- Pacman-dev - lists.archlinux.org

[Git][pacman/pacman][master] set bash env variables before running scripts
by Allan McRae (＠allan) 16 Oct '22

16 Oct '22

Allan McRae pushed to branch master at Pacman / Pacman Commits: da68447e by Andrew Gregory at 2022-10-15T10:40:59-07:00 set bash env variables before running scripts Bash sources user configuration files under a number of conditions that can cause issues with scripts when bash is used as the scriptlet shell. Bash assumes it's being run under rsh/ssh if stdin is connected to a socket and sources the user bashrc unless the environment variable $SHLVL is >= 2. Commit 6a4c6a02de9b45abe4c0f78c4f5d14d92d3359d6 switched from pipes to sockets when communicating with child processes to work around SIGPIPE issues. Normally $SHLVL would be inherited from the shell running pacman, but operations involving scriptlets are generally run with sudo which does not let the $SHLVL variable through unless specifically configured to. Similarly $BASH_ENV can cause bash to source user-specified configuration files if set. https://lists.gnu.org/archive/html/help-bash/2022-02/msg00082.html Note: the list discussion and bash source all reference SHLVL >= 2, this is the SHLVL value *after* bash has incremented it on startup. Setting it to 1 in pacman is sufficient to disable the unwanted behavior. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> - - - - - 1 changed file: - lib/libalpm/util.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/da68447ec6325f3ee0c87db… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/da68447ec6325f3ee0c87db… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Fix missing if
by Allan McRae (＠allan) 09 Oct '22

09 Oct '22

Allan McRae pushed to branch master at Pacman / Pacman Commits: 86981383 by Allan McRae at 2022-10-09T13:43:31+10:00 Fix missing if Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - scripts/libmakepkg/tidy/strip.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/86981383a2f4380bda26311… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/86981383a2f4380bda26311… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] strip: Include `.o` files in strip operation
by Allan McRae (＠allan) 09 Oct '22

09 Oct '22

Allan McRae pushed to branch master at Pacman / Pacman Commits: de118245 by Frederik Schwan at 2022-10-09T11:01:12+10:00 strip: Include `.o` files in strip operation `.o` objects used to be omitted by strip.sh due to a missing match in the `Relocatable file` section. This patch fixes the issue by handling `.o` objects similar to kernel modules. fixes FS#74941 Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - scripts/libmakepkg/tidy/strip.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/de11824527ec4e2561e161a… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/de11824527ec4e2561e161a… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] strip: fix unique source paths
by Allan McRae (＠allan) 09 Oct '22

09 Oct '22

Allan McRae pushed to branch master at Pacman / Pacman Commits: 478af273 by Morten Linderud at 2022-10-09T10:57:26+10:00 strip: fix unique source paths `${pkgbase}` was added to the wrong invocation. This ensures we are producing correct debug packages. Example from the package: /usr/src/debug/pacman/pacman-6.0.2/src/pacman/callback.c /usr/src/debug/pacman/pacman-6.0.2/src/pacman/callback.h /usr/src/debug/pacman/pacman-6.0.2/src/pacman/check.c /usr/src/debug/pacman/pacman-6.0.2/src/pacman/check.h Fixes: 776b7c1e75f2 ("debugflags: Ensure we have unique source paths") Signed-off-by: Morten Linderud <morten(a)linderud.pw> Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - scripts/libmakepkg/tidy/strip.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/478af273dfe24ded197ec54… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/478af273dfe24ded197ec54… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Always create directories outputted from debugedit in debug packages
by Allan McRae (＠allan) 09 Oct '22

09 Oct '22

Allan McRae pushed to branch master at Pacman / Pacman Commits: efd0c24c by Allan McRae at 2022-10-08T21:07:45+10:00 Always create directories outputted from debugedit in debug packages The debugedit call to list all source files may include things like build/<...>. We have been filtering out these <> files, but they can point to the build directory which is important to be available for relative source paths stored in the .debug files. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - scripts/libmakepkg/tidy/strip.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/efd0c24c07b86be014a4edb… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/efd0c24c07b86be014a4edb… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

Fixes for building on macOS
by daniel.nachun＠gmail.com 09 Oct '22

09 Oct '22

1 0

[PATCH] Always create directories outputted from debugedit in debug packages
by Allan McRae 09 Oct '22

09 Oct '22

The debugedit call to list all source files may include things like build/<...>. We have been filtering out these <> files, but they can point to the build directory which is important to be available for relative source paths stored in the .debug files. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- scripts/libmakepkg/tidy/strip.sh.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/libmakepkg/tidy/strip.sh.in b/scripts/libmakepkg/tidy/strip.sh.in index 91c66f13..17526a34 100644 --- a/scripts/libmakepkg/tidy/strip.sh.in +++ b/scripts/libmakepkg/tidy/strip.sh.in @@ -72,8 +72,8 @@ strip_file() { while IFS= read -r t; do file="${srcdir}/${t}" dest="${dbgsrc}/${t}" - if [[ -f "$file" ]] && ! [[ -f $dest ]]; then - mkdir -p "${dest%/*}" + mkdir -p "${dest%/*}" + [[ -f "$file" ]]; then cp -- "$file" "$dest" fi done < <(source_files "$binary") -- 2.37.3

1 0

[PATCH] strip: fix unique source paths
by Morten Linderud 06 Oct '22

06 Oct '22

From: Morten Linderud <morten(a)linderud.pw> `${pkgbase}` was added to the wrong invocation. This ensures we are producing correct debug packages. Example from the package: /usr/src/debug/pacman/pacman-6.0.2/src/pacman/callback.c /usr/src/debug/pacman/pacman-6.0.2/src/pacman/callback.h /usr/src/debug/pacman/pacman-6.0.2/src/pacman/check.c /usr/src/debug/pacman/pacman-6.0.2/src/pacman/check.h Fixes: 776b7c1e75f2 ("debugflags: Ensure we have unique source paths") Signed-off-by: Morten Linderud <morten(a)linderud.pw> --- scripts/libmakepkg/tidy/strip.sh.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/libmakepkg/tidy/strip.sh.in b/scripts/libmakepkg/tidy/strip.sh.in index 91c66f13..01af6e03 100644 --- a/scripts/libmakepkg/tidy/strip.sh.in +++ b/scripts/libmakepkg/tidy/strip.sh.in @@ -47,7 +47,7 @@ source_files() { LANG=C debugedit --no-recompute-build-id \ --base-dir "${srcdir}" \ - --dest-dir "${dbgsrcdir}/${pkgbase}" \ + --dest-dir "${dbgsrcdir}" \ --list-file /dev/stdout "$1" \ | sort -zu | tr '\0' '\n' } @@ -141,7 +141,7 @@ tidy_strip() { if check_option "debug" "y"; then dbgdir="$pkgdirbase/$pkgbase-@DEBUGSUFFIX@/usr/lib/debug" - dbgsrcdir="${DBGSRCDIR:-/usr/src/debug}" + dbgsrcdir="${DBGSRCDIR:-/usr/src/debug}/${pkgbase}" dbgsrc="$pkgdirbase/$pkgbase-@DEBUGSUFFIX@$dbgsrcdir" mkdir -p "$dbgdir" "$dbgsrc" fi -- 2.38.0

1 0

[PATCH] strip: Include `.o` files in strip operation
by Frederik Schwan 05 Oct '22

05 Oct '22

`.o` objects used to be omitted by strip.sh due to a missing match in the `Relocatable file` section. This patch fixes the issue by handling `.o` objects similar to kernel modules. fixes FS#74941 --- scripts/libmakepkg/tidy/strip.sh.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/libmakepkg/tidy/strip.sh.in b/scripts/libmakepkg/tidy/strip.sh.in index 688bcf1b..71fe8e88 100644 --- a/scripts/libmakepkg/tidy/strip.sh.in +++ b/scripts/libmakepkg/tidy/strip.sh.in @@ -155,7 +155,7 @@ tidy_strip() { if ar t "$binary" &>/dev/null; then # Libraries (.a) strip_flags="$STRIP_STATIC" STRIPLTO=1 - elif [[ $binary = *'.ko' ]]; then # Kernel module + elif [[ $binary = *'.ko' || $binary = *'.o' ]]; then # Kernel module or object strip_flags="$STRIP_SHARED" else continue -- 2.36.1

1 1

[Git][pacman/pacman] Pushed new tag v6.0.2
by Allan McRae (＠allan) 03 Oct '22

03 Oct '22

Allan McRae pushed new tag v6.0.2 at Pacman / Pacman -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/tree/v6.0.2 You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][release/6.0.x] 2 commits: Remove move translations with mismatching arguments
by Allan McRae (＠allan) 03 Oct '22

03 Oct '22

Allan McRae pushed to branch release/6.0.x at Pacman / Pacman Commits: 8c61170c by Allan McRae at 2022-10-03T12:49:34+10:00 Remove move translations with mismatching arguments Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - c2d4568d by Allan McRae at 2022-10-03T12:52:04+10:00 Release v6.0.2 Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 17 changed files: - doc/index.asciidoc - meson.build - scripts/po/de.po - scripts/po/el.po - scripts/po/eo.po - scripts/po/es.po - scripts/po/es_419.po - scripts/po/hi.po - scripts/po/pl.po - scripts/po/ru.po - scripts/po/sl.po - scripts/po/zh_TW.po - src/pacman/po/az_AZ.po - src/pacman/po/es_419.po - src/pacman/po/hi.po - src/pacman/po/sl.po - src/pacman/po/tr.po View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/69eae8644576c63b20200a… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/69eae8644576c63b20200a… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

pacman-6.0.2 release in 24 hours
by Allan McRae 02 Oct '22

02 Oct '22

Hi all, I have pulled a bunch of patches to the release branch. Mostly to do with improved WKD support and better debug packages, but also a couple of fixes that fix what are probably low risk security issues. Note, these changes add debugedit as a dependency for makepkg. Normally I would avoid such a change in a minor release, but debug packages are rather bad without this change... I will do the final release in 24 hours. Let me know if there are any more patches that should be included. Allan

1 0

[Git][pacman/pacman][release/6.0.x] 2 commits: libmakepkg: fix compatibility with bash-5.2 globskipdots
by Allan McRae (＠allan) 02 Oct '22

02 Oct '22

Allan McRae pushed to branch release/6.0.x at Pacman / Pacman Commits: 5c10680f by Allan McRae at 2022-10-02T11:45:43+10:00 libmakepkg: fix compatibility with bash-5.2 globskipdots Bash 5.2 has a new globskipdots option, which is enabled by default. The check_dotfiles lint fails with globskipdots due to the assumption that at least the "." and ".." paths will match. Disabling globskipdots would be the usual solution, but that fails on bash<5.2. Instead, enable nullglob for this check. Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit a6b06a5b17e19db8700597ee06bae42b2cfe7b5a) - - - - - 69eae864 by Allan McRae at 2022-10-02T11:54:34+10:00 Update NEWS for pacman-6.0.2 release Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 2 changed files: - NEWS - scripts/libmakepkg/lint_package/dotfiles.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/1daabff0fb9948fb260ce3… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/1daabff0fb9948fb260ce3… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[PATCH] Update NEWS for pacman-6.0.2 release
by Allan McRae 02 Oct '22

02 Oct '22

Signed-off-by: Allan McRae <allan(a)archlinux.org> --- NEWS | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/NEWS b/NEWS index b01bf8bc..58088c32 100644 --- a/NEWS +++ b/NEWS @@ -1,5 +1,19 @@ VERSION DESCRIPTION ----------------------------------------------------------------------------- +6.0.2 - Fix potential content injection during PGP import (FS#73703) + - Fix potential segfault during PGP key import (FS#73534) + - Fix potential information leak while parsing badly formed + download header (FS#73704) + - Translation fixes to avoid segfault (FS#75680) + - makepkg: + - Fix compatability with bash 5.2 (FS#76035) + - Fix behaviour while attempting stripping of readonly files + (FS#74486) + - Use debugedit instead of awk for identifying source files + for debug packages + - Use -ffile-prefix-map instead of -fdebug-prefix-map to + capture all source files in debug packages + - Add -flto to LDFLAGS for clang 6.0.1 - Prevent download error pages ending up in package files (FS#71083) - Give -U downloads a random .part file name if needed -- 2.37.3

1 0

[Git][pacman/pacman][master] libmakepkg: fix compatibility with bash-5.2 globskipdots
by Allan McRae (＠allan) 02 Oct '22

02 Oct '22

Allan McRae pushed to branch master at Pacman / Pacman Commits: a6b06a5b by Allan McRae at 2022-10-02T11:40:52+10:00 libmakepkg: fix compatibility with bash-5.2 globskipdots Bash 5.2 has a new globskipdots option, which is enabled by default. The check_dotfiles lint fails with globskipdots due to the assumption that at least the "." and ".." paths will match. Disabling globskipdots would be the usual solution, but that fails on bash<5.2. Instead, enable nullglob for this check. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - scripts/libmakepkg/lint_package/dotfiles.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/a6b06a5b17e19db8700597e… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/a6b06a5b17e19db8700597e… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[PATCH] libmakepkg: fix compatibility with bash-5.2 globskipdots
by Allan McRae 02 Oct '22

02 Oct '22

Bash 5.2 has a new globskipdots option, which is enabled by default. The check_dotfiles lint fails with globskipdots due to the assumption that at least the "." and ".." paths will match. Disabling globskipdots would be the usual solution, but that fails on bash<5.2. Instead, enable nullglob for this check. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- scripts/libmakepkg/lint_package/dotfiles.sh.in | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/scripts/libmakepkg/lint_package/dotfiles.sh.in b/scripts/libmakepkg/lint_package/dotfiles.sh.in index 243fb31c..0b993dd4 100644 --- a/scripts/libmakepkg/lint_package/dotfiles.sh.in +++ b/scripts/libmakepkg/lint_package/dotfiles.sh.in @@ -29,10 +29,17 @@ lint_package_functions+=('check_dotfiles') check_dotfiles() { local ret=0 + + local shellopts=$(shopt -p nullglob) + shopt -s nullglob + for f in "$pkgdir"/.*; do [[ ${f##*/} == . || ${f##*/} == .. ]] && continue error "$(gettext "Dotfile found in package root '%s'")" "$f" ret=1 done + + eval "$shellopts" + return $ret } -- 2.37.3

1 0

[Git][pacman/pacman][release/6.0.x] 20 commits: remove YouCompleteMe config
by Allan McRae (＠allan) 02 Oct '22

02 Oct '22

Allan McRae pushed to branch release/6.0.x at Pacman / Pacman Commits: ec0bf17c by Andrew Gregory at 2022-10-02T11:14:00+10:00 remove YouCompleteMe config Added, seemingly by accident, with meson in 51db84750ece4de58923d4ce43cb0638ef150f5f Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> (cherry picked from commit 529e208f39a02f5e8347f8e97b4748ef4b69b004) - - - - - e56c7a3f by Carlo Teubner at 2022-10-02T11:14:31+10:00 "pacman -Q --changelog": fix writing uninit'd mem Previously, when printing a package changelog to stdout, we would write chunks of data that were not necessarily nul-terminated to stdout using a function (fputs) which requires the input string to be nul-terminated. On my system, this would result in occasional garbage characters showing up in the "pacman -Qc" output. Fix this by never nul-terminating the chunk, and using the fwrite() function which takes an explicit input size and does not require a nul-terminated string. Signed-off-by: Carlo Teubner <carlo(a)cteubner.net> (cherry picked from commit 806ccd90ede19a69a013206641e5c6e330950d07) - - - - - 53289acd by morganamilo at 2022-10-02T11:14:59+10:00 alpm: fix wrong access() being used When removing files we check _alpm_access() to see if we can write (delete) the file. If not, we check if the file exists because if the file does not exist then we don't actually need to remove it so there's no issue. However the second call uses acess() instead of _alpm_access() which does not the rootdir into account. (cherry picked from commit 5287cc7251759d619382d702161dae79fa121ded) - - - - - 0352053e by Allan McRae at 2022-10-02T11:15:37+10:00 LTO: Add -flto to LDFLAGS for clang GCC automatically detects when it is linking LTO objects, but clang does not. Add -flto to LDFLAGS to make this work for clang too. Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit 26ee6ff6adbcd8560ec3a65cf219d2ab98edb804) - - - - - ff91a9d4 by morganamilo at 2022-10-02T11:16:22+10:00 alpm: return -1 for error in find_dl_candidates This is the error value generally used and the calling function explicitly checks for -1, later causing the error to be missed and the transaction to continue. > pacman -S xterm warning: xterm-369-1 is up to date -- reinstalling resolving dependencies... looking for conflicting packages... Package (1) Old Version New Version Net Change Download Size extra/xterm 369-1 369-1 0.00 MiB 0.42 MiB Total Download Size: 0.42 MiB Total Installed Size: 1.05 MiB Net Upgrade Size: 0.00 MiB :: Proceed with installation? [Y/n] error: no servers configured for repository: extra (1/1) checking keys in keyring [--------------------------------------------------------] 100% (1/1) checking package integrity [--------------------------------------------------------] 100% error: failed to commit transaction (wrong or NULL argument passed) Errors occurred, no packages were upgraded. (cherry picked from commit 58c81fa2139a1e928f2a0e673c76f9d6ea684a1b) - - - - - 95ef9899 by Xiretza at 2022-10-02T11:16:56+10:00 makepkg: use -ffile-prefix-map instead of -fdebug-prefix-map >From gcc(1): -ffile-prefix-map=old=new [...] Specifying this option is equivalent to specifying all the individual -f*-prefix-map options. This can be used to make reproducible builds that are location independent. Specifically, this additionally enables -fmacro-prefix-map=, which causes prefix mapping to be applied to expansions of __FILE__ and similar macros.. Without this option, if source files are compiled by passing the absolute file path to the compiler (as done by e.g. cmake), any expansions of __FILE__ (e.g. from uses of assert()) will contain $srcdir. Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit e37f7d8b6b4d2f9accf97eb96d0eacbddf2a1345) - - - - - 6c880acb by Morten Linderud at 2022-10-02T11:18:33+10:00 makepkg: Use pkgbase in pkgdesc for debug packages When trying to identify debug packages among other packages we discovered that it's pkgname used in pkgdesc. Since pkgname can sometimes be an array when building debug packages for a split package, this could potentially include a pkgname that might not make sense depending on the order of the array. This patch simply uses pkgbase as it seems more correct. Signed-off-by: Morten Linderud <morten(a)linderud.pw> Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit 2fe1ba5d817d1e51188de1b63fcd61e7d7ad173a) - - - - - 23e337ba by Allan McRae at 2022-10-02T11:19:09+10:00 libmakepkg: add extra buildflags only when buildflags is not disabled This means options=('!buildflags') will disable the addition of CFLAG etc for LTO and debug building. Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit 42fe4864a0c8e2846007ffee532fe0cf4b321cdd) - - - - - c4a21f33 by Morten Linderud at 2022-10-02T11:19:25+10:00 strip: Use debugedit instead of AWK to parse source files This moves us from the fairly ugly AWK parsing line to debugedit which originally comes out of the rpm project. The original code has issues parsing anything that was not straight C/C++ and languages like Rust or Go would return invalid source code files. debugedit handles all these cases better. Fixes FS#66755 Fixes FS#66888 Fixes FS#65677 Signed-off-by: Morten Linderud <morten(a)linderud.pw> Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit ae2f506ddfd11d9becda7216033fe1b159536982) - - - - - 51354b7d by Evangelos Foutras at 2022-10-02T11:20:32+10:00 Make link time optimization flags configurable We want to use -flto=auto in Arch Linux to speed up building, but we can't hardcode it in buildenv/lto.sh because other downstreams might have clang < 13.0.0 which did not recognize -flto=auto as equivalent to -flto=full. Introducing an LTOFLAGS variable to makepkg.conf seems the way to go. Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit e1ce2351f5c00dd90104e0f4ce3bf176da28af08) - - - - - c974d6d2 by Allan McRae at 2022-10-02T11:23:51+10:00 Ensure WKD key lookup returns the correct key Looking up a key using WKD just ensures you have a key with the same email address, it does not ensure that a key with the correct fingerprint has been downloaded. Check a key with the relevant fingerprint is available after a WKD import. (cherry picked from commit e1246baddd14ec6f4b6270b59bea0e1b639472a7) - - - - - 2c83cd08 by Allan McRae at 2022-10-02T11:23:51+10:00 Fix segfault when failing to import keys Avoid a segfault when a search of the keyserver returns that the key is found but returns no primary IDs. We are then likely going to fail the import, but attempt anyway because no-one know what a keyserver will do! Fixes FS#73534. Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit 6b37d9943183f662cbd9be9031e5e7ba6fd6bea1) - - - - - b187daef by Allan McRae at 2022-10-02T11:23:51+10:00 Do not use WKD to import keys for package installs from a file In order to use WKD in pacman -U/--upgrade operations, we need to get the packager information from the .PKGINFO within the package. That has obvious security implications. e.g. something like this could convince a user to download a different key to what they expect: packager = foo bar <>^[[2K^[[0G:: Import PGP key DEADBEEF, "foo <bar> While downloading an untrusted key has little impact due to the web-of-trust model used by pacman, this could be bad in combination with an exploit that allowed trust of keys in the keyring to be altered. To be safe, do not use WKD when installing using -U. Fixes FS#73703. Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit 632eb9739d23181996cc3f4fb069b81eb0e998c7) - - - - - 3bad9848 by Allan McRae at 2022-10-02T11:23:51+10:00 Avoid information leakage with badly formed download header Parsing of Content-Disposition relies on well formed headers. A malformed header such as: Content-Disposition=""; will result in a strnduppayload->content_disp_name, -1, ptr), which will copy memory until it hits a \0. Prevent this by only copying the value if it exists. Fixes FS#73704. Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit 40583ebe892018587ef354993dee15cff9c808d6) - - - - - a1837fa5 by Jonas Witschel at 2022-10-02T11:23:51+10:00 makepkg: use bsdtar --no-read-sparse for archive creation if available bsdtar uses the "pax" TAR archive format by default, which has support for storing sparse file information in the archive. Unfortunately this is a source of unreproducibility because the sparse encoding is taken from the file system and different file systems handle sparse files differently: some file systems have no support for sparsely encoded files at all, and even file systems with sparse file support can report different file information for identical files due to differing implementations. As a real world example where this happens, consider the Arch Linux package "brotli-testdata 1.0.9-7", which contains a sparsely encoded all-zeros file "usr/share/brotli/testdata/zeros". Building this package on a btrfs file system yields a different package than building it on tmpfs or ext4 solely due to different sparse file information that gets recorded in the package tarball. To improve the reproducibility of archives containing sparsely encoded files, libarchive version 3.6.0 introduces a new --no-read-sparse option. This skips reading sparse file information from disk entirely and therefore stores files "expanded" in the archive, which is the only way to make them reliably reproducible across file systems. makepkg will use this option if libarchive is recent enough to support it, which is detected at build time. Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit f5f9e0f4ea30503657944b5c34690bd36069b07e) - - - - - ce40629b by Allan McRae at 2022-10-02T11:24:15+10:00 libmakepkg: Do not "strip" files when the format is not recognised We use a multi step process during stripping to ensure permissions do not get changed. However, if the initial objcopy fails, the subsequent cat results in a blank file. Abandon early if objcopy fails. Fixes FS#74486 Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit 18152a211aeee07e655c2cc4438c25e558e3b8aa) - - - - - d55924db by Morten Linderud at 2022-10-02T11:24:47+10:00 debugflags: Ensure we have unique source paths In some cases packages are built outside of a directory which contains pkgname-pkgver, this results in source listing in debug packages having a conflicting path like `/usr/src/debug/build/` which is not ideal. This patch ensures we always include the pkgbase to ensure the paths are unique. Signed-off-by: Morten Linderud <morten(a)linderud.pw> Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit 776b7c1e75f24b9cab86b797c1acf549c7da2c46) - - - - - 4b21c60e by Allan McRae at 2022-10-02T11:25:22+10:00 Correctly handle failure in getting build or install dates alpm_pkg_get_builddate() and alpm_pkg_get_installdate() both return -1 on error. Correctly handle the error condition in pacman. Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit 7bcc2d9b233dea3d7ed3824cc33d635d024d0784) - - - - - 958475a7 by Kristian Klausen at 2022-10-02T11:26:04+10:00 pacman-key: Don't check gpg's trustdb after each key revocation The trustdb is marked as dirty when a key is revoked[1] and GPG will recheck it the next time. Checking the trustdb can take 300-500ms which with 52 revoked keys (and counting) adds up. This is very noticeable when initializing and populating pacman's keyring like archiso is doing[2]. It is also unnecessary as the trustdb is always checked as the last step when populating the keyring. [1] https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=g10/keyedit.c… [2] https://gitlab.archlinux.org/archlinux/archiso/-/issues/191 (cherry picked from commit 673ce1ab10a652948f4f62bbbe8d12c5f4932cb0) - - - - - 1daabff0 by Allan McRae at 2022-10-02T11:26:26+10:00 Gitlab CI: Install glibc-debug valgrind test Currently our gitlab CI is failing due to valgrind breakage. With Arch stripping glibc, valgrind now requires debuginfod to be active. However the gitlab CI system combined without our testsuite does not retrieve these symbols, even when the appropriate environmental variable is set. Work around this by installing the glibc-debug package directly using a slight kludge... All blame for this approach is assigned to foutrelis! Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit d1e95c4e540283ff5d2a108459582ce2fa05c6ff) - - - - - 20 changed files: - .gitlab-ci.yml - − .ycm_extra_conf.py - build-aux/edit-script.sh.in - doc/makepkg.conf.5.asciidoc - etc/makepkg.conf.in - lib/libalpm/be_package.c - lib/libalpm/dload.c - lib/libalpm/remove.c - lib/libalpm/signing.c - lib/libalpm/sync.c - meson.build - scripts/libmakepkg/buildenv/buildflags.sh.in - scripts/libmakepkg/buildenv/debugflags.sh.in - scripts/libmakepkg/buildenv/lto.sh.in - + scripts/libmakepkg/executable/debugedit.sh.in - scripts/libmakepkg/lint_config/variable.sh.in - scripts/libmakepkg/tidy/strip.sh.in - scripts/makepkg.sh.in - scripts/pacman-key.sh.in - src/pacman/package.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/77420fe5001e0fdde9e68d… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/77420fe5001e0fdde9e68d… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[PATCH] pacman: Add space before percent sign in download progress string.
by severoraz＠gmail.com 28 Sep '22

28 Sep '22

From: Severo Raz <severoraz(a)gmail.com> Also add explanatory comment and reduce use of magic numbers. Signed-off-by: Severo Raz <severoraz(a)gmail.com> --- src/pacman/callback.c | 32 ++++++++++++++++++++------------ 1 file changed, 20 insertions(+), 12 deletions(-) diff --git a/src/pacman/callback.c b/src/pacman/callback.c index aa6303bf..c48b887d 100644 --- a/src/pacman/callback.c +++ b/src/pacman/callback.c @@ -152,19 +152,28 @@ static int64_t get_update_timediff(int first_call) /* refactored from cb_trans_progress */ static void fill_progress(const int percent, const int proglen) { - /* 8 = 1 space + 1 [ + 1 ] + 5 for percent */ - const int hashlen = proglen > 8 ? proglen - 8 : 0; - const int hash = percent * hashlen / 100; - int i; + /* + * Format: + * " [###---] NNN %" + * where NNN is the space-padded percentage. + * + * thrshlen = strlen(" [] 100 %") = 9 + * perclen = strlen(" 100 %") = 6 + */ + const int threshlen = 9; + const int perclen = 6; + const int pbarlen = (proglen > threshlen) ? (proglen - threshlen) : 0; + + if(pbarlen > 0) { + const int remlen = (100 - percent) * pbarlen / 100; - if(hashlen > 0) { fputs(" [", stdout); - for(i = hashlen; i > 0; --i) { + for(int i = pbarlen; i > 0; --i) { /* if special progress bar enabled */ if(config->chomp) { - if(i > hashlen - hash) { + if(i > remlen) { putchar('-'); - } else if(i == hashlen - hash) { + } else if(i == remlen) { if(percent % 2 == 0) { fputs("\033[1;33mC\033[m", stdout); } else { @@ -176,7 +185,7 @@ static void fill_progress(const int percent, const int proglen) fputs("\033[0;37m \033[m", stdout); } } /* else regular progress bar */ - else if(i > hashlen - hash) { + else if(i > remlen) { putchar('#'); } else { putchar('-'); @@ -185,9 +194,8 @@ static void fill_progress(const int percent, const int proglen) putchar(']'); } /* print display percent after progress bar */ - /* 5 = 1 space + 3 digits + 1 % */ - if(proglen >= 5) { - printf(" %3d%%", percent); + if(proglen >= perclen) { + printf(" %3d %%", percent); } putchar('\r'); -- 2.37.3

4 5

[Git][pacman/pacman][master] 2 commits: Update Transifex config
by Allan McRae (＠allan) 26 Sep '22

26 Sep '22

Allan McRae pushed to branch master at Pacman / Pacman Commits: e10751a1 by Allan McRae at 2022-09-26T20:53:48+10:00 Update Transifex config Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 546433b4 by Allan McRae at 2022-09-26T21:10:54+10:00 Update Transifex client usage instructions Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 2 changed files: - .tx/config - RELEASE View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/673ce1ab10a652948f4f62… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/673ce1ab10a652948f4f62… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][release/6.0.x] 2 commits: Update Transifex config
by Allan McRae (＠allan) 26 Sep '22

26 Sep '22

Allan McRae pushed to branch release/6.0.x at Pacman / Pacman Commits: 6b1a8365 by Allan McRae at 2022-09-26T20:54:21+10:00 Update Transifex config Signed-off-by: Allan McRae <allan(a)archlinux.org> (cherry picked from commit e10751a1e05f19644bb444248bac2cfda3ddaf6a) - - - - - 77420fe5 by Allan McRae at 2022-09-26T21:09:49+10:00 Final update of 6.0.x translations from Transifex Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 30 changed files: - .tx/config - lib/libalpm/po/ar.po - lib/libalpm/po/ast.po - lib/libalpm/po/az_AZ.po - lib/libalpm/po/bg.po - lib/libalpm/po/br.po - lib/libalpm/po/ca.po - lib/libalpm/po/cs.po - lib/libalpm/po/da.po - lib/libalpm/po/de.po - lib/libalpm/po/el.po - lib/libalpm/po/en_GB.po - lib/libalpm/po/eo.po - lib/libalpm/po/es.po - lib/libalpm/po/es_419.po - lib/libalpm/po/eu.po - lib/libalpm/po/eu_ES.po - lib/libalpm/po/fi.po - lib/libalpm/po/fr.po - lib/libalpm/po/gl.po - lib/libalpm/po/hi.po - lib/libalpm/po/hr.po - lib/libalpm/po/hu.po - lib/libalpm/po/id.po - lib/libalpm/po/it.po - lib/libalpm/po/ja.po - lib/libalpm/po/kk.po - lib/libalpm/po/ko.po - lib/libalpm/po/libalpm.pot - lib/libalpm/po/lt.po View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/0a6fecd07271a54d9009ea… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/0a6fecd07271a54d9009ea… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] 2 commits: makepkg.8: add missing fullstop
by Allan McRae (＠allan) 26 Sep '22

26 Sep '22

Allan McRae pushed to branch master at Pacman / Pacman Commits: 53dd3e84 by Allan McRae at 2022-09-07T23:14:12+10:00 makepkg.8: add missing fullstop Fixes FS#75838 Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 673ce1ab by Kristian Klausen at 2022-09-26T20:22:11+10:00 pacman-key: Don't check gpg's trustdb after each key revocation The trustdb is marked as dirty when a key is revoked[1] and GPG will recheck it the next time. Checking the trustdb can take 300-500ms which with 52 revoked keys (and counting) adds up. This is very noticeable when initializing and populating pacman's keyring like archiso is doing[2]. It is also unnecessary as the trustdb is always checked as the last step when populating the keyring. [1] https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=g10/keyedit.c… [2] https://gitlab.archlinux.org/archlinux/archiso/-/issues/191 - - - - - 2 changed files: - doc/makepkg.8.asciidoc - scripts/pacman-key.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/656abdb256b65da13f82fb… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/656abdb256b65da13f82fb… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[PATCH] makepkg.8: add missing fullstop
by Allan McRae 07 Sep '22

07 Sep '22

Fixes FS#75838 Signed-off-by: Allan McRae <allan(a)archlinux.org> --- doc/makepkg.8.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/makepkg.8.asciidoc b/doc/makepkg.8.asciidoc index d023b038..a86c33f0 100644 --- a/doc/makepkg.8.asciidoc +++ b/doc/makepkg.8.asciidoc @@ -75,7 +75,7 @@ Options For each source file in the source array of PKGBUILD, download the file if required and generate integrity checks. The integrity checks generated are determined by the checks present in the PKGBUILD, falling back to the - value of the INTEGRITY_CHECK array in makepkg.conf(5) if these are absent + value of the INTEGRITY_CHECK array in makepkg.conf(5) if these are absent. This output can be redirected into your PKGBUILD for source validation using "`makepkg -g >> PKGBUILD`". -- 2.37.2

1 0

[Git][pacman/pacman][master] 3 commits: libmakepkg: Fix git clone command
by Allan McRae (＠allan) 30 Aug '22

30 Aug '22

Allan McRae pushed to branch master at Pacman / Pacman Commits: 184f5931 by soloturn at 2022-08-02T13:07:09+10:00 libmakepkg: Fix git clone command Commit e017a5975cfe3e53670848bd45c982524d6745af introduced the GITFLAGS environmental variable. While ensuring the default of "--mirror" was kept, there was a capitalisation mistake made. Handle the default for GITFLAGS directly in the git clone command. - - - - - 064e556c by Ben Westover at 2022-08-02T23:04:22+10:00 doc: Fix grammar in pacman.8.asciidoc Signed-off-by: Ben Westover <kwestover.kw(a)gmail.com> - - - - - 656abdb2 by Ben Westover at 2022-08-04T22:29:27+10:00 doc: Create documentation for pacman-db-upgrade and testpkg There are two "binaries" that are currently missing documentation, pacman-db-upgrade and testpkg. This patch adds that documentation. Signed-off-by: Ben Westover <kwestover.kw(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 5 changed files: - doc/meson.build - + doc/pacman-db-upgrade.8.asciidoc - doc/pacman.8.asciidoc - + doc/testpkg.8.asciidoc - scripts/libmakepkg/source/git.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/e017a5975cfe3e53670848… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/e017a5975cfe3e53670848… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[PATCH 1/2] Diff color version strings
by David Gustavsson 18 Aug '22

18 Aug '22

In package table, with VerbosePkgLists and Color, color the part of package version strings that changes. Signed-off-by: David Gustavsson <david.e.gustavsson(a)gmail.com> --- src/pacman/conf.c | 4 ++++ src/pacman/conf.h | 2 ++ src/pacman/util.c | 35 +++++++++++++++++++++++++++++++---- src/pacman/util.h | 1 + 4 files changed, 38 insertions(+), 4 deletions(-) diff --git a/src/pacman/conf.c b/src/pacman/conf.c index f9edf75b..d5c598b9 100644 --- a/src/pacman/conf.c +++ b/src/pacman/conf.c @@ -80,6 +80,8 @@ void enable_colors(int colors) colstr->err = BOLDRED; colstr->faint = GREY46; colstr->nocolor = NOCOLOR; + colstr->diffrem = RED; + colstr->diffadd = GREEN; } else { colstr->colon = ":: "; colstr->title = ""; @@ -91,6 +93,8 @@ void enable_colors(int colors) colstr->err = ""; colstr->faint = ""; colstr->nocolor = ""; + colstr->diffrem = ""; + colstr->diffadd = ""; } } diff --git a/src/pacman/conf.h b/src/pacman/conf.h index f7916ca9..782b5758 100644 --- a/src/pacman/conf.h +++ b/src/pacman/conf.h @@ -33,6 +33,8 @@ typedef struct __colstr_t { const char *err; const char *faint; const char *nocolor; + const char *diffrem; + const char *diffadd; } colstr_t; typedef struct __config_repo_t { diff --git a/src/pacman/util.c b/src/pacman/util.c index 53833d6f..10d7c573 100644 --- a/src/pacman/util.c +++ b/src/pacman/util.c @@ -840,8 +840,10 @@ static alpm_list_t *create_verbose_row(pm_target_t *target) { char *str; off_t size = 0; + size_t i = 0; double human_size; const char *label; + const char *version; alpm_list_t *ret = NULL; /* a row consists of the package name, */ @@ -858,12 +860,28 @@ static alpm_list_t *create_verbose_row(pm_target_t *target) add_table_cell(&ret, str, CELL_NORMAL | CELL_FREE); /* old and new versions */ - pm_asprintf(&str, "%s", - target->remove != NULL ? alpm_pkg_get_version(target->remove) : ""); + version = alpm_pkg_get_version(target->remove); + char old_version[strlen(version) + strlen(config->colstr.diffrem) + strlen(config->colstr.nocolor) + 1]; + memcpy(old_version, (char *)version, strlen(version) + 1); + version = alpm_pkg_get_version(target->install); + char new_version[strlen(version) + strlen(config->colstr.diffadd) + strlen(config->colstr.nocolor) + 1]; + memcpy(new_version, (char *)version, strlen(version) + 1); + + i = 0; + while (old_version[i] != '\0' && new_version[i] != '\0' && old_version[i] == new_version[i]) { + i++; + } + insertstring(old_version, config->colstr.diffrem, i); + insertstring(new_version, config->colstr.diffadd, i); + snprintf(old_version + i + strlen(old_version + i), + strlen(config->colstr.nocolor) + 1, "%s", config->colstr.nocolor); + snprintf(new_version + i + strlen(new_version + i), + strlen(config->colstr.nocolor) + 1, "%s", config->colstr.nocolor); + + pm_asprintf(&str, "%s", old_version); add_table_cell(&ret, str, CELL_NORMAL | CELL_FREE); - pm_asprintf(&str, "%s", - target->install != NULL ? alpm_pkg_get_version(target->install) : ""); + pm_asprintf(&str, "%s", new_version); add_table_cell(&ret, str, CELL_NORMAL | CELL_FREE); /* and size */ @@ -1859,3 +1877,12 @@ void console_erase_line(void) { printf("\x1B[K"); } + +/* inserts string insert into string at index i, modifying string */ +void insertstring(char *string, const char *insert, size_t i) +{ + char temp[strlen(string) - i + 1]; + memcpy(temp, string + i, strlen(string + i) + 1); + memcpy(string + i, insert, strlen(insert) + 1); + memcpy(string + i + strlen(insert), temp, strlen(temp) + 1); +} diff --git a/src/pacman/util.h b/src/pacman/util.h index 52e79915..003961eb 100644 --- a/src/pacman/util.h +++ b/src/pacman/util.h @@ -88,6 +88,7 @@ void console_cursor_move_down(unsigned int lines); void console_cursor_move_end(void); /* Erases line from the current cursor position till the end of the line */ void console_erase_line(void); +void insertstring(char *string, const char *insert, size_t i); int pm_printf(alpm_loglevel_t level, const char *format, ...) __attribute__((format(printf,2,3))); int pm_asprintf(char **string, const char *format, ...) __attribute__((format(printf,2,3))); -- 2.35.1

2 3

[PATCH] doc: Create documentation for pacman-db-upgrade and testpkg
by Ben Westover 03 Aug '22

03 Aug '22

There are two "binaries" that are currently missing documentation, pacman-db-upgrade and testpkg. This patch adds that documentation. Signed-off-by: Ben Westover <kwestover.kw(a)gmail.com> --- doc/meson.build | 2 ++ doc/pacman-db-upgrade.8.asciidoc | 39 ++++++++++++++++++++++++++++++++ doc/testpkg.8.asciidoc | 21 +++++++++++++++++ 3 files changed, 62 insertions(+) create mode 100644 doc/pacman-db-upgrade.8.asciidoc create mode 100644 doc/testpkg.8.asciidoc diff --git a/doc/meson.build b/doc/meson.build index 06df92c9..a18e7f3f 100644 --- a/doc/meson.build +++ b/doc/meson.build @@ -5,7 +5,9 @@ manpages = [ { 'name': 'makepkg-template.1' }, { 'name': 'repo-add.8' }, { 'name': 'vercmp.8' }, + { 'name': 'testpkg.8' }, { 'name': 'pacman-key.8' }, + { 'name': 'pacman-db-upgrade.8' }, { 'name': 'PKGBUILD.5', 'extra_depends' : [ 'PKGBUILD-example.txt' ] }, { 'name': 'makepkg.conf.5' }, { 'name': 'pacman.conf.5' }, diff --git a/doc/pacman-db-upgrade.8.asciidoc b/doc/pacman-db-upgrade.8.asciidoc new file mode 100644 index 00000000..d984179b --- /dev/null +++ b/doc/pacman-db-upgrade.8.asciidoc @@ -0,0 +1,39 @@ +pacman-db-upgrade(8) +==================== + +Name +---- +pacman-db-upgrade - upgrade the local pacman database to a newer format + +Synopsis +-------- +'pacman-db-upgrade' [options] + +Description +----------- +'pacman-db-upgrade' is a script that upgrades the local database used +by linkman:pacman[8] to a newer format. + +Common Options +-------------- +*-h, \--help*:: +Show the built-in help message and exit. +*-V, \--version*:: +Show version information and exit. +*\--nocolor*:: +Remove color from output. + +pacman-db-upgrade Options +------------------------- +*-d, \--dbpath* <path>:: +Set an alternate database location. +*\--config* <path>:: +Set an alternate configuration file. +*-r, \--root* <path>:: +Sset an alternate installation root. + +See Also +-------- +linkman:pacman[8] + +include::footer.asciidoc[] diff --git a/doc/testpkg.8.asciidoc b/doc/testpkg.8.asciidoc new file mode 100644 index 00000000..6401a9be --- /dev/null +++ b/doc/testpkg.8.asciidoc @@ -0,0 +1,21 @@ +testpkg(8) +========== + +Name +---- +testpkg - test a pacman package for validity + +Synopsis +-------- +'testpkg' <package file> + +Description +----------- +'testpkg' is a script used to make sure packages produced by +linkman:makepkg[8] are valid. + +See Also +-------- +linkman:makepkg[8] + +include::footer.asciidoc[] -- 2.37.1

2 4