January 2021 - Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH v2 1/3] libalpm: introduce get_sync_pkg_ops() helper
by Emil Velikov 08 Jan '21

08 Jan '21

Currently default_pkg_ops is accessed in two different ways. There is get_file_pkg_ops (in be_package.c) creating a local once-off 'tweaked' copy. As well as load_pkg_for_entry (be_sync.c) which modifies in-place and uses default_pkg_ops. This seems rather misleading and fragile approach. Introduce a helper for the second use-case so that default_pkg_ops is handled consistently and essentially remains unchanged throughout. Signed-off-by: Emil Velikov <emil.l.velikov(a)gmail.com> --- lib/libalpm/be_sync.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/lib/libalpm/be_sync.c b/lib/libalpm/be_sync.c index 225df76d..8fdf0fb2 100644 --- a/lib/libalpm/be_sync.c +++ b/lib/libalpm/be_sync.c @@ -281,6 +281,23 @@ static int _sync_get_validation(alpm_pkg_t *pkg) return pkg->validation; } +/** Package sync operations struct accessor. We implement this as a method + * rather than a static struct as in be_files because we want to reuse the + * majority of the default_pkg_ops struct and add only a few operations of + * our own on top. + */ +static struct pkg_operations *get_sync_pkg_ops(void) +{ + static struct pkg_operations sync_pkg_ops; + static int sync_pkg_ops_initalized = 0; + if(!sync_pkg_ops_initalized) { + sync_pkg_ops = default_pkg_ops; + sync_pkg_ops.get_validation = _sync_get_validation; + sync_pkg_ops_initalized = 1; + } + return &sync_pkg_ops; +} + static alpm_pkg_t *load_pkg_for_entry(alpm_db_t *db, const char *entryname, const char **entry_filename, alpm_pkg_t *likely_pkg) { @@ -321,8 +338,7 @@ static alpm_pkg_t *load_pkg_for_entry(alpm_db_t *db, const char *entryname, pkg->origin = ALPM_PKG_FROM_SYNCDB; pkg->origin_data.db = db; - pkg->ops = &default_pkg_ops; - pkg->ops->get_validation = _sync_get_validation; + pkg->ops = get_sync_pkg_ops(); pkg->handle = db->handle; /* add to the collection */ -- 2.30.0

2 3

[pacman-dev] [PATCH 1/5] libalpm: remove useless if
by morganamilo 08 Jan '21

08 Jan '21

--- lib/libalpm/dload.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index d43e6d45..d3636e18 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -899,10 +899,6 @@ int SYMEXPORT alpm_fetch_pkgurl(alpm_handle_t *handle, const alpm_list_t *urls, struct dload_payload *payload = i->data; char *filepath; - if(payload->signature) { - continue; - } - if(payload->destfile_name) { const char *filename = mbasename(payload->destfile_name); filepath = _alpm_filecache_find(handle, filename); -- 2.30.0

3 10

[pacman-dev] Adding privilege levitation to pacman
by Emil Velikov 06 Jan '21

06 Jan '21

Hello everyone, For a while now I've been wondering about adding privilege elevation to pacman, or if you prefer to libalpm. In particular, one that uses polkit akin to systemd and various other tools. The reason behind this is a multiple fold, but my main selfish wish is to get rid of yaourt. As you know, it is an "unsafe pacman wrapper" which is capable of a very basic elevation via sudo. Once that is complete, I have been itching to try and minimise the use/requirement of root, or as it's better known - apply the principle of least privilege. Would either of the above be suitable for inclusion in pacman/libalpm? Having the thumbs-up, before writing and testing the code, would be appreciated. Thanks Emil

5 16

[pacman-dev] [PATCH v2] pacman: add file checksum validation against mtree
by Emil Velikov 05 Jan '21

05 Jan '21

With libarchive v3.5.0 we have API to fetch the digest from the mtree. Use that to validate if the installed files are modified or not. As always, a modified backup file will trigger a warning but will not result in an actual failure. v2: Produce separate messages for failed to calc checksum vs missing checksum information in mtree Signed-off-by: Emil Velikov <emil.l.velikov(a)gmail.com> --- src/pacman/check.c | 74 +++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 67 insertions(+), 7 deletions(-) diff --git a/src/pacman/check.c b/src/pacman/check.c index 02217d0f..ec741a95 100644 --- a/src/pacman/check.c +++ b/src/pacman/check.c @@ -176,19 +176,78 @@ static int check_file_size(const char *pkgname, const char *filepath, return 0; } -/* placeholders - libarchive currently does not read checksums from mtree files -static int check_file_md5sum(const char *pkgname, const char *filepath, - struct stat *st, struct archive_entry *entry, int backup) +#if ARCHIVE_VERSION_NUMBER >= 3005000 +static int check_file_cksum(const char *pkgname, const char *filepath, + int backup, const char *cksum_name, const char *cksum_calc, const char *cksum_mtree) { + if(!cksum_calc) { + if(!config->quiet) { + pm_printf(ALPM_LOG_WARNING, _("%s: %s (failed to calculate %s checksum)\n"), + pkgname, filepath, cksum_name); + } + return 1; + } + + if(!cksum_mtree) { + if(!config->quiet) { + pm_printf(ALPM_LOG_WARNING, _("%s: %s (%s checksum information not available)\n"), + pkgname, filepath, cksum_name); + } + return 1; + } + + if(strcmp(cksum_calc, cksum_mtree) != 0) { + if(backup) { + if(!config->quiet) { + printf("%s%s%s: ", config->colstr.title, _("backup file"), + config->colstr.nocolor); + printf(_("%s: %s (%s checksum mismatch)\n"), + pkgname, filepath, cksum_name); + } + return 0; + } + if(!config->quiet) { + pm_printf(ALPM_LOG_WARNING, _("%s: %s (%s checksum mismatch)\n"), + pkgname, filepath, cksum_name); + } + return 1; + } + return 0; } +#endif + +static int check_file_md5sum(const char *pkgname, const char *filepath, + struct archive_entry *entry, int backup) +{ + int errors = 0; +#if ARCHIVE_VERSION_NUMBER >= 3005000 + char *cksum_calc = alpm_compute_md5sum(filepath); + char *cksum_mtree = hex_representation(archive_entry_digest(entry, + ARCHIVE_ENTRY_DIGEST_MD5), 16); + errors = check_file_cksum(pkgname, filepath, backup, "MD5", cksum_calc, + cksum_mtree); + free(cksum_mtree); + free(cksum_calc); +#endif + return (errors != 0 ? 1 : 0); +} static int check_file_sha256sum(const char *pkgname, const char *filepath, - struct stat *st, struct archive_entry *entry, int backup) + struct archive_entry *entry, int backup) { - return 0; + int errors = 0; +#if ARCHIVE_VERSION_NUMBER >= 3005000 + char *cksum_calc = alpm_compute_sha256sum(filepath); + char *cksum_mtree = hex_representation(archive_entry_digest(entry, + ARCHIVE_ENTRY_DIGEST_SHA256), 32); + errors = check_file_cksum(pkgname, filepath, backup, "SHA256", cksum_calc, + cksum_mtree); + free(cksum_mtree); + free(cksum_calc); +#endif + return (errors != 0 ? 1 : 0); } -*/ /* Loop through the files of the package to check if they exist. */ int check_pkg_fast(alpm_pkg_t *pkg) @@ -369,7 +428,8 @@ int check_pkg_full(alpm_pkg_t *pkg) if(type == AE_IFREG) { file_errors += check_file_size(pkgname, filepath, &st, entry, backup); - /* file_errors += check_file_md5sum(pkgname, filepath, &st, entry, backup); */ + file_errors += check_file_md5sum(pkgname, filepath, entry, backup); + file_errors += check_file_sha256sum(pkgname, filepath, entry, backup); } if(config->quiet && file_errors) { -- 2.30.0

2 1

[pacman-dev] [PATCH v2 1/3] meson: pacman-conf add missing libcommon link
by Emil Velikov 05 Jan '21

05 Jan '21

Currently, we are erroneously exporting all the symbols via the libalpm.so. As such, the libcommon dependency is resolved. The libalpm.so exports are about to be resolved shortly, yet that exposed that pacman-conf is missing a link against libcommon. Signed-off-by: Emil Velikov <emil.l.velikov(a)gmail.com> --- meson.build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meson.build b/meson.build index 264c6501..740ad717 100644 --- a/meson.build +++ b/meson.build @@ -347,7 +347,7 @@ executable( 'pacman-conf', pacman_conf_sources, include_directories : includes, - link_with : [libalpm], + link_with : [libalpm, libcommon], dependencies : [libarchive], install : true, ) -- 2.30.0

1 2

[pacman-dev] [PATCH 1/3] Remove pre libarchive 3.0 code
by Emil Velikov 05 Jan '21

05 Jan '21

Pacman has required libarchive 3.0 or later for quite some time mow. Signed-off-by: Emil Velikov <emil.l.velikov(a)gmail.com> --- lib/libalpm/libarchive-compat.h | 20 -------------------- 1 file changed, 20 deletions(-) diff --git a/lib/libalpm/libarchive-compat.h b/lib/libalpm/libarchive-compat.h index 0ff005ae..596fd664 100644 --- a/lib/libalpm/libarchive-compat.h +++ b/lib/libalpm/libarchive-compat.h @@ -24,48 +24,28 @@ static inline int _alpm_archive_read_free(struct archive *archive) { -#if ARCHIVE_VERSION_NUMBER >= 3000000 return archive_read_free(archive); -#else - return archive_read_finish(archive); -#endif } static inline int64_t _alpm_archive_compressed_ftell(struct archive *archive) { -#if ARCHIVE_VERSION_NUMBER >= 3000000 return archive_filter_bytes(archive, -1); -#else - return archive_position_compressed(archive); -#endif } static inline int _alpm_archive_read_open_file(struct archive *archive, const char *filename, size_t block_size) { -#if ARCHIVE_VERSION_NUMBER >= 3000000 return archive_read_open_filename(archive, filename, block_size); -#else - return archive_read_open_file(archive, filename, block_size); -#endif } static inline int _alpm_archive_filter_code(struct archive *archive) { -#if ARCHIVE_VERSION_NUMBER >= 3000000 return archive_filter_code(archive, 0); -#else - return archive_compression(archive); -#endif } static inline int _alpm_archive_read_support_filter_all(struct archive *archive) { -#if ARCHIVE_VERSION_NUMBER >= 3000000 return archive_read_support_filter_all(archive); -#else - return archive_read_support_compression_all(archive); -#endif } #endif /* LIBARCHIVE_COMPAT_H */ -- 2.29.2

2 6

[pacman-dev] [PATCH 1/3] meson: replace objects with link_whole
by Emil Velikov 04 Jan '21

04 Jan '21

Instead extracting/listing objects from existing static libraries, simply add those to the link list. Note that link_whole is needed otherwise, unused code will be pruned. Signed-off-by: Emil Velikov <emil.l.velikov(a)gmail.com> --- meson.build | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/meson.build b/meson.build index 264c6501..fd573826 100644 --- a/meson.build +++ b/meson.build @@ -310,15 +310,14 @@ alpm_deps = [crypto_provider, libarchive, libcurl, libintl, gpgme] libalpm_a = static_library( 'alpm_objlib', libalpm_sources, - # https://github.com/mesonbuild/meson/issues/3937 - objects : libcommon.extract_all_objects(), + link_whole: libcommon, include_directories : includes, dependencies : alpm_deps) libalpm = library( 'alpm', version : libalpm_version, - objects: libalpm_a.extract_all_objects(recursive: true), + link_whole: libalpm_a, dependencies : alpm_deps, install : true) -- 2.29.2

3 10