109,6 +109,7 @@ TESTS += test/pacman/tests/query007.py TESTS += test/pacman/tests/query010.py TESTS += test/pacman/tests/query011.py TESTS += test/pacman/tests/query012.py +TESTS += test/pacman/tests/query013.py TESTS += test/pacman/tests/querycheck001.py TESTS += test/pacman/tests/querycheck002.py TESTS += test/pacman/tests/querycheck_fast_file_type.py diff --git a/test/pacman/tests/query013.py b/test/pacman/tests/query013.py new file mode 100644 index 00000000..b3c0a335 --- /dev/null +++ b/test/pacman/tests/query013.py @@ -0,0 +1,10 @@ +self.description = "Query ownership of non-existing file" + +sp = pmpkg("dummy", "1.0-1") +sp.files = ["etc/config"] +self.addpkg2db("local", sp) + +self.args = "-Qo %s/etc/config" % self.root + +self.addrule("PACMAN_RETCODE=0") +self.addrule("PACMAN_OUTPUT=/etc/config is owned by dummy 1.0-1$") -- 2.13.3

3 4

[pacman-dev] [Patch 1/1] Fix CVE-2016-5434 (DoS/loop and out of boundary read)
by Nils Freydank 20 Oct '17

20 Oct '17

This is a rewrite of Tobias Stoeckmann’s patch from June 2016[1] using functions instead of macros. (Thanks to Tobias for explanations of his patch.) A short question on Freenode IRC showed that macros are generally discouraged and functions should be used. The patch introduces size_t length_check() and applies it to libalpm/signing.c and signing.h. Feedback is very appreciated. [1] Original patch: https://lists.archlinux.org/pipermail/pacman-dev/2016-June/021148.html CVE request (and assignment): http://seclists.org/oss-sec/2016/q2/526 diff --git a/lib/libalpm/signing.c b/lib/libalpm/signing.c index 95cb3280..f7a9c9a8 100644 --- a/lib/libalpm/signing.c +++ b/lib/libalpm/signing.c @@ -986,6 +986,19 @@ int SYMEXPORT alpm_siglist_cleanup(alpm_siglist_t *siglist) return 0; } +/* Check to avoid out of boundary reads */ +size_t length_check(size_t length, size_t position, size_t a, + alpm_handle_t *handle, const char *identifier) +{ + if( a == 0 || length - position <= a) + { + _alpm_log(handle, ALPM_LOG_ERROR, \ + _("%s: signature format error"), identifier); + return -1; + } + else return 0; +} + /** * Extract the Issuer Key ID from a signature * @param sig PGP signature @@ -1021,19 +1034,22 @@ int SYMEXPORT alpm_extract_keyid(alpm_handle_t *handle, const char *identifier, } switch(sig[pos] & 0x03) { - case 0: - blen = sig[pos + 1]; - pos = pos + 2; + case 0: if( length_check(len, pos, 1, handle, identifier) ){ return -1; } + else blen = sig[pos + 1]; + if( length_check(len, pos, 2, handle, identifier) ){ return -1; } + else pos = pos + 2; break; - case 1: - blen = (sig[pos + 1] << 8) | sig[pos + 2]; - pos = pos + 3; + if( length_check(len, pos, 2, handle, identifier) ){ return -1; } + else blen = (sig[pos + 1] << 8) | sig[pos + 2]; + if( length_check(len, pos, 3, handle, identifier) ){ return -1; } + else pos = pos + 3; break; - case 2: - blen = (sig[pos + 1] << 24) | (sig[pos + 2] << 16) | (sig[pos + 3] << 8) | sig[pos + 4]; - pos = pos + 5; + case 2: if( length_check(len, pos, 4, handle, identifier) ){ return -1; } + else blen = (sig[pos + 1] << 24) | (sig[pos + 2] << 16) | (sig[pos + 3] << 8) | sig[pos + 4]; + if( length_check(len, pos, 5, handle, identifier) ){ return -1; } + else pos = pos + 5; break; case 3: @@ -1057,25 +1073,38 @@ int SYMEXPORT alpm_extract_keyid(alpm_handle_t *handle, const char *identifier, return -1; } - pos = pos + 4; + if( length_check(len, pos, 4, handle, identifier) ){ return -1; } + else pos = pos + 4; - hlen = (sig[pos] << 8) | sig[pos + 1]; - pos = pos + hlen + 2; + if( length_check(len, pos, 1, handle, identifier) ){ return -1; } + else hlen = (sig[pos] << 8) | sig[pos + 1]; - ulen = (sig[pos] << 8) | sig[pos + 1]; - pos = pos + 2; + if( length_check(len, pos, 2, handle, identifier) ){ return -1; } + else pos = pos + hlen + 2; + + if( length_check(len, pos, 1, handle, identifier) ){ return -1; } + else ulen = (sig[pos] << 8) | sig[pos + 1]; + + if( length_check(len, pos, 2, handle, identifier) ){ return -1; } + else pos = pos + 2; spos = pos; + if( length_check(len, pos, ulen, handle, identifier) ){ return -1; } + else while(spos < pos + ulen) { if(sig[spos] < 192) { slen = sig[spos]; - spos = spos + 1; + if( length_check(len + ulen, spos, 1, handle, identifier) ){ return -1; } + else spos = spos + 1; } else if(sig[spos] < 255) { - slen = (sig[spos] << 8) | sig[spos + 1]; - spos = spos + 2; + if( length_check(pos + ulen, spos, 1, handle, identifier) ){ return -1; } + else slen = (sig[spos] << 8) | sig[spos + 1]; + if( length_check(pos + ulen, spos, 2, handle, identifier) ){ return -1; } + else spos = spos + 2; } else { - slen = (sig[spos + 1] << 24) | (sig[spos + 2] << 16) | (sig[spos + 3] << 8) | sig[spos + 4]; + if( length_check(len, pos, 4, handle, identifier) ){ return -1; } + else slen = (sig[spos + 1] << 24) | (sig[spos + 2] << 16) | (sig[spos + 3] << 8) | sig[spos + 4]; spos = spos + 5; } @@ -1083,17 +1112,20 @@ int SYMEXPORT alpm_extract_keyid(alpm_handle_t *handle, const char *identifier, /* issuer key ID */ char key[17]; size_t i; + if( length_check(pos + ulen, spos, 8, handle, identifier) ){return -1; } + else{ for (i = 0; i < 8; i++) { sprintf(&key[i * 2], "%02X", sig[spos + i + 1]); } + } *keys = alpm_list_add(*keys, strdup(key)); break; } - - spos = spos + slen; + if( length_check(pos + ulen + 1, spos, slen, handle, identifier) ) {return -1; } + else spos = spos + slen; } - - pos = pos + (blen - hlen - 8); + if( length_check( blen, hlen, 8, handle, identifier ) ){return -1;} + else pos = pos + (blen - hlen - 8); } return 0; diff --git a/lib/libalpm/signing.h b/lib/libalpm/signing.h index 3507f584..a67bd900 100644 --- a/lib/libalpm/signing.h +++ b/lib/libalpm/signing.h @@ -36,4 +36,6 @@ int _alpm_key_import(alpm_handle_t *handle, const char *fpr); #endif /* ALPM_SIGNING_H */ +size_t length_check(size_t length, size_t position, size_t a, + alpm_handle_t *handle, const char *identifier); -- GPG fingerprint: '766B 8122 1342 6912 3401 492A 8B54 D7A3 FF3C DB17' Nils Freydank / Holgersson

3 8

[pacman-dev] [PATCH] Make the flags used for sed -i configurable
by Alastair Hughes 14 Sep '17

14 Sep '17

Not all sed implementations on linux accept the --follow-symlinks argument, so let the user configure the arguments passed to sed if required. Signed-off-by: Alastair Hughes <hobbitalastair(a)gmail.com> --- configure.ac | 14 ++++++++++---- scripts/Makefile.am | 3 ++- scripts/makepkg.sh.in | 4 ++-- 3 files changed, 14 insertions(+), 7 deletions(-) diff --git a/configure.ac b/configure.ac index 57f068d3..babb8fad 100644 --- a/configure.ac +++ b/configure.ac @@ -339,10 +339,10 @@ GCC_VISIBILITY_CC # Host-dependant definitions DEFAULT_DUFLAGS=" -sk --apparent-size" +DEFAULT_SEDINPLACEFLAGS=" --follow-symlinks -i" INODECMD="stat -c '%i %n'" OWNERCMD="stat -c '%u:%g'" MODECMD="stat -c '%a'" -SEDINPLACE="sed --follow-symlinks -i" STRIP_BINARIES="--strip-all" STRIP_SHARED="--strip-unneeded" STRIP_STATIC="--strip-debug" @@ -351,7 +351,7 @@ case "${host_os}" in INODECMD="stat -f '%i %N'" OWNERCMD="stat -f '%u:%g'" MODECMD="stat -f '%Lp'" - SEDINPLACE="sed -i \"\"" + DEFAULT_SEDINPLACEFLAGS=" -i \"\"" DEFAULT_DUFLAGS=" -sk" ;; darwin*) @@ -359,7 +359,7 @@ case "${host_os}" in INODECMD="/usr/bin/stat -f '%i %N'" OWNERCMD="/usr/bin/stat -f '%u:%g'" MODECMD="/usr/bin/stat -f '%Lp'" - SEDINPLACE="/usr/bin/sed -i ''" + DEFAULT_SEDINPLACEFLAGS=" -i ''" DEFAULT_DUFLAGS=" -sk" STRIP_BINARIES="" STRIP_SHARED="-S" @@ -368,10 +368,10 @@ case "${host_os}" in esac AM_CONDITIONAL([DARWIN], test "x$host_os_darwin" = "xyes") AC_PATH_PROGS([DUPATH], [du], [du], [/usr/bin$PATH_SEPARATOR/bin] ) +AC_PATH_PROGS([SEDPATH], [sed], [sed], [/usr/bin$PATH_SEPARATOR/bin] ) AC_SUBST(INODECMD) AC_SUBST(OWNERCMD) AC_SUBST(MODECMD) -AC_SUBST(SEDINPLACE) AC_SUBST(STRIP_BINARIES) AC_SUBST(STRIP_SHARED) AC_SUBST(STRIP_STATIC) @@ -382,6 +382,12 @@ if test "${DUFLAGS+set}" != "set"; then fi AC_ARG_VAR(DUFLAGS, [flags for du, overriding the default]) +# Flags for sed in place +if test "${SEDINPLACEFLAGS+set}" != "set"; then + SEDINPLACEFLAGS="${DEFAULT_SEDINPLACEFLAGS}" +fi +AC_ARG_VAR(SEDINPLACEFLAGS, [flags for sed, overriding the default]) + # Variables plugged into makepkg.conf CARCH="${host%%-*}" CHOST="${host}" diff --git a/scripts/Makefile.am b/scripts/Makefile.am index 4bb08a24..86e44cb6 100644 --- a/scripts/Makefile.am +++ b/scripts/Makefile.am @@ -152,7 +152,8 @@ edit = sed \ -e "s|@OWNERCMD[@]|$(OWNERCMD)|g" \ -e "s|@MODECMD[@]|$(MODECMD)|g" \ -e 's|@SIZECMD[@]|$(SIZECMD)|g' \ - -e 's|@SEDINPLACE[@]|$(SEDINPLACE)|g' \ + -e 's|@SEDINPLACEFLAGS[@]|$(SEDINPLACEFLAGS)|g' \ + -e 's|@SEDPATH[@]|$(SEDPATH)|g' \ -e 's|@DUFLAGS[@]|$(DUFLAGS)|g' \ -e 's|@DUPATH[@]|$(DUPATH)|g' \ -e 's|@SCRIPTNAME[@]|$@|g' \ diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 20e9dd7e..65a9235f 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -189,12 +189,12 @@ update_pkgver() { if [[ -n $newpkgver && $newpkgver != "$pkgver" ]]; then if [[ -f $BUILDFILE && -w $BUILDFILE ]]; then - if ! @SEDINPLACE@ "s:^pkgver=[^ ]*:pkgver=$newpkgver:" "$BUILDFILE"; then + if ! @SEDPATH@ @SEDINPLACEFLAGS@ "s:^pkgver=[^ ]*:pkgver=$newpkgver:" "$BUILDFILE"; then error "$(gettext "Failed to update %s from %s to %s")" \ "pkgver" "$pkgver" "$newpkgver" exit 1 fi - @SEDINPLACE@ "s:^pkgrel=[^ ]*:pkgrel=1:" "$BUILDFILE" + @SEDPATH@ @SEDINPLACEFLAGS@ "s:^pkgrel=[^ ]*:pkgrel=1:" "$BUILDFILE" source_safe "$BUILDFILE" local fullver=$(get_full_version) msg "$(gettext "Updated version: %s")" "$pkgbase $fullver" -- 2.14.0

2 1

[pacman-dev] [PATCH] makepkg: respect $SOURCE_DATE_EPOCH to activate reproducible builds
by Eli Schwartz 13 Sep '17

13 Sep '17

If SOURCE_DATE_EPOCH is set, `touch` all source files before running build() to fix the modification times. This works around build systems and compilers that embed the file modification times into the file contents of release artifacts. Signed-off-by: Eli Schwartz <eschwartz93(a)gmail.com> --- Guarded by checking for the variable, because this stomps all over incremental builds. I prefer looking for SOURCE_DATE_EPOCH in the environment because less bloat IMHO, but perhaps this would be preferable as a makepkg flag or makepkg.conf option? Is there anything else that needs to be done to force reproducible builds, other than merely setting SOURCE_DATE_EPOCH which should be harmless as a global thing? scripts/makepkg.sh.in | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 20e9dd7e..fb1d40a9 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -79,15 +79,22 @@ PKGFUNC=0 PKGVERFUNC=0 PREPAREFUNC=0 REPKG=0 +REPRODUCIBLE=0 RMDEPS=0 SKIPCHECKSUMS=0 SKIPPGPCHECK=0 SIGNPKG='' SPLITPKG=0 SOURCEONLY=0 + VERIFYSOURCE=0 -export SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-$(date +%s)} +if [[ -n $SOURCE_DATE_EPOCH ]]; then + REPRODUCIBLE=1 +else + SOURCE_DATE_EPOCH=$(date +%s) +fi +export SOURCE_DATE_EPOCH PACMAN_OPTS=() @@ -475,6 +482,12 @@ run_prepare() { } run_build() { + if (( REPRODUCIBLE )); then + # We have activated reproducible builds, so unify source times before + # building + find "$srcdir" -exec touch -h -d @$SOURCE_DATE_EPOCH {} + + fi + run_function_safe "build" } -- 2.13.2

4 7

[pacman-dev] [PATCH] libmakepkg/integrity: check for invalid tags
by Eli Schwartz 13 Sep '17

13 Sep '17

As per https://lists.archlinux.org/pipermail/arch-general/2017-July/043876.html git doesn't check that the tag name matches what an annotated tag object *thinks* it should be called. This is a bit of a theoretical attack and some would argue that we should always use commits since upstream can legitimately change a tag, but nevertheless this can result in a downgrade attack if the git download transport was manipulated. So, check the tag blob to make sure the tag actually matches the name we used for `git checkout` Signed-off-by: Eli Schwartz <eschwartz93(a)gmail.com> --- scripts/libmakepkg/integrity/verify_signature.sh.in | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/scripts/libmakepkg/integrity/verify_signature.sh.in b/scripts/libmakepkg/integrity/verify_signature.sh.in index 5468f977..3783dbb2 100644 --- a/scripts/libmakepkg/integrity/verify_signature.sh.in +++ b/scripts/libmakepkg/integrity/verify_signature.sh.in @@ -187,6 +187,13 @@ verify_git_signature() { printf " %s git repo ... " "${dir##*/}" >&2 + tagname="$(git -C "$dir" cat-file tag "$fragval" 2>/dev/null | awk 'FNR == 3 {print $2}')" + if [[ $fragtype = tag && -n $tagname && $tagname != $fragval ]]; then + printf "%s (%s)" "$(gettext "FAILED")" "$(gettext "forged tag, you have been hacked!")" >&2 + errors=1 + return 1 + fi + git -C "$dir" verify-$fragtype --raw "$fragval" > "$statusfile" 2>&1 if ! grep -qs NEWSIG "$statusfile"; then printf '%s\n' "$(gettext "SIGNATURE NOT FOUND")" >&2 -- 2.13.2

3 7