February 2021 - Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH] makepkg: --source should download repos with PGP signatures
by Eli Schwartz 08 Apr '21

08 Apr '21

We optimize this out for sourceballs since VCS sources don't get their checksums verified. But this logic is broken ever since we implemented PGP signature checking for git sources -- if the git source is signed, we still check it, but we don't make sure to download it first. makepkg then fails to generate a sourceball unless you previously ran --verifysource or attempted to build. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- scripts/libmakepkg/source.sh.in | 5 ++++- scripts/libmakepkg/source/git.sh.in | 9 ++++++--- scripts/makepkg.sh.in | 2 +- 3 files changed, 11 insertions(+), 5 deletions(-) diff --git a/scripts/libmakepkg/source.sh.in b/scripts/libmakepkg/source.sh.in index a0c6b662..b95e6be8 100644 --- a/scripts/libmakepkg/source.sh.in +++ b/scripts/libmakepkg/source.sh.in @@ -35,7 +35,7 @@ done download_sources() { local netfile all_sources - local get_source_fn=get_all_sources_for_arch get_vcs=1 + local get_source_fn=get_all_sources_for_arch get_vcs=1 get_pgp=0 msg "$(gettext "Retrieving sources...")" @@ -47,6 +47,9 @@ download_sources() { novcs) get_vcs=0 ;; + getpgp) + (( SKIPPGPCHECK )) || get_pgp=1 + ;; *) break ;; diff --git a/scripts/libmakepkg/source/git.sh.in b/scripts/libmakepkg/source/git.sh.in index 7d191b8d..d090f14e 100644 --- a/scripts/libmakepkg/source/git.sh.in +++ b/scripts/libmakepkg/source/git.sh.in @@ -29,13 +29,16 @@ source "$LIBRARY/util/pkgbuild.sh" download_git() { + local netfile=$1 + local query=$(get_uri_query "$netfile") + # abort early if parent says not to fetch if declare -p get_vcs > /dev/null 2>&1; then - (( get_vcs )) || return + if (( ! get_pgp )) || [[ $query != signed ]]; then + (( get_vcs )) || return + fi fi - local netfile=$1 - local dir=$(get_filepath "$netfile") [[ -z "$dir" ]] && dir="$SRCDEST/$(get_filename "$netfile")" diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 7e8d6805..c9940f0a 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -1416,7 +1416,7 @@ if (( SOURCEONLY )); then download_sources allarch elif ( (( ! SKIPCHECKSUMS )) || \ ( (( ! SKIPPGPCHECK )) && source_has_signatures ) ); then - download_sources allarch novcs + download_sources allarch novcs getpgp fi check_source_integrity all cd_safe "$startdir" -- 2.28.0

2 1

[pacman-dev] [PATCH v2] pacman-key: --refresh-keys queries WKD before keyserver
by Morten Linderud 03 Mar '21

03 Mar '21

From: Morten Linderud <morten(a)linderud.pw> With the recent outages of the keyservers there is a possibility of `--refresh-keys` failing to fetch new keys. A lot of current key distribution is done over WKD these days, and `pacman-key` has the ability to use it for `--recv-key`. There was a hope `gpg` would end up supporting WKD for the refresh functionality, but this seems to be limited to expired keys fetched through WKD. Since this functionality isn't yet available it makes sense to stuff it into `pacman-key`. The current implementation looks over all available keyids in the keyring, attempts to fetch over WKD and then fall backs to keyservers if no email has a valid WKD available. The downside of this approach is that it takes a bit longer to refresh the keys, but it should be more robust as the distribution should be providing their own WKDs. Co-authored-by: Jonas Witschel <diabonas(a)archlinux.org> Signed-off-by: Morten Linderud <morten(a)linderud.pw> --- * Done grep -vx * Removed the redundant error since it's caught by `check_keyids_exist` * Improved the error message with the keyid scripts/pacman-key.sh.in | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index c65669f5..e89d7af9 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -540,11 +540,36 @@ receive_keys() { } refresh_keys() { + local ret=0 ids masterkey emails + check_keyids_exist "$@" - if ! "${GPG_PACMAN[@]}" --refresh-keys "$@" ; then - error "$(gettext "A specified local key could not be updated from a keyserver.")" - exit 1 - fi + + # don't try to refresh the user's local masterkey + masterkey="$("${GPG_PACMAN[@]}" --list-keys --with-colons pacman@localhost | + awk -F: '$1 == "pub" { print $5 }')" + + mapfile -t ids < \ + <("${GPG_PACMAN[@]}" --list-keys --with-colons "$@" | + awk -F: '$1 == "pub" { print $5 }' | grep -vx "$masterkey") + + for id in "${ids[@]}"; do + mapfile -t emails < \ + <("${GPG_PACMAN[@]}" --list-keys --list-options show-only-fpr-mbox "$id" | + awk '{print $2 }') + + # first try looking up the key in a WKD (only works by email address) + for email in "${emails[@]}"; do + "${GPG_PACMAN[@]}" --locate-external-keys "$email" && break + done + + # if no key was found, fall back to using the keyservers (with the key fingerprint instead) + if (( $? )) && ! "${GPG_PACMAN[@]}" --refresh-keys "$id"; then + error "$(gettext "The following key could not be updated from WKD or keyserver: %s")" "$id" + ret=1 + fi + done + + exit $ret } verify_sig() { -- 2.30.1

3 3

[pacman-dev] [PATCH] Remove "total download" callback in favor of generic event callback
by Anatol Pomozov 01 Mar '21

01 Mar '21

Total download callback called right before packages start downloaded. But we already have an event for such event (ALPM_EVENT_PKG_RETRIEVE_START) and it is naturally to use the event to pass information about expected download size. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- README | 1 - lib/libalpm/alpm.h | 32 ++++++++++++-------------------- lib/libalpm/dload.c | 2 +- lib/libalpm/handle.c | 13 ------------- lib/libalpm/handle.h | 1 - lib/libalpm/sync.c | 25 +++++++++---------------- src/pacman/callback.c | 9 ++------- src/pacman/callback.h | 2 -- src/pacman/conf.c | 4 ---- 9 files changed, 24 insertions(+), 65 deletions(-) diff --git a/README b/README index 6aa68374..470ccf3c 100644 --- a/README +++ b/README @@ -52,7 +52,6 @@ library is initialized. * logcb: The callback function for "log" operations. * dlcb: The callback function for download progress of each package. * fetchcb: Callback for custom download function. -* totaldlcb: The callback function for overall download progress. * eventcb: Callback for transaction messages. * questioncb: Callback for selecting amongst choices. * progresscb: Callback to handle display of transaction progress. diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index 230f872e..3213f5cc 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -926,6 +926,16 @@ typedef struct _alpm_event_hook_run_t { size_t total; } alpm_event_hook_run_t; +/** An optional dependency was removed. */ +typedef struct _alpm_event_pkg_retrieve_t { + /** Type of event */ + alpm_event_type_t type; + /** Number of packages to download */ + size_t num; + /** Total size of packages to download */ + off_t total_size; +} alpm_event_pkg_retrieve_t; + /** Events. * This is a union passed to the callback that allows the frontend to know * which type of event was triggered (via type). It is then possible to @@ -954,6 +964,8 @@ typedef union _alpm_event_t { alpm_event_hook_t hook; /** A hook was ran */ alpm_event_hook_run_t hook_run; + /** Download packages */ + alpm_event_pkg_retrieve_t pkg_retrieve; } alpm_event_t; /** Event callback. @@ -1197,12 +1209,6 @@ typedef void (*alpm_cb_download)(const char *filename, alpm_download_event_type_t event, void *data); -/** Total Download callback. - * @param howmany the number of packages that will be downloaded during \link alpm_trans_commit \endlink. - * @param total amount that will be downloaded during \link alpm_trans_commit \endlink. - */ -typedef void (*alpm_cb_totaldl)(size_t howmany, off_t total); - /** A callback for downloading files * @param url the URL of the file to be downloaded * @param localpath the directory to which the file should be downloaded @@ -1525,20 +1531,6 @@ alpm_cb_fetch alpm_option_get_fetchcb(alpm_handle_t *handle); */ int alpm_option_set_fetchcb(alpm_handle_t *handle, alpm_cb_fetch cb); -/** Returns the callback used to report total download size. - * @param handle the context handle - * @return the currently set total download callback - */ -alpm_cb_totaldl alpm_option_get_totaldlcb(alpm_handle_t *handle); - -/** Sets the callback used to report total download size. - * @param handle the context handle - * @param cb the cb to use - * @return 0 on success, -1 on error (pm_errno is set accordingly) - */ -int alpm_option_set_totaldlcb(alpm_handle_t *handle, alpm_cb_totaldl cb); - - /** Returns the callback used for events. * @param handle the context handle * @return the currently set event callback diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index df5e8be7..5d44bbb4 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -851,7 +851,7 @@ int SYMEXPORT alpm_fetch_pkgurl(alpm_handle_t *handle, const alpm_list_t *urls, const char *cachedir; alpm_list_t *payloads = NULL; const alpm_list_t *i; - alpm_event_t event; + alpm_event_t event = {0}; CHECK_HANDLE(handle, return -1); ASSERT(*fetched == NULL, RET_ERR(handle, ALPM_ERR_WRONG_ARGS, -1)); diff --git a/lib/libalpm/handle.c b/lib/libalpm/handle.c index 0444ee5d..cf399a44 100644 --- a/lib/libalpm/handle.c +++ b/lib/libalpm/handle.c @@ -174,12 +174,6 @@ alpm_cb_fetch SYMEXPORT alpm_option_get_fetchcb(alpm_handle_t *handle) return handle->fetchcb; } -alpm_cb_totaldl SYMEXPORT alpm_option_get_totaldlcb(alpm_handle_t *handle) -{ - CHECK_HANDLE(handle, return NULL); - return handle->totaldlcb; -} - alpm_cb_event SYMEXPORT alpm_option_get_eventcb(alpm_handle_t *handle) { CHECK_HANDLE(handle, return NULL); @@ -327,13 +321,6 @@ int SYMEXPORT alpm_option_set_fetchcb(alpm_handle_t *handle, alpm_cb_fetch cb) return 0; } -int SYMEXPORT alpm_option_set_totaldlcb(alpm_handle_t *handle, alpm_cb_totaldl cb) -{ - CHECK_HANDLE(handle, return -1); - handle->totaldlcb = cb; - return 0; -} - int SYMEXPORT alpm_option_set_eventcb(alpm_handle_t *handle, alpm_cb_event cb) { CHECK_HANDLE(handle, return -1); diff --git a/lib/libalpm/handle.h b/lib/libalpm/handle.h index 3e7d323e..03cca1ee 100644 --- a/lib/libalpm/handle.h +++ b/lib/libalpm/handle.h @@ -72,7 +72,6 @@ struct __alpm_handle_t { /* callback functions */ alpm_cb_log logcb; /* Log callback function */ alpm_cb_download dlcb; /* Download callback function */ - alpm_cb_totaldl totaldlcb; /* Total download callback function */ alpm_cb_fetch fetchcb; /* Download file callback function */ alpm_cb_event eventcb; alpm_cb_question questioncb; diff --git a/lib/libalpm/sync.c b/lib/libalpm/sync.c index c742e395..3ccf299e 100644 --- a/lib/libalpm/sync.c +++ b/lib/libalpm/sync.c @@ -749,7 +749,7 @@ static int download_files(alpm_handle_t *handle) const char *cachedir; alpm_list_t *i, *files = NULL; int ret = 0; - alpm_event_t event; + alpm_event_t event = {0}; alpm_list_t *payloads = NULL; cachedir = _alpm_filecache_setup(handle); @@ -760,21 +760,6 @@ static int download_files(alpm_handle_t *handle) goto finish; } - /* Total progress - figure out the total download size if required to - * pass to the callback. This function is called once, and it is up to the - * frontend to compute incremental progress. */ - if(handle->totaldlcb) { - off_t total_size = (off_t)0; - size_t howmany = 0; - /* sum up the download size for each package and store total */ - for(i = files; i; i = i->next) { - alpm_pkg_t *spkg = i->data; - total_size += spkg->download_size; - howmany++; - } - handle->totaldlcb(howmany, total_size); - } - if(files) { /* check for necessary disk space for download */ if(handle->checkspace) { @@ -800,6 +785,14 @@ static int download_files(alpm_handle_t *handle) } event.type = ALPM_EVENT_PKG_RETRIEVE_START; + + /* sum up the number of packages to download and its total size */ + for(i = files; i; i = i->next) { + alpm_pkg_t *spkg = i->data; + event.pkg_retrieve.total_size += spkg->download_size; + event.pkg_retrieve.num++; + } + EVENT(handle, &event); for(i = files; i; i = i->next) { alpm_pkg_t *pkg = i->data; diff --git a/src/pacman/callback.c b/src/pacman/callback.c index 7468ed7e..3eae626a 100644 --- a/src/pacman/callback.c +++ b/src/pacman/callback.c @@ -338,6 +338,8 @@ void cb_event(alpm_event_t *event) case ALPM_EVENT_PKG_RETRIEVE_START: colon_printf(_("Retrieving packages...\n")); on_progress = 1; + list_total_pkgs = event->pkg_retrieve.num; + list_total = event->pkg_retrieve.total_size; total_enabled = config->totaldownload && list_total; if(total_enabled) { init_total_progressbar(); @@ -696,13 +698,6 @@ void cb_progress(alpm_progress_t event, const char *pkgname, int percent, } } -/* callback to handle receipt of total download value */ -void cb_dl_total(size_t howmany, off_t total) -{ - list_total_pkgs = howmany; - list_total = total; -} - static int dload_progressbar_enabled(void) { return !config->noprogressbar && (getcols() != 0); diff --git a/src/pacman/callback.h b/src/pacman/callback.h index 508c96b3..c1fe8f86 100644 --- a/src/pacman/callback.h +++ b/src/pacman/callback.h @@ -35,8 +35,6 @@ void cb_question(alpm_question_t *question); void cb_progress(alpm_progress_t event, const char *pkgname, int percent, size_t howmany, size_t remain); -/* callback to handle receipt of total download value */ -void cb_dl_total(size_t howmany, off_t total); /* callback to handle display of download progress */ void cb_download(const char *filename, alpm_download_event_type_t event, void *data); diff --git a/src/pacman/conf.c b/src/pacman/conf.c index 3a3ef605..b4661583 100644 --- a/src/pacman/conf.c +++ b/src/pacman/conf.c @@ -892,10 +892,6 @@ static int setup_libalpm(void) pm_printf(ALPM_LOG_WARNING, _("no '%s' configured\n"), "XferCommand"); } - if(config->totaldownload) { - alpm_option_set_totaldlcb(handle, cb_dl_total); - } - alpm_option_set_arch(handle, config->arch); alpm_option_set_checkspace(handle, config->checkspace); alpm_option_set_usesyslog(handle, config->usesyslog); -- 2.30.1

2 1

[pacman-dev] [PATCH] doas makepkg support
by Erich Ericson 26 Feb '21

26 Feb '21

The following patches should enable doas support for privilege escalation in makepkg as well as document the absence thereof in binary verification. As doas gained a little traction over the last weeks and with its presence in the official repos it seems like a cheap, yet beneficial patch to the featureset of makepkg. It might not be an exhaustive patchset as I don't know all of makepkg's and libmakepkg's intricacies, but it has been tested by me and seems to work as expected. Nonetheless those patches should "point in the right direction". >From 10ffa30e21e94801c444704362342610e49034ab Mon Sep 17 00:00:00 2001 From: Erich Ericson <fakefakefans(a)gmail.com> Date: Sun, 21 Feb 2021 01:12:04 +0100 Subject: [PATCH] doas privilege escalation in makepkg Signed-off-by: Erich Ericson <fakefakefans(a)gmail.com> --- scripts/makepkg.sh.in | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index b39433f3..47b3001d 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -232,6 +232,8 @@ run_pacman() { cmd=("$PACMAN_PATH" "${PACMAN_OPTS[@]}" "$@") if type -p sudo >/dev/null; then cmd=(sudo "${cmd[@]}") + elif type -p doas >/dev/null; then + cmd=(doas "${cmd[@]}") else cmd=(su root -c "$(printf '%q ' "${cmd[@]}")") fi -- 2.30.1 >From 2a455f2adc1bc87ed6b1d23261c8f911a7cc066b Mon Sep 17 00:00:00 2001 From: Erich Ericson <fakefakefans(a)gmail.com> Date: Sun, 21 Feb 2021 17:35:26 +0100 Subject: [PATCH] add prompting support for doas binary Signed-off-by: Erich Ericson <fakefakefans(a)gmail.com> --- scripts/libmakepkg/executable/sudo.sh.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/libmakepkg/executable/sudo.sh.in b/scripts/libmakepkg/executable/sudo.sh.in index 9e50a76b..4d701946 100644 --- a/scripts/libmakepkg/executable/sudo.sh.in +++ b/scripts/libmakepkg/executable/sudo.sh.in @@ -29,8 +29,8 @@ executable_functions+=('executable_sudo') executable_sudo() { if (( DEP_BIN || RMDEPS || INSTALL )); then - if ! type -p sudo >/dev/null; then - warning "$(gettext "Cannot find the %s binary. Will use %s to acquire root privileges.")" "sudo" "su" + if ! type -p sudo >/dev/null || ! type -p doas >/dev/null; then + warning "$(gettext "Cannot find neither the %s nor %s binary. Will use %s to acquire root privileges.")" "sudo" "doas" "su" fi fi } -- 2.30.1 Erich "DaErich" Ericson

4 4

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v6.0.0alpha1-72-g0f75ab32
by Allan McRae 24 Feb '21

24 Feb '21

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via 0f75ab3224141a5e8a4fe72b48b4639c83c6316b (commit) via 7587153a447bd537c8f138be9ca0a3886a5f1e57 (commit) from 17d3da477770313a16a4f29ecae8476613ad3277 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0f75ab3224141a5e8a4fe72b48b4639c83c6316b Author: Morten Linderud <morten(a)linderud.pw> Date: Mon Feb 22 00:09:07 2021 +0100 pacman-key: --refresh-keys queries WKD before keyserver With the recent outages of the keyservers there is a possibility of `--refresh-keys` failing to fetch new keys. A lot of current key distribution is done over WKD these days, and `pacman-key` has the ability to use it for `--recv-key`. There was a hope `gpg` would end up supporting WKD for the refresh functionality, but this seems to be limited to expired keys fetched through WKD. Since this functionality isn't yet available it makes sense to stuff it into `pacman-key`. The current implementation looks over all available keyids in the keyring, attempts to fetch over WKD and then fall backs to keyservers if no email has a valid WKD available. The downside of this approach is that it takes a bit longer to refresh the keys, but it should be more robust as the distribution should be providing their own WKDs. Co-authored-by: Jonas Witschel <diabonas(a)archlinux.org> Signed-off-by: Morten Linderud <morten(a)linderud.pw> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 7587153a447bd537c8f138be9ca0a3886a5f1e57 Author: Morten Linderud <morten(a)linderud.pw> Date: Sun Feb 21 22:36:31 2021 +0100 libmakepkg: Support zstd decompression for sources This enables us to extract files in the source array and ensures that we can decompress files if the uncompressed signature is served. Signed-off-by: Morten Linderud <morten(a)linderud.pw> Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: .../libmakepkg/integrity/verify_signature.sh.in | 3 +- scripts/libmakepkg/source/file.sh.in | 5 ++++ scripts/pacman-key.sh.in | 33 +++++++++++++++++++--- 3 files changed, 36 insertions(+), 5 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [PATCH] Adds a --nowait option
by Daniel Radetsky 24 Feb '21

24 Feb '21

Apologies if gmail ruins this. I'm used to github prs & don't have time to setup mutt at the moment. If pacman is in use, makepkg -si will wait until it is available. This can be undesirable if you aren't running makepkg -si in the normal interactive way. For example, if you're running it from ansible (so shell output is supressed), and you also have a pacman -Syuw running in another terminal which you forgot to confirm, it will hang forever and you won't know why. More generally, if you're running it in any kind of non-interactive environment, you may want it to fail fast instead of waiting for some other condition to resolve. This is kind of a work-in-progress. I'm not totally sure what to do with the .po files (do I manually fix all the line number comments? God, I hope not). And maybe --nowait is a bad name; I'd have gone with a longer name normally like --no-wait-for-pacman, since I don't expect this to be something a user is typing a lot in a terminal, but writing and copypasta-ing in a script. But I also didn't want to buck the conventions. Whatever, I can change it. Signed-off-by: Daniel Radetsky <dradetsky(a)gmail.com> --- scripts/makepkg.sh.in | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index b39433f3..a1a450dd 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -67,6 +67,7 @@ NOARCHIVE=0 NOBUILD=0 NODEPS=0 NOEXTRACT=0 +NOWAIT=0 PKGFUNC=0 PKGVERFUNC=0 PREPAREFUNC=0 @@ -236,6 +237,10 @@ run_pacman() { cmd=(su root -c "$(printf '%q ' "${cmd[@]}")") fi local lockfile="$(pacman-conf DBPath)/db.lck" + if (( NOWAIT )) && [[ -f $lockfile ]]; then + msg "$(gettext "Pacman is currently in use, exiting")" + exit $E_FAIL + fi while [[ -f $lockfile ]]; do local timer=0 msg "$(gettext "Pacman is currently in use, please wait...")" @@ -984,6 +989,7 @@ usage() { printf -- "$(gettext " --nocheck Do not run the %s function in the %s")\n" "check()" "$BUILDSCRIPT" printf -- "$(gettext " --noprepare Do not run the %s function in the %s")\n" "prepare()" "$BUILDSCRIPT" printf -- "$(gettext " --nosign Do not create a signature for the package")\n" + printf -- "$(gettext " --nowait Exit immediately if pacman is in use")\n" printf -- "$(gettext " --packagelist Only list package filepaths that would be produced")\n" printf -- "$(gettext " --printsrcinfo Print the generated SRCINFO and exit")\n" printf -- "$(gettext " --sign Sign the resulting package with %s")\n" "gpg" @@ -1030,10 +1036,11 @@ ARGLIST=("$@") # Parse Command Line Options. OPT_SHORT="AcCdefFghiLmop:rRsSV" OPT_LONG=('allsource' 'check' 'clean' 'cleanbuild' 'config:' 'force' 'geninteg' - 'help' 'holdver' 'ignorearch' 'install' 'key:' 'log' 'noarchive' 'nobuild' - 'nocolor' 'nocheck' 'nodeps' 'noextract' 'noprepare' 'nosign' 'packagelist' - 'printsrcinfo' 'repackage' 'rmdeps' 'sign' 'skipchecksums' 'skipinteg' - 'skippgpcheck' 'source' 'syncdeps' 'verifysource' 'version') + 'help' 'holdver' 'ignorearch' 'install' 'key:' 'log' 'noarchive' + 'nobuild' 'nocolor' 'nocheck' 'nodeps' 'noextract' 'noprepare' + 'nosign' 'nowait' 'packagelist' 'printsrcinfo' 'repackage' 'rmdeps' + 'sign' 'skipchecksums' 'skipinteg' 'skippgpcheck' 'source' 'syncdeps' + 'verifysource' 'version') # Pacman Options OPT_LONG+=('asdeps' 'noconfirm' 'needed' 'noprogressbar') @@ -1074,6 +1081,7 @@ while true; do --nocheck) RUN_CHECK='n' ;; --noprepare) RUN_PREPARE='n' ;; --nosign) SIGNPKG='n' ;; + --nowait) NOWAIT=1 ;; -o|--nobuild) BUILDPKG=0 NOBUILD=1 ;; -p) shift; BUILDFILE=$1 ;; --packagelist) BUILDPKG=0 PACKAGELIST=1 IGNOREARCH=1;; -- 2.30.0

4 4

[pacman-dev] [PATCH] libmakepkg: Support zstd decompression
by Morten Linderud 21 Feb '21

21 Feb '21

From: Morten Linderud <morten(a)linderud.pw> This enables us to extract files in the source array and ensures that we can decompress files if the uncompressed signature is served. Signed-off-by: Morten Linderud <morten(a)linderud.pw> --- scripts/libmakepkg/integrity/verify_signature.sh.in | 3 ++- scripts/libmakepkg/source/file.sh.in | 5 +++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/scripts/libmakepkg/integrity/verify_signature.sh.in b/scripts/libmakepkg/integrity/verify_signature.sh.in index 2be5c493..2960ebbe 100644 --- a/scripts/libmakepkg/integrity/verify_signature.sh.in +++ b/scripts/libmakepkg/integrity/verify_signature.sh.in @@ -134,7 +134,7 @@ verify_file_signature() { fi found=0 - for ext in "" gz bz2 xz lrz lzo Z; do + for ext in "" gz bz2 xz lrz lzo Z zst; do if sourcefile="$(get_filepath "${file%.*}${ext:+.$ext}")"; then found=1 break @@ -152,6 +152,7 @@ verify_file_signature() { xz) decompress="xz -c -d" ;; lrz) decompress="lrzip -q -d" ;; lzo) decompress="lzop -c -d -q" ;; + zst) decompress="zstd -d -q -f" ;; Z) decompress="uncompress -c -f" ;; "") decompress="cat" ;; esac diff --git a/scripts/libmakepkg/source/file.sh.in b/scripts/libmakepkg/source/file.sh.in index b29aeb04..cbaab315 100644 --- a/scripts/libmakepkg/source/file.sh.in +++ b/scripts/libmakepkg/source/file.sh.in @@ -118,6 +118,11 @@ extract_file() { xz) cmd="xz" ;; *) return;; esac ;; + *application/zstd*) + case "$ext" in + zst) cmd="zstd" ;; + *) return;; + esac ;; *) # See if bsdtar can recognize the file if bsdtar -tf "$file" -q '*' &>/dev/null; then -- 2.30.1

1 0

[pacman-dev] Improve locking?
by lilydjwg 20 Feb '21

20 Feb '21

I still have issues with leftover lock file. I have some questions: In pacman.c cleanup function, the signal handler is removed before unlocking because > The soft interrupt handler dereferences config, causing a segfault if > it is called during cleanup. (commit a8e2578febbb71d1b788c7270c2be57ca1e64dec) Why wasn't it to check if config is not NULL instead? Why wasn't flock used? I mean, in addition to current lock mechanism, flock the file. I know flock doesn't work for a couple of places (NFS, non-Linux, etc), but if it works for someone's situation, it would help a lot. Thanks in advance. -- Best regards, lilydjwg

1 0

[pacman-dev] Feature: -T0 flag as default ZSTDCOMPRESSION arg
by Frederik Enste 09 Feb '21

09 Feb '21

Hello pacman devs, today I installed a big package from the AUR on a clean system and forgot to adjust the makepkg.conf beforehand. As makepkg.conf is set up to compresses all packages with zstd before installing them onto the system the compression took a while. Because of that, I would like to add the -T0 flag to the list of default ZSTCOMPRESSION args. This would allow zstd to spawn multiple compression flags (equal to the number of physical processors) and thus speed up package compression. I have created a simple patch for this feature but as this is my first contribution to this project I am not entirely sure that I adjusted all necessary files: From 6a8d811fbced5a799d88ee357d4b0c694d79e0f7 Mon Sep 17 00:00:00 2001 From: Frederik Enste <frederik(a)fenste.de> Date: Tue, 9 Feb 2021 22:43:56 +0100 Subject: [PATCH] added -T0 flag to default zstd compression Signed-off-by: Frederik Enste <frederik(a)fenste.de> --- doc/makepkg.conf.5.asciidoc | 2 +- etc/makepkg.conf.in | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/makepkg.conf.5.asciidoc b/doc/makepkg.conf.5.asciidoc index 04cc5ea9..40129a01 100644 --- a/doc/makepkg.conf.5.asciidoc +++ b/doc/makepkg.conf.5.asciidoc @@ -259,7 +259,7 @@ Options **COMPRESSGZ=**"(gzip -c -f -n)":: **COMPRESSBZ2=**"(bzip2 -c -f)":: **COMPRESSXZ=**"(xz -c -z -)":: -**COMPRESSZST=**"(zstd -c -z -)":: +**COMPRESSZST=**"(zstd -c -z -T0 -)":: **COMPRESSLZO**"(lzop -q)":: **COMPRESSLRZ=**"(lrzip -q)":: **COMPRESSLZ4=**"(lz4 -q)":: diff --git a/etc/makepkg.conf.in b/etc/makepkg.conf.in index b13b1d5d..8d655bf8 100644 --- a/etc/makepkg.conf.in +++ b/etc/makepkg.conf.in @@ -133,7 +133,7 @@ DBGSRCDIR="/usr/src/debug" COMPRESSGZ=(gzip -c -f -n) COMPRESSBZ2=(bzip2 -c -f) COMPRESSXZ=(xz -c -z -) -COMPRESSZST=(zstd -c -z -q -) +COMPRESSZST=(zstd -c -z -q -T0 -) COMPRESSLRZ=(lrzip -q) COMPRESSLZO=(lzop -q) COMPRESSZ=(compress -c -f) -- 2.30.0 Of course, I would understand if this "feature" is not important or requested by other users as everybody could change the makepkg.conf in seconds but please let me know what you think about this. Best regards, Frederik Enste

3 2

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v6.0.0alpha1-70-g17d3da47
by Allan McRae 08 Feb '21

08 Feb '21

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via 17d3da477770313a16a4f29ecae8476613ad3277 (commit) via cc1d23d333992611c4f0bd7e95c4d11fd5c7eaff (commit) via 9e425cd1ea4a5fe7e7d7f1daa225eed37650dafc (commit) via 2b8d00b7993435a8dc6f560b508a33050830ceec (commit) via 3a23abb2ec0c99d74719f97dcc9d097a105fe42b (commit) via 88d054093c1c99a697d95b26bd9aad5bc4d8e170 (commit) from ab549c846707230e44e2b7e08c6a04d44af916cd (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 17d3da477770313a16a4f29ecae8476613ad3277 Author: Emil Velikov <emil.l.velikov(a)gmail.com> Date: Sat Jan 23 21:40:04 2021 +0000 Revert "ci: cache packages" This reverts commit e348ba38814c9cc7c1c9892d0451096234dc39ab. With the above commit we started caching the downloaded packages. Based on some testing and, it saves ~30s in the "step_script" stage while adding 18s for "Restoring/Saving cache". A net saving of ~10s. With earlier commit, we no longer use an ancient image which also pulls base-devel - thus the packages we have to download is minimal. Now comparing the uncached "step_script", vs the cached one - it is slowed by 2-3 seconds (1:01 -> 1:03), while we eliminate the 18s (and growing) caching. Tl:Dr: With up-to date image, package caching in not worth it - be that time, disk or network wise. Signed-off-by: Emil Velikov <emil.l.velikov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit cc1d23d333992611c4f0bd7e95c4d11fd5c7eaff Author: Emil Velikov <emil.l.velikov(a)gmail.com> Date: Sat Jan 23 21:40:03 2021 +0000 ci: use official image The archlinux/base have been deprecated. Since we depend on base-devel simply use archlinux:base-devel Signed-off-by: Emil Velikov <emil.l.velikov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 9e425cd1ea4a5fe7e7d7f1daa225eed37650dafc Author: Matti Niemenmaa <matti.niemenmaa+git(a)iki.fi> Date: Sat Jan 30 19:46:40 2021 +0200 makepkg: Don't double-layer distcc on ccache buildenv is set once for build() and a second time for package(). When using both distcc and ccache, this lead to CCACHE_PREFIX="distcc distcc" in package(), which breaks PKGBUILDs that execute the compiler in package() because distcc complains: distcc[383041] (main) CRITICAL! distcc seems to have invoked itself recursively! Avoid causing this error by only adding "distcc" to CCACHE_PREFIX if it's not yet there. Signed-off-by: Matti Niemenmaa <matti.niemenmaa+git(a)iki.fi> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 2b8d00b7993435a8dc6f560b508a33050830ceec Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Wed Feb 3 16:57:33 2021 -0500 doxygen: fix missing parameter name This was raising a warning during the build. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 3a23abb2ec0c99d74719f97dcc9d097a105fe42b Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Sun Feb 7 19:55:17 2021 -0500 support xattr when extracting packages This permits storing the result of setcap during package() and applying the resulting capabilities to the installed program. Formerly, it was necessary to edit the binary after the fact (and thus dirty the file according to -Qkk) by using an install scriptlet. One problem that needs to be solved before this is useful, is preventing the strip routine from destroying xattrs. This is taken care of in the previous patch. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 88d054093c1c99a697d95b26bd9aad5bc4d8e170 Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Sun Feb 7 23:09:42 2021 -0500 makepkg: don't let the strip routine mess up file attributes It updates the stripped/objcopied file by creating a temp file, chown/chmodding it, and replacing the original file. But upstream binutils has CVE-worthy issues with this if running strip as root, and some recent versions of strip don't play nicely with fakeroot. Also, this has always destroyed xattrs. :/ Sidestep the issue by telling strip/objcopy to write to a temporary file, and manually dump the contents of that back into the original binary. Since the original binary is intact, albeit with different contents, it retains its correct attributes in fakeroot. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: .gitlab-ci.yml | 20 +++++--------------- lib/libalpm/add.c | 1 + lib/libalpm/alpm_list.h | 2 +- scripts/libmakepkg/buildenv/compiler.sh.in | 4 +++- scripts/libmakepkg/tidy/strip.sh.in | 11 +++++++++-- 5 files changed, 19 insertions(+), 19 deletions(-) hooks/post-receive -- The official pacman repository

1 0