March 2019 - Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH] doc: add man page for pacman-conf
by Jelle van der Waa 06 Mar '19

06 Mar '19

Signed-off-by: Jelle van der Waa <jelle(a)vdwaa.nl> --- doc/Makefile.am | 3 +- doc/pacman-conf.8.asciidoc | 60 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 62 insertions(+), 1 deletion(-) create mode 100644 doc/pacman-conf.8.asciidoc diff --git a/doc/Makefile.am b/doc/Makefile.am index de87c409..f68f4ea0 100644 --- a/doc/Makefile.am +++ b/doc/Makefile.am @@ -16,7 +16,8 @@ MANPAGES = \ makepkg.conf.5 \ pacman.conf.5 \ libalpm.3 \ - BUILDINFO.5 + BUILDINFO.5 \ + pacman-conf.8 DOXYGEN_MANS = $(wildcard man3/*.3) diff --git a/doc/pacman-conf.8.asciidoc b/doc/pacman-conf.8.asciidoc new file mode 100644 index 00000000..0e4c96be --- /dev/null +++ b/doc/pacman-conf.8.asciidoc @@ -0,0 +1,60 @@ +pacman-conf(8) +============== + +Name +---- +pacman-conf - query pacman's configuration file + + +Synopsis +-------- +'pacman-conf' [options] [<directive> ...] + + +Description +----------- +The 'pacman-conf' utility is created since parsing pacman's configuration file +is non-trivial and extremely difficult to do correctly from scripts. It makes it +easy for scripts to get the same configuration value which pacman itself would +use. + + +Options +------- +*-c, \--config* <path>:: + Specify an alternate configuration file. + +*-R, \--rootdir* <path>:: + Specify an alternate installation root (default is `/`). + +*-r, \--repo* <remote>:: + Query options for a specific repository. + +*-v, \--verbose*:: + Always shown directive names. + +*-l, \--repo-list*:: + List configured repositories. + +*-V, \--version*:: + Display version and exit. + +*-h, \--help*:: + Output syntax and command line options. + + +Examples +-------- + +pacman-conf -r core Usage:: + Show the value of the Usage configuration option for core repository. + +pacman-conf HoldPkg:: + Show the value of the HoldPkg configuration option. + + +See Also +-------- +linkman:pacman.conf[5] + +include::footer.asciidoc[] -- 2.20.1

3 6

[pacman-dev] [PATCH] doc: set rootdir correctly in man pages
by Jelle van der Waa 06 Mar '19

06 Mar '19

If an alternative rootdir is specified in either meson or configure it's not respected in the generated man pages. Signed-off-by: Jelle van der Waa <jelle(a)vdwaa.nl> --- doc/Makefile.am | 3 ++- doc/meson.build | 1 + doc/pacman.8.asciidoc | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/doc/Makefile.am b/doc/Makefile.am index de87c409..e03d6ab8 100644 --- a/doc/Makefile.am +++ b/doc/Makefile.am @@ -112,7 +112,8 @@ ASCIIDOC_OPTS = \ -a pkgdatadir=$(pkgdatadir) \ -a localstatedir=$(localstatedir) \ -a sysconfdir=$(sysconfdir) \ - -a datarootdir=$(datarootdir) + -a datarootdir=$(datarootdir) \ + -a rootdir=$(ROOTDIR) A2X_OPTS = \ --no-xmllint \ diff --git a/doc/meson.build b/doc/meson.build index b7514ef7..d6403bae 100644 --- a/doc/meson.build +++ b/doc/meson.build @@ -31,6 +31,7 @@ asciidoc_opts = [ '-a', 'localstatedir=@0@'.format(LOCALSTATEDIR), '-a', 'sysconfdir=@0@'.format(SYSCONFDIR), '-a', 'datarootdir=@0@'.format(DATAROOTDIR), + '-a', 'rootdir=@0@'.format(ROOTDIR), ] html_targets = [] diff --git a/doc/pacman.8.asciidoc b/doc/pacman.8.asciidoc index 6b2d9172..fe95178d 100644 --- a/doc/pacman.8.asciidoc +++ b/doc/pacman.8.asciidoc @@ -131,7 +131,7 @@ Options not automatically prepended. *-r, \--root* <path>:: - Specify an alternative installation root (default is `/`). This should + Specify an alternative installation root (default is +{rootdir}+). This should not be used as a way to install software into `/usr/local` instead of `/usr`. *NOTE*: If database path or log file are not specified on either the -- 2.20.1

2 1

[pacman-dev] [PATCH 1/2] libmakepkg: migrate to schema.sh for integsums
by Eli Schwartz 06 Mar '19

06 Mar '19

We cannot use most of the arrays defined there as srcinfo is dependent on the order, but migrate the hashes for now. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- scripts/libmakepkg/srcinfo.sh.in | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/libmakepkg/srcinfo.sh.in b/scripts/libmakepkg/srcinfo.sh.in index 509c4860..b9eeb817 100644 --- a/scripts/libmakepkg/srcinfo.sh.in +++ b/scripts/libmakepkg/srcinfo.sh.in @@ -24,6 +24,7 @@ LIBMAKEPKG_SRCINFO_SH=1 LIBRARY=${LIBRARY:-'@libmakepkgdir@'} source "$LIBRARY/util/pkgbuild.sh" +source "$LIBRARY/util/schema.sh" srcinfo_open_section() { printf '%s = %s\n' "$1" "$2" @@ -63,7 +64,7 @@ srcinfo_write_section_details() { local attr package_arch a local multivalued_arch_attrs=(source provides conflicts depends replaces optdepends makedepends checkdepends - {md5,sha{1,224,256,384,512}}sums) + "${known_hash_algos[@]/%/sums}") for attr in "${singlevalued[@]}"; do pkgbuild_extract_to_srcinfo "$1" "$attr" 0 -- 2.20.1

2 5

[pacman-dev] [PATCH] pacman: fix segfault when Usage is specified without a value
by morganamilo 06 Mar '19

06 Mar '19

And extract all the common code to a macro. Signed-off-by: morganamilo <morganamilo(a)gmail.com> --- src/pacman/conf.c | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/src/pacman/conf.c b/src/pacman/conf.c index 29f69052..cca3657e 100644 --- a/src/pacman/conf.c +++ b/src/pacman/conf.c @@ -844,28 +844,28 @@ static int _parse_repo(const char *key, char *value, const char *file, int ret = 0; config_repo_t *repo = section->repo; +#define CHECK_VALUE(val) do { \ + if(!val) { \ + pm_printf(ALPM_LOG_ERROR, _("config file %s, line %d: directive '%s' needs a value\n"), \ + file, line, key); \ + return 1; \ + } \ +} while(0) + if(strcmp(key, "Server") == 0) { - if(!value) { - pm_printf(ALPM_LOG_ERROR, _("config file %s, line %d: directive '%s' needs a value\n"), - file, line, key); - ret = 1; - } else { - repo->servers = alpm_list_add(repo->servers, strdup(value)); - } + CHECK_VALUE(value); + repo->servers = alpm_list_add(repo->servers, strdup(value)); } else if(strcmp(key, "SigLevel") == 0) { - if(!value) { - pm_printf(ALPM_LOG_ERROR, _("config file %s, line %d: directive '%s' needs a value\n"), - file, line, key); - } else { - alpm_list_t *values = NULL; - setrepeatingoption(value, "SigLevel", &values); - if(values) { - ret = process_siglevel(values, &repo->siglevel, - &repo->siglevel_mask, file, line); - FREELIST(values); - } + CHECK_VALUE(value); + alpm_list_t *values = NULL; + setrepeatingoption(value, "SigLevel", &values); + if(values) { + ret = process_siglevel(values, &repo->siglevel, + &repo->siglevel_mask, file, line); + FREELIST(values); } } else if(strcmp(key, "Usage") == 0) { + CHECK_VALUE(value); alpm_list_t *values = NULL; setrepeatingoption(value, "Usage", &values); if(values) { @@ -881,6 +881,8 @@ static int _parse_repo(const char *key, char *value, const char *file, file, line, key, repo->name); } +#undef CHECK_VALUE + return ret; } -- 2.21.0

2 2

[pacman-dev] [GIT] The official pacman repository annotated tag, v5.1.3, created. v5.1.3
by Allan McRae 28 Feb '19

28 Feb '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The annotated tag, v5.1.3 has been created at d0ccd3d47473a73794bf62fc5530acefc1725f02 (tag) tagging 1bf767234363f7ad5933af3f7ce267c123017bde (commit) replaces v5.1.2 tagged by Allan McRae on Fri Mar 1 11:30:34 2019 +1000 - Log ----------------------------------------------------------------- v5.1.3 -----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEEZkWwqMcAXnjbHXhk+Z/+D+rpmb0FAlx4i3kACgkQ+Z/+D+rp mb07+AgAgkU/SbvNS3yXQMB7hOe7I7TUz4OzZsNnBdqBXmE8qvOmmyiJBLBEFo2u i3b7uWg3bYbYP9INvx3lNLgU6CjmXo3a+3uh0BpyArY9w6JL5a/mFdcK3QHApoAc 76m3MRYGR2kxQiztTUyxJMYdMe5VSC3HayKghHLJjGkNNcwcNMjeAuJY/yFPVwyF quIr518LkDJFTqFqfWoaKfGCcTkeXLvlhqeyvNLpBIwJ1RRzosZB1pwNqj4czGMi Lf0RacJLRsC5XlTeC0SXTq6U8aGOPZ+cc8sb3YyVSYiHIhfvFZRm0M3fFXhwF97+ bnr2LZUR1jDh/LPlRevnxVWCoPTK9w== =G8+y -----END PGP SIGNATURE----- Allan McRae (1): Release v5.1.3 Andrew Gregory (1): Sanitize file name received from Content-Disposition header ----------------------------------------------------------------------- hooks/post-receive -- The official pacman repository

2 1

[pacman-dev] [GIT] The official pacman repository branch, release/5.1.x, updated. v5.1.3
by Allan McRae 28 Feb '19

28 Feb '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, release/5.1.x has been updated via 1bf767234363f7ad5933af3f7ce267c123017bde (commit) via 9702703633bec2c007730006de2aeec8587dfc84 (commit) from 0b36d8781783d7f4a0086e12eb7cae542e7f6bd7 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 1bf767234363f7ad5933af3f7ce267c123017bde Author: Allan McRae <allan(a)archlinux.org> Date: Fri Mar 1 11:28:42 2019 +1000 Release v5.1.3 Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 9702703633bec2c007730006de2aeec8587dfc84 Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Fri Mar 1 11:23:20 2019 +1000 Sanitize file name received from Content-Disposition header When installing a remote package with "pacman -U <url>", pacman renames the downloaded package file to match the name given in the Content-Disposition header. However, pacman does not sanitize this name, which may contain slashes, before calling rename(). A malicious server (or a network MitM if downloading over HTTP) can send a content-disposition header to make pacman place the file anywhere in the filesystem, potentially leading to arbitrary root code execution. Notably, this bypasses pacman's package signature checking. For example, a malicious package-hosting server (or a network man-in-the-middle, if downloading over HTTP) could serve the following header: Content-Disposition: filename=../../../../../../usr/share/libalpm/hooks/evil.hook and pacman would move the downloaded file to /usr/share/libalpm/hooks/evil.hook. This invocation of "pacman -U" would later fail, unable to find the downloaded package in the cache directory, but the hook file would remain in place. The commands in the malicious hook would then be run (as root) the next time any package is installed. Discovered-by: Adam Suhl <asuhl(a)mit.edu> Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit d197d8ab82cf10650487518fb968067897a12775) ----------------------------------------------------------------------- Summary of changes: NEWS | 2 ++ configure.ac | 4 ++-- lib/libalpm/dload.c | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.1.1-140-gd197d8ab
by Allan McRae 28 Feb '19

28 Feb '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via d197d8ab82cf10650487518fb968067897a12775 (commit) from adb961a88e6644d5edb16cfcb5dbd1f02e4a1781 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit d197d8ab82cf10650487518fb968067897a12775 Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Fri Mar 1 11:23:20 2019 +1000 Sanitize file name received from Content-Disposition header When installing a remote package with "pacman -U <url>", pacman renames the downloaded package file to match the name given in the Content-Disposition header. However, pacman does not sanitize this name, which may contain slashes, before calling rename(). A malicious server (or a network MitM if downloading over HTTP) can send a content-disposition header to make pacman place the file anywhere in the filesystem, potentially leading to arbitrary root code execution. Notably, this bypasses pacman's package signature checking. For example, a malicious package-hosting server (or a network man-in-the-middle, if downloading over HTTP) could serve the following header: Content-Disposition: filename=../../../../../../usr/share/libalpm/hooks/evil.hook and pacman would move the downloaded file to /usr/share/libalpm/hooks/evil.hook. This invocation of "pacman -U" would later fail, unable to find the downloaded package in the cache directory, but the hook file would remain in place. The commands in the malicious hook would then be run (as root) the next time any package is installed. Discovered-by: Adam Suhl <asuhl(a)mit.edu> Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: lib/libalpm/dload.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) hooks/post-receive -- The official pacman repository

1 0