August 2018 - Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH 0/7] Improve linting for makepkg
by morganamilo 31 Jan '19

31 Jan '19

I recently did some data crunshing on AUR packages, trying to find ones that are formatted incorrectly, catching mistakes makepkg did not. I wrote up on the results here https://github.com/Morganamilo/go-srcinfo/issues/1. This patch should cover all the mistakes found and make is so that makepkg bails out duing the linting phase and users are forced to make more correct pkgbuilds. morganamilo (7): libmakepkg: disallow empty arch libmakepkg: stop printsrcinfo generating empty values libmakepkg: lint disallowed variables in package() libmakepkg: lint disallowed architecture specific variables libmakepkg: disallow using any as an architecture specific variable libmakepkg: add pkgbase to linted variables libmakepkg: disallow using 'any' with other arches scripts/libmakepkg/lint_pkgbuild/arch.sh.in | 14 +++- .../libmakepkg/lint_pkgbuild/variable.sh.in | 72 ++++++++++++++++++- scripts/libmakepkg/srcinfo.sh.in | 6 +- 3 files changed, 86 insertions(+), 6 deletions(-) -- 2.17.1

5 56

[pacman-dev] [PATCH] Check for all return values of _alpm_key_in_keychain
by David Phillips 24 Jan '19

24 Jan '19

This fixes a bug I encountered with a GPG keyring where the key id used to locate a key in the keyring was ambiguous within my keychain. This commit ensures that all valid return values are checked to catch this and related error cases rather than incorrectly taking an error case to mean the key was found, since this is rarely going to be the case. --- lib/libalpm/be_package.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/lib/libalpm/be_package.c b/lib/libalpm/be_package.c index 7e8b7920..1891fa5a 100644 --- a/lib/libalpm/be_package.c +++ b/lib/libalpm/be_package.c @@ -754,10 +754,21 @@ int SYMEXPORT alpm_pkg_load(alpm_handle_t *handle, const char *filename, int ful alpm_list_t *k; for(k = keys; k; k = k->next) { char *key = k->data; - if(_alpm_key_in_keychain(handle, key) == 0) { - if(_alpm_key_import(handle, key) == -1) { + switch(_alpm_key_in_keychain(handle, key)) { + case 1: + /* key is known; proceed */ + break; + case 0: + /* key is unknown; attempt to import */ + if(_alpm_key_import(handle, key) == -1) { + fail = 1; + } + break; + case -1: + /* error finding key in keychain */ + default: fail = 1; - } + break; } } FREELIST(keys); -- 2.12.2

3 3

[pacman-dev] [PATCH 1/3] libmakepkg: optimize get_protocol to always return proto, not proto+uri
by Eli Schwartz 22 Jan '19

22 Jan '19

e.g. git+https:// is commonly used for git repositories cloned over HTTPS, but we assume a proto with a plus in it is actually a protocol followed by some URI handler. So we might as well simplify the return value and not have to always add glob matching everywhere when checking the proto in use. This is required in order to use the proto directly in function calls, which will be used in a followup patch. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- .../libmakepkg/integrity/generate_checksum.sh.in | 2 +- .../libmakepkg/integrity/verify_signature.sh.in | 4 ++-- scripts/libmakepkg/source.sh.in | 16 ++++++++-------- scripts/libmakepkg/util/source.sh.in | 14 ++++++++------ 4 files changed, 19 insertions(+), 17 deletions(-) diff --git a/scripts/libmakepkg/integrity/generate_checksum.sh.in b/scripts/libmakepkg/integrity/generate_checksum.sh.in index eb9b74fc..b8b078ec 100644 --- a/scripts/libmakepkg/integrity/generate_checksum.sh.in +++ b/scripts/libmakepkg/integrity/generate_checksum.sh.in @@ -52,7 +52,7 @@ generate_one_checksum() { proto="$(get_protocol "$netfile")" case $proto in - bzr*|git*|hg*|svn*) + bzr|git|hg|svn) sum="SKIP" ;; *) diff --git a/scripts/libmakepkg/integrity/verify_signature.sh.in b/scripts/libmakepkg/integrity/verify_signature.sh.in index ea877822..38f8afa1 100644 --- a/scripts/libmakepkg/integrity/verify_signature.sh.in +++ b/scripts/libmakepkg/integrity/verify_signature.sh.in @@ -49,7 +49,7 @@ check_pgpsigs() { for netfile in "${all_sources[@]}"; do proto="$(get_protocol "$netfile")" - if [[ $proto = git* ]]; then + if [[ $proto = git ]]; then verify_git_signature "$netfile" "$statusfile" || continue else verify_file_signature "$netfile" "$statusfile" || continue @@ -263,7 +263,7 @@ source_has_signatures() { proto="$(get_protocol "$netfile")" query=$(get_uri_query "$netfile") - if [[ ${netfile%%::*} = *.@(sig?(n)|asc) || ( $proto = git* && $query = signed ) ]]; then + if [[ ${netfile%%::*} = *.@(sig?(n)|asc) || ( $proto = git && $query = signed ) ]]; then return 0 fi done diff --git a/scripts/libmakepkg/source.sh.in b/scripts/libmakepkg/source.sh.in index 5d7df732..198efd5e 100644 --- a/scripts/libmakepkg/source.sh.in +++ b/scripts/libmakepkg/source.sh.in @@ -63,16 +63,16 @@ download_sources() { local) download_local "$netfile" ;; - bzr*) + bzr) (( get_vcs )) && download_bzr "$netfile" ;; - git*) + git) (( get_vcs )) && download_git "$netfile" ;; - hg*) + hg) (( get_vcs )) && download_hg "$netfile" ;; - svn*) + svn) (( get_vcs )) && download_svn "$netfile" ;; *) @@ -93,16 +93,16 @@ extract_sources() { local file=$(get_filename "$netfile") local proto=$(get_protocol "$netfile") case "$proto" in - bzr*) + bzr) extract_bzr "$netfile" ;; - git*) + git) extract_git "$netfile" ;; - hg*) + hg) extract_hg "$netfile" ;; - svn*) + svn) extract_svn "$netfile" ;; *) diff --git a/scripts/libmakepkg/util/source.sh.in b/scripts/libmakepkg/util/source.sh.in index 17e44664..faa7061b 100644 --- a/scripts/libmakepkg/util/source.sh.in +++ b/scripts/libmakepkg/util/source.sh.in @@ -41,10 +41,12 @@ get_protocol() { if [[ $1 = *://* ]]; then # strip leading filename local proto="${1#*::}" - printf "%s\n" "${proto%%://*}" + proto="${proto%%://*}" + # strip proto+uri:// + printf "%s\n" "${proto%%+*}" elif [[ $1 = *lp:* ]]; then local proto="${1#*::}" - printf "%s\n" "${proto%%lp:*}" + printf "%s\n" "${proto%%+lp:*}" else printf "%s\n" local fi @@ -63,15 +65,15 @@ get_filename() { local proto=$(get_protocol "$netfile") case $proto in - bzr*|git*|hg*|svn*) + bzr|git|hg|svn) filename=${netfile%%#*} filename=${filename%%\?*} filename=${filename%/} filename=${filename##*/} - if [[ $proto = bzr* ]]; then + if [[ $proto = bzr ]]; then filename=${filename#*lp:} fi - if [[ $proto = git* ]]; then + if [[ $proto = git ]]; then filename=${filename%%.git*} fi ;; @@ -89,7 +91,7 @@ get_filepath() { local proto="$(get_protocol "$1")" case $proto in - bzr*|git*|hg*|svn*) + bzr|git|hg|svn) if [[ -d "$startdir/$file" ]]; then file="$startdir/$file" elif [[ -d "$SRCDEST/$file" ]]; then -- 2.17.0

2 5

[pacman-dev] [PATCH v2 0/3] makepkg: Improve lint_pkgbuild error messages for epoch/ver/rel
by Luke Shumaker 10 Jan '19

10 Jan '19

From: Luke Shumaker <lukeshu(a)parabola.nu> The error messages that makepkg prints when encountering a bad epoch/pkgver/pkgrel are often somewhat misleading. These patchset tries to improve that. The behavior is intended to be unchanged, other than what the messages say. v2: - Don't skip lint_pkgrel if (( PKGVERFUNC )), I should have never included that bit in v1. - check_fullpkgver: Don't let rel strip ver down to nothing Luke Shumaker (3): makepkg: Better error messages for versions in (check,make,opt)depends/provides/conflicts makepkg: check_pkgrel: Don't say "decimal" in the error message makepkg: check_pkgver: Report what the bad pkgver is scripts/Makefile.am | 1 + .../lint_pkgbuild/checkdepends.sh.in | 10 ++-- .../libmakepkg/lint_pkgbuild/conflicts.sh.in | 10 ++-- .../libmakepkg/lint_pkgbuild/depends.sh.in | 14 ++--- scripts/libmakepkg/lint_pkgbuild/epoch.sh.in | 10 +++- .../libmakepkg/lint_pkgbuild/fullpkgver.sh.in | 58 +++++++++++++++++++ .../lint_pkgbuild/makedepends.sh.in | 10 ++-- .../libmakepkg/lint_pkgbuild/optdepends.sh.in | 10 ++-- scripts/libmakepkg/lint_pkgbuild/pkgrel.sh.in | 15 +++-- scripts/libmakepkg/lint_pkgbuild/pkgver.sh.in | 2 +- .../libmakepkg/lint_pkgbuild/provides.sh.in | 10 ++-- 11 files changed, 106 insertions(+), 44 deletions(-) create mode 100644 scripts/libmakepkg/lint_pkgbuild/fullpkgver.sh.in -- Happy hacking, ~ Luke Shumaker 2.18.0

2 6

[pacman-dev] [PATCH] libmakepkg/lint_pkgbuild: check for invalid variables even if they're empty
by Eli Schwartz 10 Jan '19

10 Jan '19

Checking the length of the variable to be non-zero before considering it an error is inconsistent; license=() and depends='' and `declare arch` should be considered just as wrong. In fact the current check detects depends='' as non-zero and returns an error, but happily considers the others to be perfectly okay. A more reliable check is to simply see if the name has been declared (whether it is set or not), and then enforce that it's been declared to the right type. As an added benefit, avoiding the creation of proxy-evaled variables to count the number of indexes results in simpler code. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- scripts/libmakepkg/lint_pkgbuild/variable.sh.in | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/scripts/libmakepkg/lint_pkgbuild/variable.sh.in b/scripts/libmakepkg/lint_pkgbuild/variable.sh.in index 3266cb5e..52bb61a9 100644 --- a/scripts/libmakepkg/lint_pkgbuild/variable.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/variable.sh.in @@ -37,12 +37,11 @@ lint_variable() { replaces sha1sums sha256sums sha384sums sha512sums source) local string=(changelog epoch install pkgdesc pkgrel pkgver url) - local i a v pkg keys out bad ret=0 + local i a pkg out bad ret=0 # global variables for i in ${array[@]} ${arch_array[@]}; do - eval "keys=(\"\${!$i[@]}\")" - if (( ${#keys[*]} > 0 )); then + if declare -p $i > /dev/null 2>&1; then if ! is_array $i; then error "$(gettext "%s should be an array")" "$i" ret=1 @@ -54,11 +53,9 @@ lint_variable() { [[ $a == "any" ]] && continue for i in ${arch_array[@]}; do - v="${i}_${a}" - eval "keys=(\"\${!${v}[@]}\")" - if (( ${#keys[*]} > 0 )); then - if ! is_array $v; then - error "$(gettext "%s_%s should be an array")" "$i" "$a" + if declare -p "${i}_${a}" > /dev/null 2>&1; then + if ! is_array ${i}_${a}; then + error "$(gettext "%s should be an array")" "${i}_${a}" ret=1 fi fi @@ -66,8 +63,7 @@ lint_variable() { done for i in ${string[@]}; do - eval "keys=(\"\${!$i[@]}\")" - if (( ${#keys[*]} > 0 )); then + if declare -p "$i" > /dev/null 2>&1; then if is_array $i; then error "$(gettext "%s should not be an array")" "$i" ret=1 -- 2.17.1

2 1

[pacman-dev] [PATCH] pacman-key: just accept one file to verify, and enforce detached sigs
by Eli Schwartz 21 Oct '18

21 Oct '18

Simply pass options on to gpg the same way gpg uses them -- no looping through and checking lots of signatures. This prevents a situation where the signature file to be verified is manipulated to contain a complete signature which is valid, but not a detached signature for the file you are actually trying to verify. gpg does not offer an option to verify many files at once by naming each signature/file pair, and there's no reason for us to do so either, since it would be quite tiresome to do so. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- scripts/pacman-key.sh.in | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 0f1630a9..0573e92f 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -486,18 +486,19 @@ refresh_keys() { } verify_sig() { - local ret=0 - for sig; do - msg "Checking %s..." "$sig" - if grep -q 'BEGIN PGP SIGNATURE' "$sig"; then - error "$(gettext "Cannot use armored signatures for packages: %s")" "$sig" - return 1 - fi - if ! "${GPG_PACMAN[@]}" --status-fd 1 --verify "$sig" | grep -qE '^\[GNUPG:\] TRUST_(FULLY|ULTIMATE).*$'; then - error "$(gettext "The signature identified by %s could not be verified.")" "$sig" - ret=1 - fi - done + local ret=0 sig=$1 file=$2 + if [[ -z $file ]]; then + file=${sig%.*} + fi + msg "Checking %s..." "$sig" + if grep -q 'BEGIN PGP SIGNATURE' "$sig"; then + error "$(gettext "Cannot use armored signatures for packages: %s")" "$sig" + exit 1 + fi + if ! "${GPG_PACMAN[@]}" --status-fd 1 --verify "$sig" "$file" | grep -qE '^\[GNUPG:\] TRUST_(FULLY|ULTIMATE).*$'; then + error "$(gettext "The signature identified by %s could not be verified.")" "$sig" + ret=1 + fi exit $ret } -- 2.17.0

2 3

[pacman-dev] [PATCH] makepkg: lint_pkgver: Run even if PKGVERFUNC
by Luke Shumaker 20 Sep '18

20 Sep '18

From: Luke Shumaker <lukeshu(a)parabola.nu> lint_pkgver returns 0 if PKGVERFUNC, since it's likely that update_pkgver() will change the value of pkgver anyway, and there's no point in linting the old value. update_pkgver() will call check_pkgver() itself to validate the new value. However, that "optimization" only holds if we're definitely going to call update_pkgver() later; and that's way more complicated than if (( PKGVERFUNC )); then it's more like: if (( !GENINTEG && !PACKAGELIST && !PRINTSRCINFO && !SOURCEONLY && !REPKG && PKGVERFUNC )); then Which is to say: If I have a PKGBUILD with pkgver(): * if I run `makepkg -g` I expect it to lint pkgver, but it won't * if I run `makepkg -R` I expect it to lint pkgver, but it won't * ... So let's fix that. Rather than try to keep a huge list of conditions in sync with the flow of makepkg.sh.in, let's just drop it. As far as I can tell, the only thing that skipping lint_pkgver() really enables is letting the PKGBUILD author write `pkgver=` in the initial version, and letting pkgver() fill it in. They can just start writing `pkgver=0` for that workflow. --- scripts/libmakepkg/lint_pkgbuild/pkgver.sh.in | 5 ----- 1 file changed, 5 deletions(-) diff --git a/scripts/libmakepkg/lint_pkgbuild/pkgver.sh.in b/scripts/libmakepkg/lint_pkgbuild/pkgver.sh.in index 65216b64..e9b1566f 100644 --- a/scripts/libmakepkg/lint_pkgbuild/pkgver.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/pkgver.sh.in @@ -44,10 +44,5 @@ check_pkgver() { } lint_pkgver() { - if (( PKGVERFUNC )); then - # defer check to after getting version from pkgver function - return 0 - fi - check_pkgver "$pkgver" } -- 2.18.0

3 2

[pacman-dev] [PATCH 0/4][WIP] makepkg test suite
by Andrew Gregory 20 Sep '18

20 Sep '18

The long-awaited makepkg test suite is finally here, or at least the start of it. The tests can be run via `make check` or they can also be run directly. Included so far are a few tests for package generation and a single libmakepkg test for some of the util/pkgbuild functions. I made some small changes to the lib in order to make it easier to use and to allow stricter error checking in the test suite (set -u). Andrew Gregory (4): util/pkgbuild: guard against unset variable util/pkgbuild: manually set extglob util/pkgbuild: fix broken indentation add basic makepkg test Makefile.am | 6 +- configure.ac | 2 + scripts/libmakepkg/util/pkgbuild.sh.in | 23 +++--- test/makepkg/Makefile.am | 9 +++ test/makepkg/README | 15 ++++ test/makepkg/test_functions.sh | 143 +++++++++++++++++++++++++++++++++ test/makepkg/tests/Makefile.am | 7 ++ test/makepkg/tests/TESTS | 4 + test/makepkg/tests/dbfiles.sh | 35 ++++++++ test/makepkg/tests/dotfiles.sh | 33 ++++++++ test/makepkg/tests/pkgbuild.sh | 53 ++++++++++++ test/makepkg/tests/util-pkgbuild.sh | 35 ++++++++ 12 files changed, 355 insertions(+), 10 deletions(-) create mode 100644 test/makepkg/Makefile.am create mode 100644 test/makepkg/README create mode 100644 test/makepkg/test_functions.sh create mode 100644 test/makepkg/tests/Makefile.am create mode 100644 test/makepkg/tests/TESTS create mode 100755 test/makepkg/tests/dbfiles.sh create mode 100755 test/makepkg/tests/dotfiles.sh create mode 100755 test/makepkg/tests/pkgbuild.sh create mode 100755 test/makepkg/tests/util-pkgbuild.sh -- 2.11.1

5 13

[pacman-dev] [PATCH] during -Qu add [ignored] for repos without Usage = Upgrade
by morganamilo 19 Sep '18

19 Sep '18

Fixes FS#59854 Signed-off-by: morganamilo <morganamilo(a)gmail.com> --- src/pacman/query.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/pacman/query.c b/src/pacman/query.c index 00c39638..faa06e60 100644 --- a/src/pacman/query.c +++ b/src/pacman/query.c @@ -325,10 +325,14 @@ static int display(alpm_pkg_t *pkg) colstr->version, alpm_pkg_get_version(pkg), colstr->nocolor); if(config->op_q_upgrade) { + int usage; alpm_pkg_t *newpkg = alpm_sync_newversion(pkg, alpm_get_syncdbs(config->handle)); + alpm_db_t *db = alpm_pkg_get_db(newpkg); + alpm_db_get_usage(db, &usage); + printf(" -> %s%s%s", colstr->version, alpm_pkg_get_version(newpkg), colstr->nocolor); - if(alpm_pkg_should_ignore(config->handle, pkg)) { + if(alpm_pkg_should_ignore(config->handle, pkg) || !(usage & ALPM_DB_USAGE_UPGRADE)) { printf(" %s", _("[ignored]")); } } -- 2.18.0

3 5

[pacman-dev] [PATCH 1/3] makepkg: refactor archive compression for reusability
by Eli Schwartz 19 Sep '18

19 Sep '18

This allows for more easily extending the list of allowed compression methods, as it has to be modified in only one place. Also allow the user to specify their own preferred command + options for source packages in addition to compiled packages. Currently, makepkg.conf(5) erroneously claims this is already possible. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- I'm not 100% sure how to handle this, perhaps it should encompass bsdtar/$pkg_file as well? scripts/makepkg.sh.in | 57 ++++++++++++++++++++++++++------------------------- 1 file changed, 29 insertions(+), 28 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 20e9dd7e..a5c216dd 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -698,6 +698,26 @@ list_package_files() { sed -e 's|^\./||' | tr '\n' '\0' } +# Wrapper around many stream compression formats, for use in the middle of a +# pipeline. A tar archive is passed on stdin and compressed to stdout. +compress_as() { + # $1: final archive filename extension for compression type detection + + local ext="$1" + + case "$ext" in + *tar.gz) ${COMPRESSGZ[@]:-gzip -c -f -n} ;; + *tar.bz2) ${COMPRESSBZ2[@]:-bzip2 -c -f} ;; + *tar.xz) ${COMPRESSXZ[@]:-xz -c -z -} ;; + *tar.lrz) ${COMPRESSLRZ[@]:-lrzip -q} ;; + *tar.lzo) ${COMPRESSLZO[@]:-lzop -q} ;; + *tar.Z) ${COMPRESSZ[@]:-compress -c -f} ;; + *tar) cat ;; + *) warning "$(gettext "'%s' is not a valid archive extension.")" \ + "$ext"; cat ;; + esac +} + create_package() { (( NOARCHIVE )) && return @@ -748,21 +768,8 @@ create_package() { msg2 "$(gettext "Compressing package...")" # TODO: Maybe this can be set globally for robustness shopt -s -o pipefail - # bsdtar's gzip compression always saves the time stamp, making one - # archive created using the same command line distinct from another. - # Disable bsdtar compression and use gzip -n for now. list_package_files | LANG=C bsdtar -cnf - --null --files-from - | - case "$PKGEXT" in - *tar.gz) ${COMPRESSGZ[@]:-gzip -c -f -n} ;; - *tar.bz2) ${COMPRESSBZ2[@]:-bzip2 -c -f} ;; - *tar.xz) ${COMPRESSXZ[@]:-xz -c -z -} ;; - *tar.lrz) ${COMPRESSLRZ[@]:-lrzip -q} ;; - *tar.lzo) ${COMPRESSLZO[@]:-lzop -q} ;; - *tar.Z) ${COMPRESSZ[@]:-compress -c -f} ;; - *tar) cat ;; - *) warning "$(gettext "'%s' is not a valid archive extension.")" \ - "$PKGEXT"; cat ;; - esac > "${pkg_file}" || ret=$? + compress_as "$PKGEXT" > "${pkg_file}" || ret=$? shopt -u -o pipefail @@ -843,26 +850,20 @@ create_srcpackage() { done done - local TAR_OPT - case "$SRCEXT" in - *tar.gz) TAR_OPT="-z" ;; - *tar.bz2) TAR_OPT="-j" ;; - *tar.xz) TAR_OPT="-J" ;; - *tar.lrz) TAR_OPT="--lrzip" ;; - *tar.lzo) TAR_OPT="--lzop" ;; - *tar.Z) TAR_OPT="-Z" ;; - *tar) TAR_OPT="" ;; - *) warning "$(gettext "'%s' is not a valid archive extension.")" \ - "$SRCEXT" ;; - esac - local fullver=$(get_full_version) local pkg_file="$SRCPKGDEST/${pkgbase}-${fullver}${SRCEXT}" # tar it up msg2 "$(gettext "Compressing source package...")" cd_safe "${srclinks}" - if ! LANG=C bsdtar -cL ${TAR_OPT} -f "$pkg_file" ${pkgbase}; then + + # TODO: Maybe this can be set globally for robustness + shopt -s -o pipefail + LANG=C bsdtar -cLf - ${pkgbase} | compress_as "$SRCEXT" > "${pkg_file}" || ret=$? + + shopt -u -o pipefail + + if (( ret )); then error "$(gettext "Failed to create source package file.")" exit 1 # TODO: error code fi -- 2.14.1

2 18