March 2024 - Pacman-dev - lists.archlinux.org

[Git][pacman/pacman][master] use snprintf instead of sprintf
by Allan McRae (＠allan) 24 Mar '24

24 Mar '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 01e64e8b by Vladislav Nepogodin at 2024-03-25T13:24:41+10:00 use snprintf instead of sprintf sprintf does not check for buffer overflows (CWE-120) modified: src/pacman/callback.c - - - - - 11 changed files: - lib/libalpm/alpm.c - lib/libalpm/be_local.c - lib/libalpm/be_sync.c - lib/libalpm/conflict.c - lib/libalpm/db.c - lib/libalpm/signing.c - lib/libalpm/sync.c - lib/libalpm/trans.c - src/pacman/callback.c - src/pacman/package.c - src/pacman/query.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/01e64e8b6a25f94b13dc925… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/01e64e8b6a25f94b13dc925… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

No signed 6.1.0 release on sources.archlinux.org
by Ben Westover 20 Mar '24

20 Mar '24

Hello, I package pacman for Debian, and I have been using the tarballs from sources.archlinux.org as my source, since they are PGP signed. 6.1.0 was released a couple weeks ago but still has not appeared at that location. Is this no longer the best place to get pacman source tarballs? Is there anywhere else to look for signed tarballs? Thanks, -- Ben Westover

2 1

[Git][pacman/pacman][release/6.1.x] 2 commits: Limit scope of `name` and `a` variable to avoid conflict with PKGBUILD scripts.
by Allan McRae (＠allan) 20 Mar '24

20 Mar '24

Allan McRae pushed to branch release/6.1.x at Pacman / Pacman Commits: 082094a1 by bartus at 2024-03-19T12:43:00+00:00 Limit scope of `name` and `a` variable to avoid conflict with PKGBUILD scripts. - - - - - b2bb2e24 by Allan McRae at 2024-03-20T21:39:41+10:00 makepkg: Fix missing end of line in -D documentaiton Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 2 changed files: - scripts/libmakepkg/util/pkgbuild.sh.in - scripts/makepkg.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/b59d68a2094287df8af5e8… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/b59d68a2094287df8af5e8… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] makepkg: Fix missing end of line in -D documentaiton
by Allan McRae (＠allan) 20 Mar '24

20 Mar '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: b2bb2e24 by Allan McRae at 2024-03-20T21:39:41+10:00 makepkg: Fix missing end of line in -D documentaiton Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - scripts/makepkg.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/b2bb2e24827450465a9e0a8… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/b2bb2e24827450465a9e0a8… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Limit scope of `name` and `a` variable to avoid conflict with PKGBUILD scripts.
by Allan McRae (＠allan) 19 Mar '24

19 Mar '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 082094a1 by bartus at 2024-03-19T12:43:00+00:00 Limit scope of `name` and `a` variable to avoid conflict with PKGBUILD scripts. - - - - - 1 changed file: - scripts/libmakepkg/util/pkgbuild.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/082094a1d8d0f7a528fe0ad… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/082094a1d8d0f7a528fe0ad… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][release/6.1.x] 5 commits: Fix deadlink to the old bug tracker in footer
by Allan McRae (＠allan) 18 Mar '24

18 Mar '24

Allan McRae pushed to branch release/6.1.x at Pacman / Pacman Commits: 942bbe2d by Dale young at 2024-03-18T17:15:07+08:00 Fix deadlink to the old bug tracker in footer The bug tracker had been updated in doc/index.asciidoc, but the one in doc/footer.asciidoc was still the old one, which is a deadlink now. I udpated it just by copying the sentense in doc/index.asciidoc Signed-off-by: Dale young <daleyoung4242(a)gmail.com> - - - - - 478af5d1 by Allan McRae at 2024-03-19T00:40:09+00:00 Fix read-after-free issue parsing config files We were indirectly adjusting a pointer to a parameter that was declared as a const. This resulted in a use-after-free when using --debug: [11:09:18] debug: config: finished parsing ��A�8_ Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - eb5bf691 by Demi Obenour at 2024-03-19T11:44:38+10:00 Fetch signature and database from the same URL Previously, the for loops on lines 1035 and 1037 would advance to the next element in the server list, even if downloading the URL succeeded. If there are no more servers in the list, `s` would be NULL, causing a NULL pointer dereference on line 1046. If there were servers left in the list, the signature would be downloaded from a wrong URL. 1. Fetching of database signatures is enabled. 2. There is only one enabled remote repository URL, or fetching from all but the last one fails and fetching from the last one succeeds. 3. An XferCommand is used. Qubes OS Arch templates satisfy all of these conditions and trigger the bug. - - - - - 92102f47 by Allan McRae at 2024-03-19T01:47:42+00:00 makepkg: document -D in --help text Fixes #110. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - b59d68a2 by Allan McRae at 2024-03-19T12:02:44+10:00 Update bug report URL in tranlsation configuration files Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 10 changed files: - doc/footer.asciidoc - lib/libalpm/dload.c - lib/libalpm/po/Makevars - lib/libalpm/po/meson.build - scripts/makepkg.sh.in - scripts/po/Makevars - scripts/po/meson.build - src/pacman/conf.c - src/pacman/po/Makevars - src/pacman/po/meson.build View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/bae9594ac1806ce30f2af1… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/bae9594ac1806ce30f2af1… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Update bug report URL in tranlsation configuration files
by Allan McRae (＠allan) 18 Mar '24

18 Mar '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: b59d68a2 by Allan McRae at 2024-03-19T12:02:44+10:00 Update bug report URL in tranlsation configuration files Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 6 changed files: - lib/libalpm/po/Makevars - lib/libalpm/po/meson.build - scripts/po/Makevars - scripts/po/meson.build - src/pacman/po/Makevars - src/pacman/po/meson.build View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/b59d68a2094287df8af5e8a… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/b59d68a2094287df8af5e8a… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] makepkg: document -D in --help text
by Allan McRae (＠allan) 18 Mar '24

18 Mar '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 92102f47 by Allan McRae at 2024-03-19T01:47:42+00:00 makepkg: document -D in --help text Fixes #110. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - scripts/makepkg.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/92102f477ee9b8a93614c3b… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/92102f477ee9b8a93614c3b… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Fetch signature and database from the same URL
by Allan McRae (＠allan) 18 Mar '24

18 Mar '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: eb5bf691 by Demi Obenour at 2024-03-19T11:44:38+10:00 Fetch signature and database from the same URL Previously, the for loops on lines 1035 and 1037 would advance to the next element in the server list, even if downloading the URL succeeded. If there are no more servers in the list, `s` would be NULL, causing a NULL pointer dereference on line 1046. If there were servers left in the list, the signature would be downloaded from a wrong URL. 1. Fetching of database signatures is enabled. 2. There is only one enabled remote repository URL, or fetching from all but the last one fails and fetching from the last one succeeds. 3. An XferCommand is used. Qubes OS Arch templates satisfy all of these conditions and trigger the bug. - - - - - 1 changed file: - lib/libalpm/dload.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/eb5bf6913835e7553433ef8… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/eb5bf6913835e7553433ef8… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Fix read-after-free issue parsing config files
by Allan McRae (＠allan) 18 Mar '24

18 Mar '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 478af5d1 by Allan McRae at 2024-03-19T00:40:09+00:00 Fix read-after-free issue parsing config files We were indirectly adjusting a pointer to a parameter that was declared as a const. This resulted in a use-after-free when using --debug: [11:09:18] debug: config: finished parsing ��A�8_ Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - src/pacman/conf.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/478af5d1c869f16e7e72bb4… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/478af5d1c869f16e7e72bb4… You're receiving this email because of your account on gitlab.archlinux.org.

1 0