- Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH] Disable embedded signatures by default
by Anatol Pomozov 30 Aug '20

30 Aug '20

Switching from embedded to detached signatures is a big change. This feature needs to be thoroughly tested before embedded signatures will be completely removed from the database. To help with detached signatures testing we enable it by default. But in case if an user needs to go back to embedded signatures we add a config option to reenable it - "UseEmbeddedSignatures". Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- doc/pacman.conf.5.asciidoc | 4 ++++ lib/libalpm/alpm.h | 3 +++ lib/libalpm/be_sync.c | 4 +++- lib/libalpm/handle.c | 13 +++++++++++++ lib/libalpm/handle.h | 1 + src/pacman/conf.c | 4 ++++ src/pacman/conf.h | 2 ++ src/pacman/pacman-conf.c | 3 +++ 8 files changed, 33 insertions(+), 1 deletion(-) diff --git a/doc/pacman.conf.5.asciidoc b/doc/pacman.conf.5.asciidoc index 3c2f1fea..dd1d3d5e 100644 --- a/doc/pacman.conf.5.asciidoc +++ b/doc/pacman.conf.5.asciidoc @@ -214,6 +214,10 @@ Options positive integer. If this config option is not set then only one download stream is used (i.e. downloads happen sequentially). +*UseEmbeddedSignatures*:: + Enable database embedded signatures usage. If this flag is not set then + only detached signatures (*.sig files) are used. + Repository Sections ------------------- diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index 614a530c..f88428f2 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -920,6 +920,9 @@ int alpm_option_set_arch(alpm_handle_t *handle, const char *arch); int alpm_option_get_checkspace(alpm_handle_t *handle); int alpm_option_set_checkspace(alpm_handle_t *handle, int checkspace); +int alpm_option_get_embeddedsigs(alpm_handle_t *handle); +int alpm_option_set_embeddedsigs(alpm_handle_t *handle, int embeddedsigs); + const char *alpm_option_get_dbext(alpm_handle_t *handle); int alpm_option_set_dbext(alpm_handle_t *handle, const char *dbext); diff --git a/lib/libalpm/be_sync.c b/lib/libalpm/be_sync.c index 225df76d..d31f4862 100644 --- a/lib/libalpm/be_sync.c +++ b/lib/libalpm/be_sync.c @@ -602,7 +602,9 @@ static int sync_db_read(alpm_db_t *db, struct archive *archive, } else if(strcmp(line, "%SHA256SUM%") == 0) { READ_AND_STORE(pkg->sha256sum); } else if(strcmp(line, "%PGPSIG%") == 0) { - READ_AND_STORE(pkg->base64_sig); + if(db->handle->embeddedsigs) { + READ_AND_STORE(pkg->base64_sig); + } } else if(strcmp(line, "%REPLACES%") == 0) { READ_AND_SPLITDEP(pkg->replaces); } else if(strcmp(line, "%DEPENDS%") == 0) { diff --git a/lib/libalpm/handle.c b/lib/libalpm/handle.c index 1310601a..d0077cd4 100644 --- a/lib/libalpm/handle.c +++ b/lib/libalpm/handle.c @@ -294,6 +294,12 @@ int SYMEXPORT alpm_option_get_checkspace(alpm_handle_t *handle) return handle->checkspace; } +int SYMEXPORT alpm_option_get_embeddedsigs(alpm_handle_t *handle) +{ + CHECK_HANDLE(handle, return -1); + return handle->embeddedsigs; +} + const char SYMEXPORT *alpm_option_get_dbext(alpm_handle_t *handle) { CHECK_HANDLE(handle, return NULL); @@ -754,6 +760,13 @@ int SYMEXPORT alpm_option_set_checkspace(alpm_handle_t *handle, int checkspace) return 0; } +int SYMEXPORT alpm_option_set_embeddedsigs(alpm_handle_t *handle, int embeddedsigs) +{ + CHECK_HANDLE(handle, return -1); + handle->embeddedsigs = embeddedsigs; + return 0; +} + int SYMEXPORT alpm_option_set_dbext(alpm_handle_t *handle, const char *dbext) { CHECK_HANDLE(handle, return -1); diff --git a/lib/libalpm/handle.h b/lib/libalpm/handle.h index 9fef0fbf..de278d88 100644 --- a/lib/libalpm/handle.h +++ b/lib/libalpm/handle.h @@ -98,6 +98,7 @@ struct __alpm_handle_t { char *arch; /* Architecture of packages we should allow */ int usesyslog; /* Use syslog instead of logfile? */ /* TODO move to frontend */ int checkspace; /* Check disk space before installing */ + int embeddedsigs; /* Use embedded signatures instead of detached one */ char *dbext; /* Sync DB extension */ int siglevel; /* Default signature verification level */ int localfilesiglevel; /* Signature verification level for local file diff --git a/src/pacman/conf.c b/src/pacman/conf.c index 3a3ef605..6268f229 100644 --- a/src/pacman/conf.c +++ b/src/pacman/conf.c @@ -598,6 +598,9 @@ static int _parse_options(const char *key, char *value, } else if(strcmp(key, "ILoveCandy") == 0) { config->chomp = 1; pm_printf(ALPM_LOG_DEBUG, "config: chomp\n"); + } else if(strcmp(key, "UseEmbeddedSignatures") == 0) { + config->embeddedsigs = 1; + pm_printf(ALPM_LOG_DEBUG, "config: embeddedsigs\n"); } else if(strcmp(key, "VerbosePkgLists") == 0) { config->verbosepkglists = 1; pm_printf(ALPM_LOG_DEBUG, "config: verbosepkglists\n"); @@ -899,6 +902,7 @@ static int setup_libalpm(void) alpm_option_set_arch(handle, config->arch); alpm_option_set_checkspace(handle, config->checkspace); alpm_option_set_usesyslog(handle, config->usesyslog); + alpm_option_set_embeddedsigs(handle, config->embeddedsigs); alpm_option_set_ignorepkgs(handle, config->ignorepkg); alpm_option_set_ignoregroups(handle, config->ignoregrp); diff --git a/src/pacman/conf.h b/src/pacman/conf.h index b8a451ad..e1dbd1bc 100644 --- a/src/pacman/conf.h +++ b/src/pacman/conf.h @@ -111,6 +111,8 @@ typedef struct __config_t { /* conf file options */ /* I Love Candy! */ unsigned short chomp; + /* Use database embedded signatures if present */ + unsigned short embeddedsigs; /* format target pkg lists as table */ unsigned short verbosepkglists; /* When downloading, display the amount downloaded, rate, ETA, and percent diff --git a/src/pacman/pacman-conf.c b/src/pacman/pacman-conf.c index 463badf1..b96fb6b8 100644 --- a/src/pacman/pacman-conf.c +++ b/src/pacman/pacman-conf.c @@ -267,6 +267,7 @@ static void dump_config(void) show_bool("VerbosePkgLists", config->verbosepkglists); show_bool("DisableDownloadTimeout", config->disable_dl_timeout); show_bool("ILoveCandy", config->chomp); + show_bool("UseEmbeddedSignatures", config->embeddedsigs); show_bool("NoProgressBar", config->noprogressbar); show_int("ParallelDownloads", config->parallel_downloads); @@ -381,6 +382,8 @@ static int list_directives(void) show_bool("DisableDownloadTimeout", config->disable_dl_timeout); } else if(strcasecmp(i->data, "ILoveCandy") == 0) { show_bool("ILoveCandy", config->chomp); + } else if(strcasecmp(i->data, "UseEmbeddedSignatures") == 0) { + show_bool("UseEmbeddedSignatures", config->embeddedsigs); } else if(strcasecmp(i->data, "NoProgressBar") == 0) { show_bool("NoProgressBar", config->noprogressbar); -- 2.28.0

4 7

[pacman-dev] [PATCH v3] libalpm: Add support for trigger dropins
by Daan De Meyer 21 Aug '20

21 Aug '20

In some scenarios, instead of adding their own hooks, packages want to augment hooks already installed by other packages with extra triggers. Currently, this requires modifying the existing hook file which is error prone and hard to manage for package managers. A concrete example where packages would want to extend an existing hook is using systemd's kernel-install script on Arch Linux. An example pacman hook for kernel-install could be the following: ``` [Trigger] Operation = Install Operation = Upgrade Type = Path Target = usr/lib/modules/*/vmlinuz Target = usr/lib/kernel/install.d/* [Trigger] Operation = Install Operation = Upgrade Type = Package Target = systemd [Action] Description = Adding kernel and initramfs images to /boot... When = PostTransaction Exec = /etc/pacman.d/scripts/mkosi-kernel-add NeedsTargets ``` This hook would run on installation and upgrades of kernel packages and every package that installs kernel-install scripts (which includes dracut and mkinitcpio). It's also fairly generic in that it doesn't include specifics of other packages except its source package (and implicitly the install directory of kernel packages). However, both mkinitcpio and dracut use the concept of hooks that can be installed by other packages to extend their functionality. In mkinitcpio these are stored in /usr/lib/initcpio. When a package is installed that installs extra hooks for mkinitcpio, the kernel-install hook will not trigger. We can fix this by adding /usr/lib/initcpio/* to the kernel-install pacman hook but this requires either modifying the kernel-install hook when installing mkinitpcio or adding all possible directories for all possible packages that want to add triggers to the kernel-install hook in the systemd package itself. Neither of these are attractive solutions. The first one isn't because we'd have to modify the hook when installing packages, the second isn't because it would be a huge maintenance burden and doesn't include for AUR or private repository packages. Instead, this commit adds support for drop-in directories that allow extra triggers to be added in separate files. When parsing hooks, we now also look in a .d directory for extra triggers (for mkinitcpio.hook, we look in mkinitcpio.hook.d). Trigger files are required to have the .trigger extension and follow the same ini format as regular hooks files. However, only [Trigger] sections are allowed. Drop-in directories for a hook can be put in any of the existing hook search directories. The same override rules that apply for normal hooks files apply for drop-in files as well. With this feature, packages can now install extra triggers for an existing hook into the trigger dropin directory for that package. These extra triggers can be tracked by the package manager and uninstalled along with the package. Signed-off-by: Daan De Meyer <daan.j.demeyer(a)gmail.com> --- doc/alpm-hooks.5.asciidoc | 9 +- lib/libalpm/hook.c | 266 ++++++++++++++++++++++++++++++++++++-- lib/libalpm/hook.h | 2 + 3 files changed, 267 insertions(+), 10 deletions(-) diff --git a/doc/alpm-hooks.5.asciidoc b/doc/alpm-hooks.5.asciidoc index 916d43bb..caa55a79 100644 --- a/doc/alpm-hooks.5.asciidoc +++ b/doc/alpm-hooks.5.asciidoc @@ -38,6 +38,12 @@ linkman:pacman.conf[5] (the default is +{sysconfdir}/pacman.d/hooks+). The file names are required to have the suffix ".hook". Hooks are run in alphabetical order of their file name, where the ordering ignores the suffix. +Extra triggers can be added in drop-in directories in the configured hook +directories. Drop-in directories for a hook must be named after the hook with +the ".d" suffix added. For example, "dracut.hook.d" would be the drop-in +directory for "dracut.hook". Trigger files in drop-in directories are required +to have the suffix ".trigger" and can only contain '[Trigger]' sections. + TRIGGERS -------- @@ -96,7 +102,8 @@ OVERRIDING HOOKS Hooks may be overridden by placing a file with the same name in a higher priority hook directory. Hooks may be disabled by overriding them with -a symlink to '/dev/null'. +a symlink to '/dev/null'. The same logic applies to trigger files in drop-in +directories. EXAMPLES -------- diff --git a/lib/libalpm/hook.c b/lib/libalpm/hook.c index aca8707e..63cdff13 100644 --- a/lib/libalpm/hook.c +++ b/lib/libalpm/hook.c @@ -44,6 +44,7 @@ struct _alpm_trigger_t { enum _alpm_hook_op_t op; enum _alpm_trigger_type_t type; alpm_list_t *targets; + char *name; }; struct _alpm_hook_t { @@ -66,6 +67,7 @@ static void _alpm_trigger_free(struct _alpm_trigger_t *trigger) { if(trigger) { FREELIST(trigger->targets); + free(trigger->name); free(trigger); } } @@ -146,16 +148,16 @@ static int _alpm_hook_validate(alpm_handle_t *handle, return ret; } -static int _alpm_hook_parse_cb(const char *file, int line, +#define error(...) _alpm_log(handle, ALPM_LOG_ERROR, __VA_ARGS__); return 1; +#define warning(...) _alpm_log(handle, ALPM_LOG_WARNING, __VA_ARGS__); + +static int _alpm_trigger_parse_cb(const char *file, int line, const char *section, char *key, char *value, void *data) { struct _alpm_hook_cb_ctx *ctx = data; alpm_handle_t *handle = ctx->handle; struct _alpm_hook_t *hook = ctx->hook; -#define error(...) _alpm_log(handle, ALPM_LOG_ERROR, __VA_ARGS__); return 1; -#define warning(...) _alpm_log(handle, ALPM_LOG_WARNING, __VA_ARGS__); - if(!section && !key) { error(_("error while reading hook %s: %s\n"), file, strerror(errno)); } else if(!section) { @@ -166,8 +168,6 @@ static int _alpm_hook_parse_cb(const char *file, int line, struct _alpm_trigger_t *t; CALLOC(t, sizeof(struct _alpm_trigger_t), 1, return 1); hook->triggers = alpm_list_add(hook->triggers, t); - } else if(strcmp(section, "Action") == 0) { - /* no special processing required */ } else { error(_("hook %s line %d: invalid section %s\n"), file, line, section); } @@ -205,6 +205,37 @@ static int _alpm_hook_parse_cb(const char *file, int line, } else { error(_("hook %s line %d: invalid option %s\n"), file, line, key); } + } + + return 0; +} + +static int _alpm_hook_parse_cb(const char *file, int line, + const char *section, char *key, char *value, void *data) +{ + struct _alpm_hook_cb_ctx *ctx = data; + alpm_handle_t *handle = ctx->handle; + struct _alpm_hook_t *hook = ctx->hook; + + if(!section && !key) { + error(_("error while reading hook %s: %s\n"), file, strerror(errno)); + } else if(!section) { + error(_("hook %s line %d: invalid option %s\n"), file, line, key); + } else if(!key) { + /* beginning a new section */ + if(strcmp(section, "Trigger") == 0) { + if (_alpm_trigger_parse_cb(file, line, section, key, value, data) != 0) { + return 1; + } + } else if(strcmp(section, "Action") == 0) { + /* no special processing required */ + } else { + error(_("hook %s line %d: invalid section %s\n"), file, line, section); + } + } else if(strcmp(section, "Trigger") == 0) { + if (_alpm_trigger_parse_cb(file, line, section, key, value, data) != 0) { + return 1; + } } else if(strcmp(section, "Action") == 0) { if(strcmp(key, "When") == 0) { if(hook->when != 0) { @@ -249,12 +280,12 @@ static int _alpm_hook_parse_cb(const char *file, int line, } } -#undef error -#undef warning - return 0; } +#undef error +#undef warning + static int _alpm_hook_trigger_match_file(alpm_handle_t *handle, struct _alpm_hook_t *hook, struct _alpm_trigger_t *t) { @@ -466,6 +497,17 @@ static alpm_list_t *find_hook(alpm_list_t *haystack, const void *needle) return NULL; } +static alpm_list_t *find_trigger(alpm_list_t *haystack, const void *needle) { + while (haystack) { + struct _alpm_trigger_t *t = haystack->data; + if (t && t->name && strcmp(t->name, needle) == 0) { + return haystack; + } + haystack = haystack->next; + } + return NULL; +} + static ssize_t _alpm_hook_feed_targets(char *buf, ssize_t needed, alpm_list_t **pos) { size_t remaining = needed, written = 0;; @@ -529,6 +571,208 @@ static int _alpm_hook_run_hook(alpm_handle_t *handle, struct _alpm_hook_t *hook) } } +static int _alpm_hook_parse_drop_in_one(alpm_handle_t *handle, + struct _alpm_hook_t *hook, const char *dir) +{ + char path[PATH_MAX]; + size_t dirlen; + struct dirent *entry; + DIR *d; + size_t suflen = strlen(ALPM_TRIGGER_SUFFIX); + int ret = 0; + + if((dirlen = strlen(dir)) + 1 >= PATH_MAX) { + _alpm_log(handle, ALPM_LOG_ERROR, + _("could not open drop-in directory: %s: %s\n"), dir, + strerror(ENAMETOOLONG)); + return -1; + } + memcpy(path, dir, dirlen + 1); + + if(!(d = opendir(path))) { + if(errno == ENOENT) { + return 0; + } else { + _alpm_log(handle, ALPM_LOG_ERROR, + _("could not open drop-in directory: %s: %s\n"), path, + strerror(errno)); + return -1; + } + } + + while((errno = 0, entry = readdir(d))) { + struct _alpm_hook_cb_ctx ctx = { handle, hook }; + size_t name_len; + struct stat buf; + + if(strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) { + continue; + } + + if((name_len = strlen(entry->d_name)) >= PATH_MAX - dirlen - 1) { + _alpm_log(handle, ALPM_LOG_ERROR, _("could not open file: %s%s: %s\n"), + path, entry->d_name, strerror(ENAMETOOLONG)); + ret = -1; + continue; + } + + /* Make sure path ends with a '/'. */ + if (dirlen > 0 && path[dirlen - 1] != '/') { + path[dirlen++] = '/'; + } + + memcpy(path + dirlen, entry->d_name, name_len + 1); + + if(name_len < suflen + || strcmp(entry->d_name + name_len - suflen, ALPM_TRIGGER_SUFFIX) != 0) { + _alpm_log(handle, ALPM_LOG_DEBUG, "skipping non-trigger file %s\n", + path); + continue; + } + + if(find_trigger(hook->triggers, entry->d_name)) { + _alpm_log(handle, ALPM_LOG_DEBUG, + "skipping overridden trigger %s\n", path); + continue; + } + + if(stat(path, &buf) != 0) { + _alpm_log(handle, ALPM_LOG_ERROR, + _("could not stat trigger file %s: %s\n"), path, + strerror(errno)); + ret = -1; + continue; + } + + if(S_ISDIR(buf.st_mode)) { + _alpm_log(handle, ALPM_LOG_DEBUG, "skipping directory %s\n", path); + continue; + } + + _alpm_log(handle, ALPM_LOG_DEBUG, "parsing trigger file %s\n", path); + + if(parse_ini(path, _alpm_trigger_parse_cb, &ctx) != 0) { + _alpm_log(handle, ALPM_LOG_ERROR, + _("parsing trigger file %s failed\n"), path); + ret = -1; + continue; + } + + STRDUP(hook->name, entry->d_name, ret = -1); + } + if(errno != 0) { + _alpm_log(handle, ALPM_LOG_ERROR, _("could not read directory: %s: %s\n"), + dir, strerror(errno)); + ret = -1; + } + + closedir(d); + + return ret; +} + +static int _alpm_hook_parse_drop_ins(alpm_handle_t *handle, alpm_list_t *hooks) +{ + alpm_list_t *i; + size_t suflen = strlen(ALPM_DROP_IN_SUFFIX); + int ret = 0; + + for(i = alpm_list_last(handle->hookdirs); i; i = alpm_list_previous(i)) { + char path[PATH_MAX]; + size_t dirlen; + struct dirent *entry; + DIR *d; + + if((dirlen = strlen(i->data)) >= PATH_MAX) { + _alpm_log(handle, ALPM_LOG_ERROR, _("could not open file: %s: %s\n"), + (char *)i->data, strerror(ENAMETOOLONG)); + ret = -1; + continue; + } + memcpy(path, i->data, dirlen + 1); + + if(!(d = opendir(path))) { + if(errno == ENOENT) { + continue; + } else { + _alpm_log(handle, ALPM_LOG_ERROR, + _("could not open directory: %s: %s\n"), path, + strerror(errno)); + ret = -1; + continue; + } + } + + while((errno = 0, entry = readdir(d))) { + alpm_list_t *j; + struct stat buf; + size_t name_len; + + if(strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) { + continue; + } + + if((name_len = strlen(entry->d_name)) >= PATH_MAX - dirlen) { + _alpm_log(handle, ALPM_LOG_ERROR, _("could not open file: %s%s: %s\n"), + path, entry->d_name, strerror(ENAMETOOLONG)); + ret = -1; + continue; + } + memcpy(path + dirlen, entry->d_name, name_len + 1); + + if(name_len < suflen + || strcmp(entry->d_name + name_len - suflen, ALPM_DROP_IN_SUFFIX) != 0) { + _alpm_log(handle, ALPM_LOG_DEBUG, + "skipping non-drop-in directory %s\n", path); + continue; + } + + entry->d_name[name_len - 2] = '\0'; + j = find_hook(hooks, entry->d_name); + entry->d_name[name_len - 2] = '.'; + + if (!j) { + _alpm_log(handle, ALPM_LOG_DEBUG, + "skipping drop-in directory %s without a corresponding hook", + path); + continue; + } + + if(stat(path, &buf) != 0) { + _alpm_log(handle, ALPM_LOG_ERROR, + _("could not stat drop-in directory %s: %s\n"), path, + strerror(errno)); + ret = -1; + continue; + } + + if(!S_ISDIR(buf.st_mode)) { + _alpm_log(handle, ALPM_LOG_DEBUG, "skipping file %s\n", path); + continue; + } + + _alpm_log(handle, ALPM_LOG_DEBUG, "parsing drop-in directory %s\n", path); + + if (_alpm_hook_parse_drop_in_one(handle, j->data, path) != 0) { + _alpm_log(handle, ALPM_LOG_ERROR, + _("failed to read drop-in files in drop-in directory %s"), + path); + ret = -1; + continue; + } + } + if(errno != 0) { + _alpm_log(handle, ALPM_LOG_ERROR, _("could not read directory: %s: %s\n"), + (char *) i->data, strerror(errno)); + ret = -1; + } + + closedir(d); + } + + return ret; +} + int _alpm_hook_run(alpm_handle_t *handle, alpm_hook_when_t when) { alpm_event_hook_t event = { .when = when }; @@ -626,6 +870,10 @@ int _alpm_hook_run(alpm_handle_t *handle, alpm_hook_when_t when) closedir(d); } + if (_alpm_hook_parse_drop_ins(handle, hooks) != 0) { + ret = -1; + } + if(ret != 0 && when == ALPM_HOOK_PRE_TRANSACTION) { goto cleanup; } diff --git a/lib/libalpm/hook.h b/lib/libalpm/hook.h index ff5de4f2..961d3238 100644 --- a/lib/libalpm/hook.h +++ b/lib/libalpm/hook.h @@ -23,6 +23,8 @@ #include "alpm.h" #define ALPM_HOOK_SUFFIX ".hook" +#define ALPM_DROP_IN_SUFFIX ".hook.d" +#define ALPM_TRIGGER_SUFFIX ".trigger" int _alpm_hook_run(alpm_handle_t *handle, alpm_hook_when_t when); -- 2.28.0

1 0

[pacman-dev] [PATCH] libalpm: Add support for trigger dropins
by Daan De Meyer 21 Aug '20

21 Aug '20

In some scenarios, instead of adding their own hooks, packages want to augment hooks already installed by other packages with extra triggers. Currently, this requires modifying the existing hook file which is error prone and hard to manage for package managers. A concrete example where packages would want to extend an existing hook is using systemd's kernel-install script on Arch Linux. An example pacman hook for kernel-install could be the following: ``` [Trigger] Operation = Install Operation = Upgrade Type = Path Target = usr/lib/modules/*/vmlinuz Target = usr/lib/kernel/install.d/* [Trigger] Operation = Install Operation = Upgrade Type = Package Target = systemd [Action] Description = Adding kernel and initramfs images to /boot... When = PostTransaction Exec = /etc/pacman.d/scripts/mkosi-kernel-add NeedsTargets ``` This hook would run on installation and upgrades of kernel packages and every package that installs kernel-install scripts (which includes dracut and mkinitcpio). It's also fairly generic in that it doesn't include specifics of other packages except its source package (and implicitly the install directory of kernel packages). However, both mkinitcpio and dracut use the concept of hooks that can be installed by other packages to extend their functionality. In mkinitcpio these are stored in /usr/lib/initcpio. When a package is installed that installs extra hooks for mkinitcpio, the kernel-install hook will not trigger. We can fix this by adding /usr/lib/initcpio/* to the kernel-install pacman hook but this requires either modifying the kernel-install hook when installing mkinitpcio or adding all possible directories for all possible packages that want to add triggers to the kernel-install hook in the systemd package itself. Neither of these are attractive solutions. The first one isn't because we'd have to modify the hook when installing packages, the second isn't because it would be a huge maintenance burden and doesn't include for AUR or private repository packages. Instead, this commit adds support for trigger dropin directories that allow extra triggers to be added in separate files. When parsing hooks, we now also look in a .d directory for extra triggers (for mkinitcpio.hook, we look in mkinitcpio.hook.d). Trigger files are required to have the .trigger extension and follow the same ini format as regular hooks files. However, only [Trigger] sections are allowed. With this feature, packages can now install extra triggers for an existing hook into the trigger dropin directory for that package. These extra triggers can be tracked by the package manager and uninstalled along with the package. Signed-off-by: Daan De Meyer <daan.j.demeyer(a)gmail.com> --- lib/libalpm/hook.c | 149 ++++++++++++++++++++++++++++++++++++++++++--- lib/libalpm/hook.h | 1 + 2 files changed, 141 insertions(+), 9 deletions(-) diff --git a/lib/libalpm/hook.c b/lib/libalpm/hook.c index aca8707e..e3d833d2 100644 --- a/lib/libalpm/hook.c +++ b/lib/libalpm/hook.c @@ -44,6 +44,7 @@ struct _alpm_trigger_t { enum _alpm_hook_op_t op; enum _alpm_trigger_type_t type; alpm_list_t *targets; + char *name; }; struct _alpm_hook_t { @@ -66,6 +67,7 @@ static void _alpm_trigger_free(struct _alpm_trigger_t *trigger) { if(trigger) { FREELIST(trigger->targets); + free(trigger->name); free(trigger); } } @@ -146,16 +148,16 @@ static int _alpm_hook_validate(alpm_handle_t *handle, return ret; } -static int _alpm_hook_parse_cb(const char *file, int line, +#define error(...) _alpm_log(handle, ALPM_LOG_ERROR, __VA_ARGS__); return 1; +#define warning(...) _alpm_log(handle, ALPM_LOG_WARNING, __VA_ARGS__); + +static int _alpm_trigger_parse_cb(const char *file, int line, const char *section, char *key, char *value, void *data) { struct _alpm_hook_cb_ctx *ctx = data; alpm_handle_t *handle = ctx->handle; struct _alpm_hook_t *hook = ctx->hook; -#define error(...) _alpm_log(handle, ALPM_LOG_ERROR, __VA_ARGS__); return 1; -#define warning(...) _alpm_log(handle, ALPM_LOG_WARNING, __VA_ARGS__); - if(!section && !key) { error(_("error while reading hook %s: %s\n"), file, strerror(errno)); } else if(!section) { @@ -166,8 +168,6 @@ static int _alpm_hook_parse_cb(const char *file, int line, struct _alpm_trigger_t *t; CALLOC(t, sizeof(struct _alpm_trigger_t), 1, return 1); hook->triggers = alpm_list_add(hook->triggers, t); - } else if(strcmp(section, "Action") == 0) { - /* no special processing required */ } else { error(_("hook %s line %d: invalid section %s\n"), file, line, section); } @@ -205,6 +205,37 @@ static int _alpm_hook_parse_cb(const char *file, int line, } else { error(_("hook %s line %d: invalid option %s\n"), file, line, key); } + } + + return 0; +} + +static int _alpm_hook_parse_cb(const char *file, int line, + const char *section, char *key, char *value, void *data) +{ + struct _alpm_hook_cb_ctx *ctx = data; + alpm_handle_t *handle = ctx->handle; + struct _alpm_hook_t *hook = ctx->hook; + + if(!section && !key) { + error(_("error while reading hook %s: %s\n"), file, strerror(errno)); + } else if(!section) { + error(_("hook %s line %d: invalid option %s\n"), file, line, key); + } else if(!key) { + /* beginning a new section */ + if(strcmp(section, "Trigger") == 0) { + if (_alpm_trigger_parse_cb(file, line, section, key, value, data) != 0) { + return 1; + } + } else if(strcmp(section, "Action") == 0) { + /* no special processing required */ + } else { + error(_("hook %s line %d: invalid section %s\n"), file, line, section); + } + } else if(strcmp(section, "Trigger") == 0) { + if (_alpm_trigger_parse_cb(file, line, section, key, value, data) != 0) { + return 1; + } } else if(strcmp(section, "Action") == 0) { if(strcmp(key, "When") == 0) { if(hook->when != 0) { @@ -249,12 +280,12 @@ static int _alpm_hook_parse_cb(const char *file, int line, } } -#undef error -#undef warning - return 0; } +#undef error +#undef warning + static int _alpm_hook_trigger_match_file(alpm_handle_t *handle, struct _alpm_hook_t *hook, struct _alpm_trigger_t *t) { @@ -466,6 +497,17 @@ static alpm_list_t *find_hook(alpm_list_t *haystack, const void *needle) return NULL; } +static alpm_list_t *find_trigger(alpm_list_t *haystack, const void *needle) { + while (haystack) { + struct _alpm_trigger_t *t = haystack->data; + if (t && t->name && strcmp(t->name, needle) == 0) { + return haystack; + } + haystack = haystack->next; + } + return NULL; +} + static ssize_t _alpm_hook_feed_targets(char *buf, ssize_t needed, alpm_list_t **pos) { size_t remaining = needed, written = 0;; @@ -529,6 +571,87 @@ static int _alpm_hook_run_hook(alpm_handle_t *handle, struct _alpm_hook_t *hook) } } +static int _alpm_hook_parse_triggers(alpm_handle_t *handle, struct _alpm_hook_t *hook, + const char *hook_path) +{ + char path[PATH_MAX]; + size_t dirlen; + struct dirent *entry; + DIR *d; + size_t suflen = strlen(ALPM_TRIGGER_SUFFIX); + int ret = 0; + + if((dirlen = strlen(hook_path) + 3) >= PATH_MAX) { + _alpm_log(handle, ALPM_LOG_ERROR, _("could not open directory: %s%s: %s\n"), + hook_path, ".d", strerror(ENAMETOOLONG)); + return -1; + } + sprintf(path, "%s.d/", hook_path); + + if(!(d = opendir(path))) { + if(errno == ENOENT) { + return 0; + } else { + _alpm_log(handle, ALPM_LOG_ERROR, + _("could not open directory: %s: %s\n"), path, strerror(errno)); + return -1; + } + } + + while((errno = 0, entry = readdir(d))) { + struct _alpm_hook_cb_ctx ctx = { handle, hook }; + size_t name_len; + struct stat buf; + + if(strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) { + continue; + } + + if((name_len = strlen(entry->d_name)) >= PATH_MAX - dirlen) { + _alpm_log(handle, ALPM_LOG_ERROR, _("could not open file: %s%s: %s\n"), + path, entry->d_name, strerror(ENAMETOOLONG)); + ret = -1; + continue; + } + memcpy(path + dirlen, entry->d_name, name_len + 1); + + if(name_len < suflen + || strcmp(entry->d_name + name_len - suflen, ALPM_TRIGGER_SUFFIX) != 0) { + _alpm_log(handle, ALPM_LOG_DEBUG, "skipping non-trigger file %s\n", path); + continue; + } + + if(find_trigger(hook->triggers, entry->d_name)) { + _alpm_log(handle, ALPM_LOG_DEBUG, "skipping overridden trigger %s\n", path); + continue; + } + + if(stat(path, &buf) != 0) { + _alpm_log(handle, ALPM_LOG_ERROR, + _("could not stat file %s: %s\n"), path, strerror(errno)); + ret = -1; + continue; + } + + if(S_ISDIR(buf.st_mode)) { + _alpm_log(handle, ALPM_LOG_DEBUG, "skipping directory %s\n", path); + continue; + } + + if(parse_ini(path, _alpm_trigger_parse_cb, &ctx) != 0) { + _alpm_log(handle, ALPM_LOG_DEBUG, "parsing trigger file %s failed\n", path); + ret = -1; + continue; + } + + STRDUP(hook->name, entry->d_name, ret = -1); + } + + closedir(d); + + return ret; +} + int _alpm_hook_run(alpm_handle_t *handle, alpm_hook_when_t when) { alpm_event_hook_t event = { .when = when }; @@ -605,6 +728,14 @@ int _alpm_hook_run(alpm_handle_t *handle, alpm_hook_when_t when) CALLOC(ctx.hook, sizeof(struct _alpm_hook_t), 1, ret = -1; closedir(d); goto cleanup); + if (_alpm_hook_parse_triggers(handle, ctx.hook, path) != 0) { + _alpm_log(handle, ALPM_LOG_DEBUG, + "parsing trigger dropins for hook file %s failed\n", path); + _alpm_hook_free(ctx.hook); + ret = -1; + continue; + } + _alpm_log(handle, ALPM_LOG_DEBUG, "parsing hook file %s\n", path); if(parse_ini(path, _alpm_hook_parse_cb, &ctx) != 0 || _alpm_hook_validate(handle, ctx.hook, path)) { diff --git a/lib/libalpm/hook.h b/lib/libalpm/hook.h index ff5de4f2..4a3bc409 100644 --- a/lib/libalpm/hook.h +++ b/lib/libalpm/hook.h @@ -23,6 +23,7 @@ #include "alpm.h" #define ALPM_HOOK_SUFFIX ".hook" +#define ALPM_TRIGGER_SUFFIX ".trigger" int _alpm_hook_run(alpm_handle_t *handle, alpm_hook_when_t when); -- 2.28.0

1 1

[pacman-dev] Arch Conf 2020
by Allan McRae 21 Aug '20

21 Aug '20

Hi all, Anyone want to do a pacman talk for Arch Conf 2020? Potentially jointly? https://lists.archlinux.org/pipermail/arch-events/2020-August/000645.html A

1 0

[pacman-dev] Making a beta release
by Allan McRae 19 Aug '20

19 Aug '20

Hi all, With the parallel downloader implementation roughly done, I'd like to make a beta release for some wider testing. Is there anything that people particularly want to land before such a testing release? Allan

2 1

[pacman-dev] Anatol is inactive due to situation in Belarus
by Anatol Pomozov 14 Aug '20

14 Aug '20

Hello folks My name is Anatol Pomozov and I am an Arch Linux developer. I've been quiet for a couple of weeks now and will probably stay away from my Arch Linux/pacman (+bcc:pacman-dev@) duties for a bit more. Please feel free to take care of my packages if it's needed. The reason for this decision is a situation that happens in my home country. I am a belarusian. My home country, my beautiful Belarus is essentially taken hostage by a usurpator Lukashenko. He has been "ruling" the country for 26 years already. Lukashenko cancelled results of the last election (where he took ~10% of votes) and declared that he is going to stay in power for another 5 years. All his political opponents were put into a jail or hiding from him abroad. Anyone who demands fair elections is terrorized by his personal army. Many people are tortured in jail. You can see what happens in Belarus in these clips https://www.youtube.com/watch?v=XG3D6881AXY https://www.youtube.com/watch?v=-6tCGnM0xiQ https://www.youtube.com/watch?v=E0VLjQvCxcc I live abroad and I am safe now. But my parents and relatives are in Belarus and they were essentially taken hostage by the Lukashenko's government. The last few weeks were stressful for me and I want to focus on my extended family as much as possible. I understand that Arch maillist might not be the place for political statements but this is something personal and something important for me. There is no place for such violence and there is no place for dictators in Europe of the 21st century. Please support Belarusian people in their fight against the usurpator. Talk to your governor/mayor/deputy/..., ask them to contact Belarusian government to stop the violence. Talk to the press, explain to them what is going on in Belarus right now. Anything that brings peace to Belarus will be helpful. Thank you. Жыве Беларусь!

1 0

[pacman-dev] [PATCH] remove more autotools files
by Eli Schwartz 11 Aug '20

11 Aug '20

We forgot to remove m4/ in commit 454ea024383eab60295e4c4fdf2c329475887b2c and now it's tragically reminding me of autotools! Also take this opportunity to drop some symlinks in lib/libalpm/ for libcommon source files. In autotools these were built specifically for libalpm and needed to be available in that directory, but the meson setup just has libalpm depend on libcommon. So these pseudo source files aren't needed anymore. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- lib/libalpm/ini.c | 1 - lib/libalpm/ini.h | 1 - lib/libalpm/util-common.c | 1 - lib/libalpm/util-common.h | 1 - m4/.gitignore | 3 - m4/acinclude.m4 | 179 ---------------------------- m4/gpgme.m4 | 238 -------------------------------------- 7 files changed, 424 deletions(-) delete mode 120000 lib/libalpm/ini.c delete mode 120000 lib/libalpm/ini.h delete mode 120000 lib/libalpm/util-common.c delete mode 120000 lib/libalpm/util-common.h delete mode 100644 m4/.gitignore delete mode 100644 m4/acinclude.m4 delete mode 100644 m4/gpgme.m4 diff --git a/lib/libalpm/ini.c b/lib/libalpm/ini.c deleted file mode 120000 index b16d2f27..00000000 --- a/lib/libalpm/ini.c +++ /dev/null @@ -1 +0,0 @@ -../../src/common/ini.c \ No newline at end of file diff --git a/lib/libalpm/ini.h b/lib/libalpm/ini.h deleted file mode 120000 index e395fa04..00000000 --- a/lib/libalpm/ini.h +++ /dev/null @@ -1 +0,0 @@ -../../src/common/ini.h \ No newline at end of file diff --git a/lib/libalpm/util-common.c b/lib/libalpm/util-common.c deleted file mode 120000 index cf965176..00000000 --- a/lib/libalpm/util-common.c +++ /dev/null @@ -1 +0,0 @@ -../../src/common/util-common.c \ No newline at end of file diff --git a/lib/libalpm/util-common.h b/lib/libalpm/util-common.h deleted file mode 120000 index 988c2acc..00000000 --- a/lib/libalpm/util-common.h +++ /dev/null @@ -1 +0,0 @@ -../../src/common/util-common.h \ No newline at end of file diff --git a/m4/.gitignore b/m4/.gitignore deleted file mode 100644 index 4bc6b527..00000000 --- a/m4/.gitignore +++ /dev/null @@ -1,3 +0,0 @@ -*.m4 -!acinclude.m4 -!gpgme.m4 diff --git a/m4/acinclude.m4 b/m4/acinclude.m4 deleted file mode 100644 index 845c8286..00000000 --- a/m4/acinclude.m4 +++ /dev/null @@ -1,179 +0,0 @@ -dnl acinclude.m4 - configure macros used by pacman and libalpm -dnl Add some custom macros for pacman and libalpm - -dnl GCC_STACK_PROTECT_LIB -dnl adds -lssp to LIBS if it is available -dnl ssp is usually provided as part of libc, but was previously a separate lib -dnl It does not hurt to add -lssp even if libc provides SSP - in that case -dnl libssp will simply be ignored. -AC_DEFUN([GCC_STACK_PROTECT_LIB],[ - AC_CACHE_CHECK([whether libssp exists], ssp_cv_lib, - [ssp_old_libs="$LIBS" - LIBS="$LIBS -lssp" - AC_TRY_LINK(,, ssp_cv_lib=yes, ssp_cv_lib=no) - LIBS="$ssp_old_libs" - ]) - if test $ssp_cv_lib = yes; then - LIBS="$LIBS -lssp" - fi -]) - -dnl GCC_STACK_PROTECT_CC -dnl checks -fstack-protector-all with the C compiler, if it exists then updates -dnl CFLAGS and defines ENABLE_SSP_CC -AC_DEFUN([GCC_STACK_PROTECT_CC],[ - AC_LANG_ASSERT(C) - if test "X$CC" != "X"; then - AC_CACHE_CHECK([whether ${CC} accepts -fstack-protector-all], - ssp_cv_cc, - [ssp_old_cflags="$CFLAGS" - CFLAGS="$CFLAGS -fstack-protector-all" - AC_TRY_COMPILE(,, ssp_cv_cc=yes, ssp_cv_cc=no) - CFLAGS="$ssp_old_cflags" - ]) - if test $ssp_cv_cc = yes; then - CFLAGS="$CFLAGS -fstack-protector-all" - AC_DEFINE([ENABLE_SSP_CC], 1, [Define if SSP C support is enabled.]) - fi - fi -]) - -dnl GCC_STACK_CLASH_PROTECTION -dnl check -fstack-clash-protection with the C compiler, if it exists then -dnl updates CFLAGS -AC_DEFUN([GCC_STACK_CLASH_PROTECTION],[ - AC_LANG_ASSERT(C) - if test "X$CC" != "X"; then - AC_CACHE_CHECK([whether ${CC} accepts -fstack-clash-protection], - scp_cv_cc, - [scp_old_cflags="$CFLAGS" - CFLAGS="$CFLAGS -fstack-clash-protection" - AC_TRY_COMPILE(,, scp_cv_cc=yes, scp_cv_cc=no) - CFLAGS="$scp_old_cflags" - ]) - if test $scp_cv_cc = yes; then - CFLAGS="$CFLAGS -fstack-clash-protection" - fi - fi -]) - -dnl GCC_FORTIFY_SOURCE_CC -dnl checks -D_FORTIFY_SOURCE with the C compiler, if it exists then updates -dnl CPPFLAGS -AC_DEFUN([GCC_FORTIFY_SOURCE_CC],[ - AC_LANG_ASSERT(C) - if test "X$CC" != "X"; then - AC_MSG_CHECKING(for FORTIFY_SOURCE support) - fs_old_cppflags="$CPPFLAGS" - fs_old_cflags="$CFLAGS" - CPPFLAGS="$CPPFLAGS -D_FORTIFY_SOURCE=2" - CFLAGS="$CFLAGS -Werror" - AC_TRY_COMPILE([#include <features.h>], [ - int main() { - #if !(__GNUC_PREREQ (4, 1) ) - #error No FORTIFY_SOURCE support - #endif - return 0; - } - ], [ - AC_MSG_RESULT(yes) - CFLAGS="$fs_old_cflags" - ], [ - AC_MSG_RESULT(no) - CPPFLAGS="$fs_old_cppflags" - CFLAGS="$fs_old_cflags" - ]) - fi -]) - -dnl GCC_VISIBILITY_CC -dnl checks -fvisibility=internal with the C compiler, if it exists then -dnl defines ENABLE_VISIBILITY_CC in both configure script and Makefiles -AC_DEFUN([GCC_VISIBILITY_CC],[ - AC_LANG_ASSERT(C) - if test "X$CC" != "X"; then - AC_CACHE_CHECK([whether ${CC} accepts -fvisibility=internal], - visibility_cv_cc, - [visibility_old_cflags="$CFLAGS" - CFLAGS="$CFLAGS -fvisibility=internal" - AC_TRY_COMPILE(,, visibility_cv_cc=yes, visibility_cv_cc=no) - CFLAGS="$visibility_old_cflags" - ]) - if test $visibility_cv_cc = yes; then - AC_DEFINE([ENABLE_VISIBILITY_CC], 1, [Define if symbol visibility C support is enabled.]) - fi - AM_CONDITIONAL([ENABLE_VISIBILITY_CC], test "x$visibility_cv_cc" = "xyes") - fi -]) - -dnl CFLAGS_ADD(PARAMETER, VARIABLE) -dnl Adds parameter to VARIABLE if the compiler supports it. For example, -dnl CFLAGS_ADD([-Wall],[WARN_FLAGS]). -AC_DEFUN([CFLAGS_ADD], -[AS_VAR_PUSHDEF([my_cflags], [cflags_cv_warn_$1])dnl -AC_CACHE_CHECK([whether compiler handles $1], [my_cflags], [ - save_CFLAGS="$CFLAGS" - CFLAGS="${CFLAGS} -Werror=unknown-warning-option" - AC_COMPILE_IFELSE([AC_LANG_PROGRAM([])], - [], - [CFLAGS="$save_CFLAGS"]) - CFLAGS="${CFLAGS} $1" - AC_COMPILE_IFELSE([AC_LANG_PROGRAM([])], - [AS_VAR_SET([my_cflags], [yes])], - [AS_VAR_SET([my_cflags], [no])]) - CFLAGS="$save_CFLAGS" -]) -AS_VAR_PUSHDEF([new_cflags], [[$2]])dnl -AS_VAR_IF([my_cflags], [yes], [AS_VAR_APPEND([new_cflags], [" $1"])]) -AS_VAR_POPDEF([new_cflags])dnl -AS_VAR_POPDEF([my_cflags])dnl -m4_ifval([$2], [AS_LITERAL_IF([$2], [AC_SUBST([$2])], [])])dnl -]) - -dnl Checks for getmntinfo and determines whether it uses statfs or statvfs -AC_DEFUN([FS_STATS_TYPE], - [AC_CACHE_CHECK([filesystem statistics type], fs_stats_cv_type, - [AC_CHECK_FUNC(getmntinfo, - [AC_COMPILE_IFELSE( - [AC_LANG_PROGRAM([[ -# include <sys/param.h> -# include <sys/mount.h> -#if HAVE_SYS_UCRED_H -#include <sys/ucred.h> -#endif -extern int getmntinfo (struct statfs **, int); -]], - [])], - [fs_stats_cv_type="struct statfs"], - [fs_stats_cv_type="struct statvfs"])], - [AC_CHECK_FUNC(getmntent, - [fs_stats_cv_type="struct statvfs"])] - )] - ) - AC_DEFINE_UNQUOTED(FSSTATSTYPE, [$fs_stats_cv_type], - [Defined as the filesystem stats type ('statvfs' or 'statfs')]) - if test $ac_cv_func_getmntinfo = yes; then - if test "$fs_stats_cv_type" = "struct statvfs"; then - AC_DEFINE([HAVE_GETMNTINFO_STATVFS], 1, [Define if getmntinfo() uses statvfs.]) - else - AC_DEFINE([HAVE_GETMNTINFO_STATFS], 1, [Define if getmntinfo() uses statfs.]) - fi - fi -]) - -dnl Checks for PATH_MAX and defines it if not present -AC_DEFUN([PATH_MAX_DEFINED], - [AC_CACHE_CHECK([PATH_MAX defined], path_max_cv_defined, - [AC_EGREP_CPP(yes, [[ -#include <limits.h> -#if defined(PATH_MAX) -yes -#endif -]], - [path_max_cv_defined=yes], - [path_max_cv_defined=no])] - ) - if test $path_max_cv_defined = no; then - AC_DEFINE([PATH_MAX], 4096, [Define if PATH_MAX is undefined by limits.h.]) - fi -]) diff --git a/m4/gpgme.m4 b/m4/gpgme.m4 deleted file mode 100644 index fe17f21a..00000000 --- a/m4/gpgme.m4 +++ /dev/null @@ -1,238 +0,0 @@ -# gpgme.m4 - autoconf macro to detect GPGME. -# Copyright (C) 2002, 2003, 2004 g10 Code GmbH -# -# This file is free software; as a special exception the author gives -# unlimited permission to copy and/or distribute it, with or without -# modifications, as long as this notice is preserved. -# -# This file is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY, to the extent permitted by law; without even the -# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. - - -AC_DEFUN([_AM_PATH_GPGME_CONFIG], -[ AC_ARG_WITH(gpgme-prefix, - AC_HELP_STRING([--with-gpgme-prefix=PFX], - [prefix where GPGME is installed (optional)]), - gpgme_config_prefix="$withval", gpgme_config_prefix="") - if test "x$gpgme_config_prefix" != x ; then - GPGME_CONFIG="$gpgme_config_prefix/bin/gpgme-config" - fi - AC_PATH_PROG(GPGME_CONFIG, gpgme-config, no) - - if test "$GPGME_CONFIG" != "no" ; then - gpgme_version=`$GPGME_CONFIG --version` - fi - gpgme_version_major=`echo $gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$.*/\1/'` - gpgme_version_minor=`echo $gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$.*/\2/'` - gpgme_version_micro=`echo $gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$.*/\3/'` -]) - -dnl AM_PATH_GPGME([MINIMUM-VERSION, -dnl [ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND ]]]) -dnl Test for libgpgme and define GPGME_CFLAGS and GPGME_LIBS. -dnl -AC_DEFUN([AM_PATH_GPGME], -[ AC_REQUIRE([_AM_PATH_GPGME_CONFIG])dnl - tmp=ifelse([$1], ,1:0.4.2,$1) - if echo "$tmp" | grep ':' >/dev/null 2>/dev/null ; then - req_gpgme_api=`echo "$tmp" | sed 's/$.*$:$.*$/\1/'` - min_gpgme_version=`echo "$tmp" | sed 's/$.*$:$.*$/\2/'` - else - req_gpgme_api=0 - min_gpgme_version="$tmp" - fi - - AC_MSG_CHECKING(for GPGME - version >= $min_gpgme_version) - ok=no - if test "$GPGME_CONFIG" != "no" ; then - req_major=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\1/'` - req_minor=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\2/'` - req_micro=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\3/'` - if test "$gpgme_version_major" -gt "$req_major"; then - ok=yes - else - if test "$gpgme_version_major" -eq "$req_major"; then - if test "$gpgme_version_minor" -gt "$req_minor"; then - ok=yes - else - if test "$gpgme_version_minor" -eq "$req_minor"; then - if test "$gpgme_version_micro" -ge "$req_micro"; then - ok=yes - fi - fi - fi - fi - fi - fi - if test $ok = yes; then - # If we have a recent GPGME, we should also check that the - # API is compatible. - if test "$req_gpgme_api" -gt 0 ; then - tmp=`$GPGME_CONFIG --api-version 2>/dev/null || echo 0` - if test "$tmp" -gt 0 ; then - if test "$req_gpgme_api" -ne "$tmp" ; then - ok=no - fi - fi - fi - fi - if test $ok = yes; then - GPGME_CFLAGS=`$GPGME_CONFIG --cflags` - GPGME_LIBS=`$GPGME_CONFIG --libs` - AC_MSG_RESULT(yes) - ifelse([$2], , :, [$2]) - else - GPGME_CFLAGS="" - GPGME_LIBS="" - AC_MSG_RESULT(no) - ifelse([$3], , :, [$3]) - fi - AC_SUBST(GPGME_CFLAGS) - AC_SUBST(GPGME_LIBS) -]) - -dnl AM_PATH_GPGME_PTHREAD([MINIMUM-VERSION, -dnl [ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND ]]]) -dnl Test for libgpgme and define GPGME_PTHREAD_CFLAGS -dnl and GPGME_PTHREAD_LIBS. -dnl -AC_DEFUN([AM_PATH_GPGME_PTHREAD], -[ AC_REQUIRE([_AM_PATH_GPGME_CONFIG])dnl - tmp=ifelse([$1], ,1:0.4.2,$1) - if echo "$tmp" | grep ':' >/dev/null 2>/dev/null ; then - req_gpgme_api=`echo "$tmp" | sed 's/$.*$:$.*$/\1/'` - min_gpgme_version=`echo "$tmp" | sed 's/$.*$:$.*$/\2/'` - else - req_gpgme_api=0 - min_gpgme_version="$tmp" - fi - - AC_MSG_CHECKING(for GPGME pthread - version >= $min_gpgme_version) - ok=no - if test "$GPGME_CONFIG" != "no" ; then - if `$GPGME_CONFIG --thread=pthread 2> /dev/null` ; then - req_major=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\1/'` - req_minor=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\2/'` - req_micro=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\3/'` - if test "$gpgme_version_major" -gt "$req_major"; then - ok=yes - else - if test "$gpgme_version_major" -eq "$req_major"; then - if test "$gpgme_version_minor" -gt "$req_minor"; then - ok=yes - else - if test "$gpgme_version_minor" -eq "$req_minor"; then - if test "$gpgme_version_micro" -ge "$req_micro"; then - ok=yes - fi - fi - fi - fi - fi - fi - fi - if test $ok = yes; then - # If we have a recent GPGME, we should also check that the - # API is compatible. - if test "$req_gpgme_api" -gt 0 ; then - tmp=`$GPGME_CONFIG --api-version 2>/dev/null || echo 0` - if test "$tmp" -gt 0 ; then - if test "$req_gpgme_api" -ne "$tmp" ; then - ok=no - fi - fi - fi - fi - if test $ok = yes; then - GPGME_PTHREAD_CFLAGS=`$GPGME_CONFIG --thread=pthread --cflags` - GPGME_PTHREAD_LIBS=`$GPGME_CONFIG --thread=pthread --libs` - AC_MSG_RESULT(yes) - ifelse([$2], , :, [$2]) - else - GPGME_PTHREAD_CFLAGS="" - GPGME_PTHREAD_LIBS="" - AC_MSG_RESULT(no) - ifelse([$3], , :, [$3]) - fi - AC_SUBST(GPGME_PTHREAD_CFLAGS) - AC_SUBST(GPGME_PTHREAD_LIBS) -]) - - -dnl AM_PATH_GPGME_GLIB([MINIMUM-VERSION, -dnl [ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND ]]]) -dnl Test for libgpgme-glib and define GPGME_GLIB_CFLAGS and GPGME_GLIB_LIBS. -dnl -AC_DEFUN([AM_PATH_GPGME_GLIB], -[ AC_REQUIRE([_AM_PATH_GPGME_CONFIG])dnl - tmp=ifelse([$1], ,1:0.4.2,$1) - if echo "$tmp" | grep ':' >/dev/null 2>/dev/null ; then - req_gpgme_api=`echo "$tmp" | sed 's/$.*$:$.*$/\1/'` - min_gpgme_version=`echo "$tmp" | sed 's/$.*$:$.*$/\2/'` - else - req_gpgme_api=0 - min_gpgme_version="$tmp" - fi - - AC_MSG_CHECKING(for GPGME - version >= $min_gpgme_version) - ok=no - if test "$GPGME_CONFIG" != "no" ; then - req_major=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\1/'` - req_minor=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\2/'` - req_micro=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\3/'` - if test "$gpgme_version_major" -gt "$req_major"; then - ok=yes - else - if test "$gpgme_version_major" -eq "$req_major"; then - if test "$gpgme_version_minor" -gt "$req_minor"; then - ok=yes - else - if test "$gpgme_version_minor" -eq "$req_minor"; then - if test "$gpgme_version_micro" -ge "$req_micro"; then - ok=yes - fi - fi - fi - fi - fi - fi - if test $ok = yes; then - # If we have a recent GPGME, we should also check that the - # API is compatible. - if test "$req_gpgme_api" -gt 0 ; then - tmp=`$GPGME_CONFIG --api-version 2>/dev/null || echo 0` - if test "$tmp" -gt 0 ; then - if test "$req_gpgme_api" -ne "$tmp" ; then - ok=no - fi - fi - fi - fi - if test $ok = yes; then - GPGME_GLIB_CFLAGS=`$GPGME_CONFIG --glib --cflags` - GPGME_GLIB_LIBS=`$GPGME_CONFIG --glib --libs` - AC_MSG_RESULT(yes) - ifelse([$2], , :, [$2]) - else - GPGME_GLIB_CFLAGS="" - GPGME_GLIB_LIBS="" - AC_MSG_RESULT(no) - ifelse([$3], , :, [$3]) - fi - AC_SUBST(GPGME_GLIB_CFLAGS) - AC_SUBST(GPGME_GLIB_LIBS) -]) - -- 2.28.0

2 1

[pacman-dev] [PATCH] Highlight changed part of new version numbers to let users easily distiguish between major, minor, bugfix and internal updates
by Lars Øyvind Hagland 10 Aug '20

10 Aug '20

Signed-off-by: Lars Øyvind Hagland <larsoc(a)gmail.com> --- src/pacman/util.c | 55 ++++++++++++++++++++++++++++++++++++++++++----- src/pacman/util.h | 2 ++ 2 files changed, 52 insertions(+), 5 deletions(-) diff --git a/src/pacman/util.c b/src/pacman/util.c index e9187529..d3c89ecb 100644 --- a/src/pacman/util.c +++ b/src/pacman/util.c @@ -531,7 +531,12 @@ static void table_print_line(const alpm_list_t *line, short col_padding, if(cell->mode & CELL_TITLE) { printf("%s%*s%s", config->colstr.title, cell_width, str, config->colstr.nocolor); } else { - printf("%*s", cell_width, str); + // printf includes ANSI control chars in width, pad manually with actual width + if (cell_width > 0) { + printf("%*s%s", cell_width - (int)cell->len, "", str); + } else { + printf("%s%*s", str, -cell_width - (int)cell->len, ""); + } } need_padding = 1; } @@ -860,8 +865,10 @@ static alpm_list_t *create_verbose_row(pm_target_t *target) target->remove != NULL ? alpm_pkg_get_version(target->remove) : ""); add_table_cell(&ret, str, CELL_NORMAL | CELL_FREE); - pm_asprintf(&str, "%s", - target->install != NULL ? alpm_pkg_get_version(target->install) : ""); + str = version_colorize_diff( + target->install ? alpm_pkg_get_version(target->install) : "", + target->remove ? alpm_pkg_get_version(target->remove) : "", + config->colstr.title); add_table_cell(&ret, str, CELL_NORMAL | CELL_FREE); /* and size */ @@ -886,7 +893,7 @@ static alpm_list_t *create_verbose_row(pm_target_t *target) /* prepare a list of pkgs to display */ static void _display_targets(alpm_list_t *targets, int verbose) { - char *str; + char *str, *version; off_t isize = 0, rsize = 0, dlsize = 0; unsigned short cols; alpm_list_t *i, *names = NULL, *header = NULL, *rows = NULL; @@ -918,8 +925,12 @@ static void _display_targets(alpm_list_t *targets, int verbose) } if(target->install) { + version = version_colorize_diff(alpm_pkg_get_version(target->install), + target->remove ? alpm_pkg_get_version(target->remove) : "", + config->colstr.nocolor); pm_asprintf(&str, "%s%s-%s%s", alpm_pkg_get_name(target->install), config->colstr.faint, - alpm_pkg_get_version(target->install), config->colstr.nocolor); + version, config->colstr.nocolor); + free(version); } else if(isize == 0) { pm_asprintf(&str, "%s%s-%s%s", alpm_pkg_get_name(target->remove), config->colstr.faint, alpm_pkg_get_version(target->remove), config->colstr.nocolor); @@ -1676,6 +1687,40 @@ int colon_printf(const char *fmt, ...) return ret; } +/** Highlight the changed part of the version string + * + * Inserts an ANSI color tag before the first changed version part and a + * no-color tag at the end. + * + * @param version The new version string + * @param old_version The old version string + * @param color The color of the highlighted part + * @return Pointer to the new string + */ +char *version_colorize_diff(const char *version, const char *old_version, const char *color) +{ + char *ret; + char start[strlen(version)], end[strlen(version)]; + unsigned long pos = 0; + + while ((pos < strlen(version)) + && (pos < strlen(old_version)) + && (version[pos] == old_version[pos])) + pos++; + while (pos > 0 + && version[pos] != '.' + && version[pos] != '-') + pos--; + if (pos != 0) + pos++; + + strncpy(start, version, pos); + start[pos] = '\0'; // strncpy does not add delimiter + strcpy(end, &version[pos]); + pm_asprintf(&ret, "%s%s%s%s", start, color, end, config->colstr.nocolor); + return ret; +} + int pm_printf(alpm_loglevel_t level, const char *format, ...) { int ret; diff --git a/src/pacman/util.h b/src/pacman/util.h index c97048fb..7597da40 100644 --- a/src/pacman/util.h +++ b/src/pacman/util.h @@ -81,6 +81,8 @@ int yesno(const char *format, ...) __attribute__((format(printf, 1, 2))); int noyes(const char *format, ...) __attribute__((format(printf, 1, 2))); char *arg_to_string(int argc, char *argv[]); char *safe_fgets_stdin(char *s, int size); +char *version_colorize_diff(const char *version, const char *old_version, const char *color); + void console_cursor_hide(void); void console_cursor_show(void); void console_cursor_move_up(unsigned int lines); -- 2.27.0

2 1

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.2.1-113-gf53ac85f
by Allan McRae 10 Aug '20

10 Aug '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via f53ac85ff6cd2f74f8157f23a5e21650cd17f372 (commit) via 62246b9355867ab83566998303c921af6b1e38ef (commit) via 2403fc97325908043917732b32adf87a2eaff603 (commit) via 74aacf44958e1343b910b3fbdcf753393857f070 (commit) from 2a352dc059f696eeda1e18116e468994c1a38430 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f53ac85ff6cd2f74f8157f23a5e21650cd17f372 Author: Anatol Pomozov <anatol.pomozov(a)gmail.com> Date: Fri Jul 31 09:53:15 2020 -0700 Enable sha256/md5 hash verification if detached signatures are used Pacman has multiple ways to verify package content integrity: - gpg signature - sha256 - md5 These verification mechanisms overlap each other. gpg signatures already contain hash value of the package content. So if a package signature is present then pacman ignored the other 2 hash values. This worked well with signtures embedded into pacman database. Recently pacman got an ability to handle detached signatures (*.sig files located next to the package files). If pacman verifies detached signature only then one can replace pkg+sig files with some other content and pacman still processes it as a valid package. To prevent it we need to verify database<->package integrity using hash values stored in the database. This commit fixes FS#67232 The new debug output is: checking package integrity... debug: found cached pkg: /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: sha256sum: 77baf61c62c5570b3a37cf0c3b16c5d9a97dde6fedd1a3528bf0cc5f96dd5e52 debug: checking sha256sum for /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: sig data: <from .sig> debug: checking signature for /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: 1 signatures returned debug: fingerprint: B5971F2C5C10A9A08C60030F786C63F330D7CB92 Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 62246b9355867ab83566998303c921af6b1e38ef Author: Anatol Pomozov <anatol.pomozov(a)gmail.com> Date: Fri Jul 31 09:54:42 2020 -0700 Fix error during keyring checking With current master version the 'keyring checking' step produces an error: debug: returning error 6 from alpm_pkg_get_sig (../lib/libalpm/package.c: 274) : wrong or NULL argument passed The package signature is still checked later at the integrity verification step though. This commit fixes keyring checking and now the debug log looks like this: debug: found cached pkg: /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: found detached signature /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst.sig with size 566 debug: found signature key: 786C63F330D7CB92 debug: looking up key 786C63F330D7CB92 locally debug: key lookup success, key exists Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 2403fc97325908043917732b32adf87a2eaff603 Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Wed Aug 5 10:02:10 2020 -0400 repo-add: use more libmakepkg to handle common compression routines Currently the list of supported formats for an archive, is maintained in two places. And repo-add does not actually get updated. :( In the process, remove some of the logical duplication when calling bsdtar/compress_as. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 74aacf44958e1343b910b3fbdcf753393857f070 Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Wed Aug 5 10:02:09 2020 -0400 libmakepkg: extend compress.sh to also permit checking validity get_compression_command() can now be used to do upfront checks for whether a given extension is known to do something successfully. This is useful when writing tools in which an unknown compression type is a fatal error. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: lib/libalpm/be_package.c | 2 +- lib/libalpm/package.c | 4 +-- scripts/libmakepkg/util/compress.sh.in | 53 +++++++++++++++++++++++++--------- scripts/repo-add.sh.in | 32 ++++++++------------ 4 files changed, 54 insertions(+), 37 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [PATCH] Fix error during keyring checking
by Anatol Pomozov 10 Aug '20

10 Aug '20

With current master version the 'keyring checking' step produces an error: debug: returning error 6 from alpm_pkg_get_sig (../lib/libalpm/package.c: 274) : wrong or NULL argument passed The package signature is still checked later at the integrity verification step though. This commit fixes keyring checking and now the debug log looks like this: debug: found cached pkg: /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: found detached signature /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst.sig with size 566 debug: found signature key: 786C63F330D7CB92 debug: looking up key 786C63F330D7CB92 locally debug: key lookup success, key exists Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- lib/libalpm/package.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/lib/libalpm/package.c b/lib/libalpm/package.c index 0885b27b..a4356518 100644 --- a/lib/libalpm/package.c +++ b/lib/libalpm/package.c @@ -270,9 +270,7 @@ const char SYMEXPORT *alpm_pkg_get_base64_sig(alpm_pkg_t *pkg) int SYMEXPORT alpm_pkg_get_sig(alpm_pkg_t *pkg, unsigned char **sig, size_t *sig_len) { - if(pkg != NULL) { - RET_ERR(pkg->handle, ALPM_ERR_WRONG_ARGS, -1); - } + ASSERT(pkg != NULL, return -1); if(pkg->base64_sig) { int ret = alpm_decode_signature(pkg->base64_sig, sig, sig_len); -- 2.28.0

2 3

[pacman-dev] [PATCH v3 1/2] libmakepkg: extend compress.sh to also permit checking validity
by Eli Schwartz 09 Aug '20

09 Aug '20

get_compression_command() can now be used to do upfront checks for whether a given extension is known to do something successfully. This is useful when writing tools in which an unknown compression type is a fatal error. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- v3: split commit, this first part implements a function useful for checking if we have a known good compression type scripts/libmakepkg/util/compress.sh.in | 53 +++++++++++++++++++------- 1 file changed, 40 insertions(+), 13 deletions(-) diff --git a/scripts/libmakepkg/util/compress.sh.in b/scripts/libmakepkg/util/compress.sh.in index 16420beb..d35a01fa 100644 --- a/scripts/libmakepkg/util/compress.sh.in +++ b/scripts/libmakepkg/util/compress.sh.in @@ -24,6 +24,7 @@ LIBMAKEPKG_UTIL_COMPRESS_SH=1 LIBRARY=${LIBRARY:-'@libmakepkgdir@'} source "$LIBRARY/util/message.sh" +source "$LIBRARY/util/pkgbuild.sh" # Wrapper around many stream compression formats, for use in the middle of a @@ -31,20 +32,46 @@ source "$LIBRARY/util/message.sh" compress_as() { # $1: final archive filename extension for compression type detection - local ext=".tar${1##*.tar}" + local cmd ext=${1#${1%.tar*}} + + if ! get_compression_command "$ext" cmd; then + warning "$(gettext "'%s' is not a valid archive extension.")" "${ext:-${1##*/}}" + cat + else + "${cmd[@]}" + fi +} + +# Retrieve the compression command for an archive extension, or cat for .tar, +# and save it to an existing array name. If the extension cannot be found, +# clear the array and return failure. +get_compression_command() { + local extarray ext=$1 outputvar=$2 + local resolvecmd=() fallback=() case "$ext" in - *.tar.gz) ${COMPRESSGZ[@]:-gzip -c -f -n} ;; - *.tar.bz2) ${COMPRESSBZ2[@]:-bzip2 -c -f} ;; - *.tar.xz) ${COMPRESSXZ[@]:-xz -c -z -} ;; - *.tar.zst) ${COMPRESSZST[@]:-zstd -c -z -q -} ;; - *.tar.lrz) ${COMPRESSLRZ[@]:-lrzip -q} ;; - *.tar.lzo) ${COMPRESSLZO[@]:-lzop -q} ;; - *.tar.Z) ${COMPRESSZ[@]:-compress -c -f} ;; - *.tar.lz4) ${COMPRESSLZ4[@]:-lz4 -q} ;; - *.tar.lz) ${COMPRESSLZ[@]:-lzip -c -f} ;; - *.tar) cat ;; - *) warning "$(gettext "'%s' is not a valid archive extension.")" \ - "$ext"; cat ;; + *.tar.gz) fallback=(gzip -c -f -n) ;; + *.tar.bz2) fallback=(bzip2 -c -f) ;; + *.tar.xz) fallback=(xz -c -z -) ;; + *.tar.zst) fallback=(zstd -c -z -q -) ;; + *.tar.lrz) fallback=(lrzip -q) ;; + *.tar.lzo) fallback=(lzop -q) ;; + *.tar.Z) fallback=(compress -c -f) ;; + *.tar.lz4) fallback=(lz4 -q) ;; + *.tar.lz) fallback=(lzip -c -f) ;; + *.tar) fallback=(cat) ;; + # do not respect unknown COMPRESS* env vars + *) array_build "$outputvar" resolvecmd; return 1 ;; esac + + ext=${ext#*.tar.} + if [[ -n $ext ]]; then + extarray="COMPRESS${ext^^}[@]" + resolvecmd=("${!extarray}") + fi + if (( ${#resolvecmd[@]} == 0 )); then + resolvecmd=("${fallback[@]}") + fi + + array_build "$outputvar" resolvecmd } -- 2.28.0

2 2

[pacman-dev] [PATCH v2] Enable sha256/md5 hash verification if detached signatures are used
by Anatol Pomozov 31 Jul '20

31 Jul '20

Pacman has multiple ways to verify package content integrity: - gpg signature - sha256 - md5 These verification mechanisms overlap each other. gpg signatures already contain hash value of the package content. So if a package signature is present then pacman ignored the other 2 hash values. This worked well with signtures embedded into pacman database. Recently pacman got an ability to handle detached signatures (*.sig files located next to the package files). If pacman verifies detached signature only then one can replace pkg+sig files with some other content and pacman still processes it as a valid package. To prevent it we need to verify database<->package integrity using hash values stored in the database. This commit fixes FS#67232 The new debug output is: checking package integrity... debug: found cached pkg: /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: sha256sum: 77baf61c62c5570b3a37cf0c3b16c5d9a97dde6fedd1a3528bf0cc5f96dd5e52 debug: checking sha256sum for /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: sig data: <from .sig> debug: checking signature for /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: 1 signatures returned debug: fingerprint: B5971F2C5C10A9A08C60030F786C63F330D7CB92 Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- lib/libalpm/be_package.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/libalpm/be_package.c b/lib/libalpm/be_package.c index f98832f4..4dde7167 100644 --- a/lib/libalpm/be_package.c +++ b/lib/libalpm/be_package.c @@ -311,7 +311,7 @@ int _alpm_pkg_validate_internal(alpm_handle_t *handle, } } - if(syncpkg && !has_sig) { + if(syncpkg && (!has_sig || !syncpkg->base64_sig)) { if(syncpkg->md5sum && !syncpkg->sha256sum) { _alpm_log(handle, ALPM_LOG_DEBUG, "md5sum: %s\n", syncpkg->md5sum); _alpm_log(handle, ALPM_LOG_DEBUG, "checking md5sum for %s\n", pkgfile); -- 2.28.0

1 0

[pacman-dev] [PATCH] Enable sha256/md5 hash verification if detached signatures are used
by Anatol Pomozov 30 Jul '20

30 Jul '20

Pacman has multiple ways to verify package content integrity: - gpg signature - sha256 - md5 These verification mechanisms overlap each other. gpg signatures already contain hash value of the package content. So if a package signature is present then pacman ignored the other 2 hash values. This worked well with signtures embedded into pacman database. Recently pacman got an ability to handle detached signatures (*.sig files located next to the package files). If pacman verifies detached signature only then one can replace pkg+sig files with some other content and pacman still processes it as a valid package. It open doors for security attacks e.g. 'rollback attack'. To prevent it we need to verify database<->package integrity using hash values stored in the database. This commit fixes FS#67232 The new debug output is: checking package integrity... debug: found cached pkg: /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: sha256sum: 77baf61c62c5570b3a37cf0c3b16c5d9a97dde6fedd1a3528bf0cc5f96dd5e52 debug: checking sha256sum for /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: sig data: <from .sig> debug: checking signature for /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: 1 signatures returned debug: fingerprint: B5971F2C5C10A9A08C60030F786C63F330D7CB92 Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- lib/libalpm/be_package.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/libalpm/be_package.c b/lib/libalpm/be_package.c index f98832f4..4dde7167 100644 --- a/lib/libalpm/be_package.c +++ b/lib/libalpm/be_package.c @@ -311,7 +311,7 @@ int _alpm_pkg_validate_internal(alpm_handle_t *handle, } } - if(syncpkg && !has_sig) { + if(syncpkg && (!has_sig || !syncpkg->base64_sig)) { if(syncpkg->md5sum && !syncpkg->sha256sum) { _alpm_log(handle, ALPM_LOG_DEBUG, "md5sum: %s\n", syncpkg->md5sum); _alpm_log(handle, ALPM_LOG_DEBUG, "checking md5sum for %s\n", pkgfile); -- 2.28.0

1 0

[pacman-dev] [PATCH] PKGBUILD-vcs.proto: replace bzr with breezy
by Michael Straube 19 Jul '20

19 Jul '20

The bzr package was replaced with breezy a while ago. Update the PKGBUILD-vcs.proto file. Signed-off-by: Michael Straube <michael.straube(a)posteo.de> --- proto/PKGBUILD-vcs.proto | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/proto/PKGBUILD-vcs.proto b/proto/PKGBUILD-vcs.proto index ae9956a9..6a76db67 100644 --- a/proto/PKGBUILD-vcs.proto +++ b/proto/PKGBUILD-vcs.proto @@ -16,7 +16,7 @@ url="" license=('GPL') groups=() depends=() -makedepends=('VCS_PACKAGE') # 'bzr', 'git', 'mercurial' or 'subversion' +makedepends=('VCS_PACKAGE') # 'breezy', 'git', 'mercurial' or 'subversion' provides=("${pkgname%-VCS}") conflicts=("${pkgname%-VCS}") replaces=() -- 2.27.0

2 2

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.2.1-109-g2a352dc0
by Allan McRae 17 Jul '20

17 Jul '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via 2a352dc059f696eeda1e18116e468994c1a38430 (commit) via 14c0e53eed4bd0c090e7ed2ebad41335d323c86c (commit) via 1fd95939dbee071f4d7fb30e19c5b3cb22969113 (commit) via a8bdc2e10ad6c942f3f1dbbbb77c126578a41bd3 (commit) from b01bcc7d3d680856bd60c4ae03e4ba3f6d889cb2 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 2a352dc059f696eeda1e18116e468994c1a38430 Author: Morten Linderud <morten(a)linderud.pw> Date: Mon Jul 13 22:25:41 2020 +0200 doc/makepkg.8: Added punctuations. Signed-off-by: Morten Linderud <morten(a)linderud.pw> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 14c0e53eed4bd0c090e7ed2ebad41335d323c86c Author: Anatol Pomozov <anatol.pomozov(a)gmail.com> Date: Mon Jul 13 09:35:34 2020 -0700 Check that destfile_name exists before using it In some cases (when trust_remote_name is used for a URL without a filename and no Content-Disposition is provided by the server) destfile_name will be NULL. In this case payload data will be stored in tempfile_name and no destfile_name is set. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 1fd95939dbee071f4d7fb30e19c5b3cb22969113 Author: Anatol Pomozov <anatol.pomozov(a)gmail.com> Date: Mon Jul 13 09:35:21 2020 -0700 Do not free payload fields in the middle of this structure use At the end of payload use it calls _alpm_dload_payload_reset() that will free() these and other fields anyway. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit a8bdc2e10ad6c942f3f1dbbbb77c126578a41bd3 Author: Anatol Pomozov <anatol.pomozov(a)gmail.com> Date: Mon Jul 13 09:35:05 2020 -0700 Build signature remote name based on the main payload name The main payload final name might be affected by url redirects or Content-Disposition HTTP header value. We want to make sure that accompanion *.sig filename always matches the package filename. So ignore finalname/Content-Disposition for the *.sig file. It also helps to fix a corner case when the download URL does not contain a filename and server provides Content-Disposition for the main payload but not for the signature payload. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: doc/makepkg.8.asciidoc | 4 +-- lib/libalpm/dload.c | 74 +++++++++++++++++++++++++++++--------------------- 2 files changed, 45 insertions(+), 33 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [PATCH] doc/makepkg.8: Added punctuations.
by foxboron＠archlinux.org 14 Jul '20

14 Jul '20

From: Morten Linderud <morten(a)linderud.pw> Signed-off-by: Morten Linderud <morten(a)linderud.pw> --- doc/makepkg.8.asciidoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/makepkg.8.asciidoc b/doc/makepkg.8.asciidoc index 544659fc..3b5e61b3 100644 --- a/doc/makepkg.8.asciidoc +++ b/doc/makepkg.8.asciidoc @@ -274,7 +274,7 @@ Environment Variables **GPGKEY=**"keyid":: Specify a key to use when signing packages, overriding the GPGKEY setting - in linkman:makepkg.conf[5] + in linkman:makepkg.conf[5]. **SOURCE_DATE_EPOCH=**"<date>":: Used for link:https://reproducible-builds.org/docs/[Reproducible Builds]. @@ -299,7 +299,7 @@ On exit, makepkg will return one of the following error codes. Error in configuration file. 3:: - User specified an invalid option + User specified an invalid option. 4:: Error in user-supplied function in PKGBUILD. -- 2.27.0

2 1

[pacman-dev] [PATCH] Check that destfile_name exists before using it
by Anatol Pomozov 14 Jul '20

14 Jul '20

In some cases (when trust_remote_name is used for a URL without a filename and no Content-Disposition is provided by the server) destfile_name will be NULL. In this case payload data will be stored in tempfile_name and no destfile_name is set. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- lib/libalpm/dload.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index 343f5c78..673e769f 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -897,15 +897,18 @@ int SYMEXPORT alpm_fetch_pkgurl(alpm_handle_t *handle, const alpm_list_t *urls, for(i = payloads; i; i = i->next) { struct dload_payload *payload = i->data; - const char *filename; char *filepath; if(payload->signature) { continue; } - filename = mbasename(payload->destfile_name); - filepath = _alpm_filecache_find(handle, filename); + if(payload->destfile_name) { + const char *filename = mbasename(payload->destfile_name); + filepath = _alpm_filecache_find(handle, filename); + } else { + STRDUP(filepath, payload->tempfile_name, GOTO_ERR(handle, ALPM_ERR_MEMORY, err)); + } if(filepath) { alpm_list_append(fetched, filepath); } else { -- 2.27.0

2 2

[pacman-dev] [PATCH] Build signature remote name based on the main payload name
by Anatol Pomozov 14 Jul '20

14 Jul '20

The main payload final name might be affected by url redirects or Content-Disposition HTTP header value. We want to make sure that accompanion *.sig filename always matches the package filename. So ignore finalname/Content-Disposition for the *.sig file. It also helps to fix a corner case when the download URL does not contain a filename and server provides Content-Disposition for the main payload but not for the signature payload. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- lib/libalpm/dload.c | 61 +++++++++++++++++++++++++++------------------ 1 file changed, 37 insertions(+), 24 deletions(-) diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index 78808eb3..1785dd6a 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -481,6 +481,31 @@ static int curl_check_finished_download(CURLM *curlm, CURLMsg *msg, curl_easy_getinfo(curl, CURLINFO_CONDITION_UNMET, &timecond); curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &effective_url); + if(payload->trust_remote_name) { + if(payload->content_disp_name) { + /* content-disposition header has a better name for our file */ + free(payload->destfile_name); + payload->destfile_name = get_fullpath(localpath, + get_filename(payload->content_disp_name), ""); + } else { + const char *effective_filename = strrchr(effective_url, '/'); + + if(effective_filename && strlen(effective_filename) > 2) { + effective_filename++; + + /* if destfile was never set, we wrote to a tempfile. even if destfile is + * set, we may have followed some redirects and the effective url may + * have a better suggestion as to what to name our file. in either case, + * refactor destfile to this newly derived name. */ + if(!payload->destfile_name || strcmp(effective_filename, + strrchr(payload->destfile_name, '/') + 1) != 0) { + free(payload->destfile_name); + payload->destfile_name = get_fullpath(localpath, effective_filename, ""); + } + } + } + } + /* Let's check if client requested downloading accompanion *.sig file */ if(!payload->signature && payload->download_signature && curlerr == CURLE_OK && payload->respcode < 400) { struct dload_payload *sig = NULL; @@ -489,6 +514,18 @@ static int curl_check_finished_download(CURLM *curlm, CURLMsg *msg, CALLOC(sig, 1, sizeof(*sig), GOTO_ERR(handle, ALPM_ERR_MEMORY, cleanup)); MALLOC(sig->fileurl, len, FREE(sig); GOTO_ERR(handle, ALPM_ERR_MEMORY, cleanup)); snprintf(sig->fileurl, len, "%s.sig", effective_url); + + if(payload->trust_remote_name) { + /* In this case server might provide a new name for the main payload. + * Choose *.sig filename based on this new name. + */ + const char* realname = payload->destfile_name ? payload->destfile_name : payload->tempfile_name; + const char *final_file = get_filename(realname); + int remote_name_len = strlen(final_file) + 5; + MALLOC(sig->remote_name, remote_name_len, FREE(sig->fileurl); FREE(sig); GOTO_ERR(handle, ALPM_ERR_MEMORY, cleanup)); + snprintf(sig->remote_name, remote_name_len, "%s.sig", final_file); + } + sig->signature = 1; sig->handle = handle; sig->force = payload->force; @@ -520,30 +557,6 @@ static int curl_check_finished_download(CURLM *curlm, CURLMsg *msg, GOTO_ERR(handle, ALPM_ERR_RETRIEVE, cleanup); } - if(payload->trust_remote_name) { - if(payload->content_disp_name) { - /* content-disposition header has a better name for our file */ - free(payload->destfile_name); - payload->destfile_name = get_fullpath(localpath, - get_filename(payload->content_disp_name), ""); - } else { - const char *effective_filename = strrchr(effective_url, '/'); - if(effective_filename && strlen(effective_filename) > 2) { - effective_filename++; - - /* if destfile was never set, we wrote to a tempfile. even if destfile is - * set, we may have followed some redirects and the effective url may - * have a better suggestion as to what to name our file. in either case, - * refactor destfile to this newly derived name. */ - if(!payload->destfile_name || strcmp(effective_filename, - strrchr(payload->destfile_name, '/') + 1) != 0) { - free(payload->destfile_name); - payload->destfile_name = get_fullpath(localpath, effective_filename, ""); - } - } - } - } - ret = 0; cleanup: -- 2.27.0

2 1

[pacman-dev] [PATCH] Do not free payload fields in the middle of this structure use
by Anatol Pomozov 13 Jul '20

13 Jul '20

At the end of payload use it calls _alpm_dload_payload_reset() that will free() these and other fields anyway. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- lib/libalpm/dload.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index 1785dd6a..343f5c78 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -698,10 +698,6 @@ static int curl_add_payload(alpm_handle_t *handle, CURLM *curlm, return 0; cleanup: - FREE(payload->fileurl); - FREE(payload->tempfile_name); - FREE(payload->destfile_name); - FREE(payload->content_disp_name); curl_easy_cleanup(curl); return ret; } -- 2.27.0

1 0

[pacman-dev] Errors in pacman man pages
by Helge Kreutzmann 09 Jul '20

09 Jul '20

Dear pacman maintainer, the manpage-l10n project maintains a large number of translations of man pages both from a large variety of sources (including packman) as well for a large variety of target languages. During their work translators notice different possible issues in the original (english) man pages. Sometimes this is a straightforward typo, sometimes a hard to read sentence, sometimes this is a convention not held up and sometimes we simply do not understand the original. We use several distributions as sources and update regularly (at least every 2 month). This means we are fairly recent (some distributions like archlinux also update frequently) but might miss the latest upstream version once in a while, so the error might be already fixed. We apologize and ask you to close the issue immediately if this should be the case, but given the huge volume of projects and the very limited number of volunteers we are not able to double check each and every issue. Secondly we translators see the manpages in the neutral po format, i.e. converted and harmonized, but not the original source (be it man, groff, xml or other). So we cannot provide a true patch (where possible), but only an approximation which you need to convert into your source format. Finally the issues I'm reporting have accumulated over time and are not always discovered by me, so sometimes my description of the problem my be a bit limited - do not hesitate to ask so we can clarify them. I'm now reporting the errors for your project. If future reports should use another channel, please let me know. Man page: makepkg-template.1 Issue: "name" and "version" should be I<> as they are options of the program "Currently used keys are: name (mandatory) and version\\&. Template names are " "limited to alphanumerics, \"@\", \"+\", \"\\&.\", \"-\", and \"_\"\\&. " "Versions are limited to numbers and \"\\&.\"\\&." -- Man page: pacman.8 Issue: This and other options' parameters could be wrapped in 'I<' and '>' "I<pacman> E<lt>operationE<gt> [options] [targets]" -- Man page: pacman.8 Issue: Curly double quotes in some strings, others regular quotes. Uniformize. "Since version 3\\&.0\\&.0, pacman has been the front-end to B<libalpm>(3), " "the \\(lqArch Linux Package Management\\(rq library\\&. This library allows " "alternative front-ends to be written (for instance, a GUI front-end)\\&." -- Man page: pacman.8 Issue: 'Search' 'owns' 'group' 'list' 'check' = option-related words, wrap around with "I<--" and ">" (or "B<--" and ">"?) "Show less information for certain query operations\\&. This is useful when " "pacman\\(cqs output is processed in a script\\&. Search will only show " "package names and not version, group, and description information; owns will " "only show package names instead of \"file is owned by pkg\" messages; group " "will only show package names and omit group names; list will only show files " "and omit package names; check will only show pairs of package names and " "missing files; a bare query will only show package names rather than names " -- Man page: pacman.8 Issue: 'Search' 'group' 'list' = option-related words, wrap around with "I<--" and ">" "Show less information for certain sync operations\\&. This is useful when " "pacman\\(cqs output is processed in a script\\&. Search will only show " "package names and not repository, version, group, and description " "information; list will only show package names and omit databases and " "versions; group will only show package names and omit group names\\&." -- Man page: pacman.conf.5 Issue: wget → B<wget>(1) "If set, an external program will be used to download all remote files\\&. " "All instances of %u will be replaced with the download URL\\&. If present, " "instances of %o will be replaced with the local filename, plus a \\(lq\\&." "part\\(rq extension, which allows programs like wget to do file resumes " "properly\\&." "This option is useful for users who experience problems with built-in HTTP/" "FTP support, or need the more advanced proxy support that comes with " "utilities like wget\\&." -- Man page: pacman.conf.5 Issue: Incorrect markup of -U: "" → B<> "Set the signature verification level for installing packages using the \"-U" "\" operation on a local file\\&. Uses the value from SigLevel as the default" "\\&." -- Man page: pacman.conf.5 Issue: Missing markup of syslog(): syslog() → B<syslog>() "Log action messages through syslog()\\&. This will insert log entries into /" "var/log/messages or equivalent\\&." -- Man page: pacman.conf.5 Issue: Where did "%o" come from? The XferCommand command usage does not have an %o "If set, an external program will be used to download all remote files\\&. " "All instances of %u will be replaced with the download URL\\&. If present, " "instances of %o will be replaced with the local filename, plus a \\(lq\\&." "part\\(rq extension, which allows programs like wget to do file resumes " "properly\\&." -- Man page: pacman.conf.5 Issue: [options] should not be translated, wrap it with B<> "The I<SigLevel> directive is valid in both the [options] and repository " "sections\\&. If used in [options], it sets a default value for any " "repository that does not provide the setting\\&." -- Man page: pacman-conf.8 Issue: remote → repository "B<-r, --repo> E<lt>remoteE<gt>" -- Dr. Helge Kreutzmann debian(a)helgefjell.de Dipl.-Phys. http://www.helgefjell.de/debian.php 64bit GNU powered gpg signed mail preferred Help keep free software "libre": http://www.ffii.de/

2 2

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.2.1-105-gb01bcc7d
by Allan McRae 07 Jul '20

07 Jul '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via b01bcc7d3d680856bd60c4ae03e4ba3f6d889cb2 (commit) via f3dfba73d22b7eca3810a8114f2aab63da488b4c (commit) via 78d6dcec6c49bd2fa830237a46fd14337bc9fd4c (commit) via 34ba8d984d89393ab85ca67724b87af67ff004c3 (commit) via f078c2d3bcb72bafda0dce5fe2c9418ca462bb1a (commit) from 6b9c1b4d54225b4c2808b5fadc2b6e779ae1916a (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit b01bcc7d3d680856bd60c4ae03e4ba3f6d889cb2 Author: Anatol Pomozov <anatol.pomozov(a)gmail.com> Date: Tue May 26 19:12:08 2020 -0700 Fallback to detached signatures during keyring check Pacman has a 'key in keyring' verification step that makes sure the signatures have a valid keyid. Currently pacman parses embedded package signatures only. Add a fallback to detached signatures. If embedded signature is missing then it tries to read corresponding *.sig file and get keyid from there. Verification: debug: found cached pkg: /var/cache/pacman/pkg/glib-networking-2.64.3-1-x86_64.pkg.tar.zst debug: found detached signature /var/cache/pacman/pkg/glib-networking-2.64.3-1-x86_64.pkg.tar.zst.sig with size 310 debug: found signature key: A5E9288C4FA415FA debug: looking up key A5E9288C4FA415FA locally debug: key lookup success, key exists Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit f3dfba73d22b7eca3810a8114f2aab63da488b4c Author: Anatol Pomozov <anatol.pomozov(a)gmail.com> Date: Mon May 18 14:30:04 2020 -0700 FS#33992: force download *.sig file if it does not exist in the cache In case if *.pkg exists but *.sig file does not we still have to pass the pkg to multi_download API. To avoid redownloading *.pkg file we use CURLOPT_TIMECONDITION curl option. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 78d6dcec6c49bd2fa830237a46fd14337bc9fd4c Author: Anatol Pomozov <anatol.pomozov(a)gmail.com> Date: Thu Apr 23 17:28:43 2020 -0700 Add a utility function to check whether a file exists in the cache It is similar to _alpm_filecache_find() but does not return a dynamically allocated memory to user. Thus the user does not need to free this resource. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 34ba8d984d89393ab85ca67724b87af67ff004c3 Author: Anatol Pomozov <anatol.pomozov(a)gmail.com> Date: Mon May 18 14:13:11 2020 -0700 Do not use counter for error tracking Current code uses an incrementing counter to check whether a function returned error: errors += some_function(); if(errors) { goto finish } Replace with a more standard variable errors = some_function(); if(errors) { goto finish } Rename 'errors' variable to a more typical 'ret'. Avoid reporting both ALPM_EVENT_PKG_RETRIEVE_FAILED and ALPM_EVENT_PKG_RETRIEVE_DONE in the error path. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit f078c2d3bcb72bafda0dce5fe2c9418ca462bb1a Author: Anatol Pomozov <anatol.pomozov(a)gmail.com> Date: Tue May 12 15:26:38 2020 -0700 Move signature payload creation to download engine Until now callee of ALPM download functionality has been in charge of payload creation both for the main file (e.g. *.pkg) and for the accompanied *.sig file. One advantage of such solution is that all payloads are independent and can be fetched in parallel thus exploiting the maximum level of download parallelism. To build *.sig file url we've been using a simple string concatenation: $requested_url + ".sig". Unfortunately there are cases when it does not work. For example an archlinux.org "Download From Mirror" link looks like this https://www.archlinux.org/packages/core/x86_64/bash/download/ and it gets redirected to some mirror. But if we append ".sig" to the end of the link url and try to download it then archlinux.org returns 404 error. To overcome this issue we need to follow redirects for the main payload first, find the final url and only then append '.sig' suffix. This implies 2 things: - the signature payload initialization need to be moved to dload.c as it is the place where we have access to the resolved url - *.sig is downloaded serially with the main payload and this reduces level of parallelism Move *.sig payload creation to dload.c. Once the main payload is fetched successfully we check if the callee asked to download the accompanied signature. If yes - create a new payload and add it to mcurl. *.sig payload does not use server list of the main payload and thus does not support mirror failover. *.sig file comes from the same server as the main payload. Refactor event loop in curl_multi_download_internal() a bit. Instead of relying on curl_multi_check_finished_download() to return number of new payloads we simply rerun the loop iteration one more time to check if there are any active downloads left. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: lib/libalpm/alpm.h | 11 ++++++ lib/libalpm/be_sync.c | 34 ++++-------------- lib/libalpm/dload.c | 95 ++++++++++++++++++++++++++++++++------------------- lib/libalpm/dload.h | 4 ++- lib/libalpm/package.c | 40 ++++++++++++++++++++++ lib/libalpm/sync.c | 67 ++++++++++++++++++++++-------------- lib/libalpm/util.c | 51 +++++++++++++++++++++++++++ lib/libalpm/util.h | 3 ++ 8 files changed, 215 insertions(+), 90 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [PATCH] FS#33992: force download *.sig file if it does not exist in the cache
by Anatol Pomozov 29 Jun '20

29 Jun '20

In case if *.pkg exists but *.sig file does not we still have to pass the pkg to multi_download API. To avoid redownloading *.pkg file we use CURLOPT_TIMECONDITION curl option. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- lib/libalpm/dload.c | 2 +- lib/libalpm/sync.c | 31 +++++++++++++++++++++++-------- 2 files changed, 24 insertions(+), 9 deletions(-) diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index f8ee6f85..78808eb3 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -282,7 +282,7 @@ static void curl_set_handle_opts(CURL *curl, struct dload_payload *payload) curl_easy_setopt(curl, CURLOPT_USERAGENT, useragent); } - if(!payload->allow_resume && !payload->force && payload->destfile_name && + if(!payload->force && payload->destfile_name && stat(payload->destfile_name, &st) == 0) { /* start from scratch, but only download if our local is out of date. */ curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE); diff --git a/lib/libalpm/sync.c b/lib/libalpm/sync.c index ea45767a..8c01ad95 100644 --- a/lib/libalpm/sync.c +++ b/lib/libalpm/sync.c @@ -22,6 +22,7 @@ */ #include <sys/types.h> /* off_t */ +#include <stdbool.h> #include <stdlib.h> #include <stdio.h> #include <string.h> @@ -698,8 +699,9 @@ static int find_dl_candidates(alpm_handle_t *handle, alpm_list_t **files) alpm_pkg_t *spkg = i->data; if(spkg->origin != ALPM_PKG_FROM_FILE) { - char *fpath = NULL; alpm_db_t *repo = spkg->origin_data.db; + bool need_download; + int siglevel = alpm_db_get_siglevel(alpm_pkg_get_db(spkg)); if(!repo->servers) { handle->pm_errno = ALPM_ERR_SERVER_NONE; @@ -710,16 +712,26 @@ static int find_dl_candidates(alpm_handle_t *handle, alpm_list_t **files) ASSERT(spkg->filename != NULL, RET_ERR(handle, ALPM_ERR_PKG_INVALID_NAME, -1)); - if(spkg->download_size == 0) { - /* check for file in cache - allows us to handle complete .part files */ - fpath = _alpm_filecache_find(handle, spkg->filename); + need_download = spkg->download_size != 0 || !_alpm_filecache_exists(handle, spkg->filename); + /* even if the package file in the cache we need to check for + * accompanion *.sig file as well. + * If *.sig is not cached then force download the package + its signature file. + */ + if(!need_download && (siglevel & ALPM_SIG_PACKAGE)) { + char *sig_filename = NULL; + int len = strlen(spkg->filename) + 5; + + MALLOC(sig_filename, len, RET_ERR(handle, ALPM_ERR_MEMORY, -1)); + snprintf(sig_filename, len, "%s.sig", spkg->filename); + + need_download = !_alpm_filecache_exists(handle, sig_filename); + + FREE(sig_filename); } - if(spkg->download_size != 0 || !fpath) { + if(need_download) { *files = alpm_list_add(*files, spkg); } - - FREE(fpath); } } @@ -782,7 +794,8 @@ static int download_files(alpm_handle_t *handle) event.type = ALPM_EVENT_PKG_RETRIEVE_START; EVENT(handle, &event); for(i = files; i; i = i->next) { - const alpm_pkg_t *pkg = i->data; + alpm_pkg_t *pkg = i->data; + int siglevel = alpm_db_get_siglevel(alpm_pkg_get_db(pkg)); struct dload_payload *payload = NULL; CALLOC(payload, 1, sizeof(*payload), GOTO_ERR(handle, ALPM_ERR_MEMORY, finish)); @@ -794,6 +807,8 @@ static int download_files(alpm_handle_t *handle) payload->servers = pkg->origin_data.db->servers; payload->handle = handle; payload->allow_resume = 1; + payload->download_signature = (siglevel & ALPM_SIG_PACKAGE); + payload->signature_optional = (siglevel & ALPM_SIG_PACKAGE_OPTIONAL); payloads = alpm_list_add(payloads, payload); } -- 2.27.0

1 0

[pacman-dev] [PATCH] Add a utility function to check whether a file exists in the cache
by Anatol Pomozov 29 Jun '20

29 Jun '20

It is similar to _alpm_filecache_find() but does not return a dynamically allocated memory to user. Thus the user does not need to free this resource. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- lib/libalpm/util.c | 14 ++++++++++++++ lib/libalpm/util.h | 2 ++ 2 files changed, 16 insertions(+) diff --git a/lib/libalpm/util.c b/lib/libalpm/util.c index ead03004..76728eb4 100644 --- a/lib/libalpm/util.c +++ b/lib/libalpm/util.c @@ -834,6 +834,20 @@ char *_alpm_filecache_find(alpm_handle_t *handle, const char *filename) return NULL; } +/** Check whether a filename exists in a registered alpm cachedir. + * @param handle the context handle + * @param filename name of file to find + * @return 0 if the filename was not found, 1 otherwise + */ +int _alpm_filecache_exists(alpm_handle_t *handle, const char *filename) +{ + int res; + char *fpath = _alpm_filecache_find(handle, filename); + res = (fpath != NULL); + FREE(fpath); + return res; +} + /** Check the alpm cachedirs for existence and find a writable one. * If no valid cache directory can be found, use /tmp. * @param handle the context handle diff --git a/lib/libalpm/util.h b/lib/libalpm/util.h index 3306a022..4fc6e718 100644 --- a/lib/libalpm/util.h +++ b/lib/libalpm/util.h @@ -136,6 +136,8 @@ int _alpm_run_chroot(alpm_handle_t *handle, const char *cmd, char *const argv[], int _alpm_ldconfig(alpm_handle_t *handle); int _alpm_str_cmp(const void *s1, const void *s2); char *_alpm_filecache_find(alpm_handle_t *handle, const char *filename); +/* Checks whether a file exists in cache */ +int _alpm_filecache_exists(alpm_handle_t *handle, const char *filename); const char *_alpm_filecache_setup(alpm_handle_t *handle); /* Unlike many uses of alpm_pkgvalidation_t, _alpm_test_checksum expects * an enum value rather than a bitfield. */ -- 2.27.0

1 0

[pacman-dev] [PATCH] Do not use counter for error tracking
by Anatol Pomozov 26 Jun '20

26 Jun '20

Current code uses an incrementing counter to check whether a function returned error: errors += some_function(); if(errors) { goto finish } Replace with a more standard variable errors = some_function(); if(errors) { goto finish } Rename 'errors' variable to a more typical 'ret'. Avoid reporting both ALPM_EVENT_PKG_RETRIEVE_FAILED and ALPM_EVENT_PKG_RETRIEVE_DONE in the error path. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- lib/libalpm/sync.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/lib/libalpm/sync.c b/lib/libalpm/sync.c index 0c2341ae..ea45767a 100644 --- a/lib/libalpm/sync.c +++ b/lib/libalpm/sync.c @@ -730,7 +730,7 @@ static int download_files(alpm_handle_t *handle) { const char *cachedir; alpm_list_t *i, *files = NULL; - int errors = 0; + int ret = 0; alpm_event_t event; alpm_list_t *payloads = NULL; @@ -750,14 +750,16 @@ static int download_files(alpm_handle_t *handle) handle->totaldlcb(total_size); } - errors += find_dl_candidates(handle, &files); + ret = find_dl_candidates(handle, &files); + if(ret) { + goto finish; + } - if(files && !errors) { + if(files) { /* check for necessary disk space for download */ if(handle->checkspace) { off_t *file_sizes; size_t idx, num_files; - int ret; _alpm_log(handle, ALPM_LOG_DEBUG, "checking available disk space for download\n"); @@ -773,7 +775,6 @@ static int download_files(alpm_handle_t *handle) free(file_sizes); if(ret != 0) { - errors++; goto finish; } } @@ -796,12 +797,13 @@ static int download_files(alpm_handle_t *handle) payloads = alpm_list_add(payloads, payload); } - event.type = ALPM_EVENT_PKG_RETRIEVE_DONE; if(_alpm_download(handle, payloads, cachedir) == -1) { - errors++; event.type = ALPM_EVENT_PKG_RETRIEVE_FAILED; + EVENT(handle, &event); _alpm_log(handle, ALPM_LOG_WARNING, _("failed to retrieve some files\n")); + goto finish; } + event.type = ALPM_EVENT_PKG_RETRIEVE_DONE; EVENT(handle, &event); } @@ -826,7 +828,7 @@ finish: handle->totaldlcb(0); } - return errors; + return ret; } #ifdef HAVE_LIBGPGME -- 2.27.0

1 0

[pacman-dev] [PATCH v2] Move signature payload creation to download engine
by Anatol Pomozov 26 Jun '20

26 Jun '20

Until now callee of ALPM download functionality has been in charge of payload creation both for the main file (e.g. *.pkg) and for the accompanied *.sig file. One advantage of such solution is that all payloads are independent and can be fetched in parallel thus exploiting the maximum level of download parallelism. To build *.sig file url we've been using a simple string concatenation: $requested_url + ".sig". Unfortunately there are cases when it does not work. For example an archlinux.org "Download From Mirror" link looks like this https://www.archlinux.org/packages/core/x86_64/bash/download/ and it gets redirected to some mirror. But if we append ".sig" to the end of the link url and try to download it then archlinux.org returns 404 error. To overcome this issue we need to follow redirects for the main payload first, find the final url and only then append '.sig' suffix. This implies 2 things: - the signature payload initialization need to be moved to dload.c as it is the place where we have access to the resolved url - *.sig is downloaded serially with the main payload and this reduces level of parallelism Move *.sig payload creation to dload.c. Once the main payload is fetched successfully we check if the callee asked to download the accompanied signature. If yes - create a new payload and add it to mcurl. *.sig payload does not use server list of the main payload and thus does not support mirror failover. *.sig file comes from the same server as the main payload. Refactor event loop in curl_multi_download_internal() a bit. Instead of relying on curl_multi_check_finished_download() to return number of new payloads we simply rerun the loop iteration one more time to check if there are any active downloads left. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- lib/libalpm/be_sync.c | 34 +++------------- lib/libalpm/dload.c | 93 +++++++++++++++++++++++++++---------------- lib/libalpm/dload.h | 4 +- 3 files changed, 67 insertions(+), 64 deletions(-) diff --git a/lib/libalpm/be_sync.c b/lib/libalpm/be_sync.c index a0736320..225df76d 100644 --- a/lib/libalpm/be_sync.c +++ b/lib/libalpm/be_sync.c @@ -180,12 +180,10 @@ int SYMEXPORT alpm_db_update(alpm_handle_t *handle, alpm_list_t *dbs, int force) dbforce = 1; } - CALLOC(payload, 1, sizeof(*payload), GOTO_ERR(handle, ALPM_ERR_MEMORY, cleanup)); + siglevel = alpm_db_get_siglevel(db); - /* set hard upper limit of 128 MiB */ - payload->max_size = 128 * 1024 * 1024; + CALLOC(payload, 1, sizeof(*payload), GOTO_ERR(handle, ALPM_ERR_MEMORY, cleanup)); payload->servers = db->servers; - /* print server + filename into a buffer */ len = strlen(db->treename) + strlen(dbext) + 1; MALLOC(payload->filepath, len, @@ -194,31 +192,11 @@ int SYMEXPORT alpm_db_update(alpm_handle_t *handle, alpm_list_t *dbs, int force) payload->handle = handle; payload->force = dbforce; payload->unlink_on_fail = 1; - + payload->download_signature = (siglevel & ALPM_SIG_DATABASE); + payload->signature_optional = (siglevel & ALPM_SIG_DATABASE_OPTIONAL); + /* set hard upper limit of 128 MiB */ + payload->max_size = 128 * 1024 * 1024; payloads = alpm_list_add(payloads, payload); - - siglevel = alpm_db_get_siglevel(db); - if(siglevel & ALPM_SIG_DATABASE) { - struct dload_payload *sig_payload; - CALLOC(sig_payload, 1, sizeof(*sig_payload), GOTO_ERR(handle, ALPM_ERR_MEMORY, cleanup)); - sig_payload->signature = 1; - - /* print filename into a buffer (leave space for separator and .sig) */ - len = strlen(db->treename) + strlen(dbext) + 5; - MALLOC(sig_payload->filepath, len, - FREE(sig_payload); GOTO_ERR(handle, ALPM_ERR_MEMORY, cleanup)); - snprintf(sig_payload->filepath, len, "%s%s.sig", db->treename, dbext); - - sig_payload->handle = handle; - sig_payload->force = dbforce; - sig_payload->errors_ok = (siglevel & ALPM_SIG_DATABASE_OPTIONAL); - - /* set hard upper limit of 16 KiB */ - sig_payload->max_size = 16 * 1024; - sig_payload->servers = db->servers; - - payloads = alpm_list_add(payloads, sig_payload); - } } event.type = ALPM_EVENT_DB_RETRIEVE_START; diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index a91bb1ac..f8ee6f85 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -18,6 +18,7 @@ * along with this program. If not, see <http://www.gnu.org/licenses/>. */ +#include <stdbool.h> #include <stdlib.h> #include <stdio.h> #include <errno.h> @@ -49,6 +50,10 @@ #include "handle.h" #ifdef HAVE_LIBCURL + +static int curl_add_payload(alpm_handle_t *handle, CURLM *curlm, + struct dload_payload *payload, const char *localpath); + static const char *get_filename(const char *url) { char *filename = strrchr(url, '/'); @@ -476,6 +481,25 @@ static int curl_check_finished_download(CURLM *curlm, CURLMsg *msg, curl_easy_getinfo(curl, CURLINFO_CONDITION_UNMET, &timecond); curl_easy_getinfo(curl, CURLINFO_EFFECTIVE_URL, &effective_url); + /* Let's check if client requested downloading accompanion *.sig file */ + if(!payload->signature && payload->download_signature && curlerr == CURLE_OK && payload->respcode < 400) { + struct dload_payload *sig = NULL; + + int len = strlen(effective_url) + 5; + CALLOC(sig, 1, sizeof(*sig), GOTO_ERR(handle, ALPM_ERR_MEMORY, cleanup)); + MALLOC(sig->fileurl, len, FREE(sig); GOTO_ERR(handle, ALPM_ERR_MEMORY, cleanup)); + snprintf(sig->fileurl, len, "%s.sig", effective_url); + sig->signature = 1; + sig->handle = handle; + sig->force = payload->force; + sig->unlink_on_fail = payload->unlink_on_fail; + sig->errors_ok = payload->signature_optional; + /* set hard upper limit of 16KiB */ + sig->max_size = 16 * 1024; + + curl_add_payload(handle, curlm, sig, localpath); + } + /* time condition was met and we didn't download anything. we need to * clean up the 0 byte .part file that's left behind. */ if(timecond == 1 && DOUBLE_EQ(bytes_dl, 0)) { @@ -565,6 +589,13 @@ cleanup: if(ret == -1 && payload->errors_ok) { ret = -2; } + + if(payload->signature) { + /* free signature payload memory that was allocated earlier in dload.c */ + _alpm_dload_payload_reset(payload); + FREE(payload); + } + return ret; } @@ -666,17 +697,16 @@ static int curl_download_internal(alpm_handle_t *handle, alpm_list_t *payloads /* struct dload_payload */, const char *localpath) { - int still_running = 0; + int active_downloads_num = 0; + bool recheck_downloads = false; int err = 0; - int parallel_downloads = handle->parallel_downloads; - + int max_streams = handle->parallel_downloads; CURLM *curlm = handle->curlm; - CURLMsg *msg; - while(still_running || payloads) { - int msgs_left = -1; + while(active_downloads_num > 0 || payloads || recheck_downloads) { + CURLMcode mc; - for(; still_running < parallel_downloads && payloads; still_running++) { + for(; active_downloads_num < max_streams && payloads; active_downloads_num++) { struct dload_payload *payload = payloads->data; if(curl_add_payload(handle, curlm, payload, localpath) == 0) { @@ -687,15 +717,19 @@ static int curl_download_internal(alpm_handle_t *handle, payloads = payloads->next; } else { - // the payload failed to start, do not start any new downloads just wait until - // active one complete. + /* The payload failed to start. Do not start any new downloads. + * Wait until all active downloads complete. + */ _alpm_log(handle, ALPM_LOG_ERROR, _("failed to setup a download payload for %s\n"), payload->remote_name); payloads = NULL; err = -1; } } - CURLMcode mc = curl_multi_perform(curlm, &still_running); + mc = curl_multi_perform(curlm, &active_downloads_num); + if(mc == CURLM_OK) { + mc = curl_multi_wait(curlm, NULL, 0, 1000, NULL); + } if(mc != CURLM_OK) { _alpm_log(handle, ALPM_LOG_ERROR, _("curl returned error %d from transfer\n"), mc); @@ -703,7 +737,13 @@ static int curl_download_internal(alpm_handle_t *handle, err = -1; } - while((msg = curl_multi_info_read(curlm, &msgs_left))) { + recheck_downloads = false; + while(true) { + int msgs_left = 0; + CURLMsg *msg = curl_multi_info_read(curlm, &msgs_left); + if(!msg) { + break; + } if(msg->msg == CURLMSG_DONE) { int ret = curl_check_finished_download(curlm, msg, localpath); if(ret == -1) { @@ -712,19 +752,16 @@ static int curl_download_internal(alpm_handle_t *handle, */ payloads = NULL; err = -1; - } else if(ret == 2) { - /* in case of a retry increase the counter of active requests - * to avoid exiting the loop early - */ - still_running++; } + /* curl_multi_check_finished_download() might add more payloads e.g. in case of a retry + * from the next mirror. We need to execute curl_multi_perform() at least one more time + * to make sure new payload requests are processed. + */ + recheck_downloads = true; } else { _alpm_log(handle, ALPM_LOG_ERROR, _("curl transfer error: %d\n"), msg->msg); } } - if(still_running) { - curl_multi_wait(curlm, NULL, 0, 1000, NULL); - } } _alpm_log(handle, ALPM_LOG_DEBUG, "curl_download_internal return code is %d\n", err); @@ -803,13 +840,11 @@ int SYMEXPORT alpm_fetch_pkgurl(alpm_handle_t *handle, const alpm_list_t *urls, { const char *cachedir; alpm_list_t *payloads = NULL; - int download_sigs; const alpm_list_t *i; alpm_event_t event; CHECK_HANDLE(handle, return -1); ASSERT(*fetched == NULL, RET_ERR(handle, ALPM_ERR_WRONG_ARGS, -1)); - download_sigs = handle->siglevel & ALPM_SIG_PACKAGE; /* find a valid cache dir to download to */ cachedir = _alpm_filecache_setup(handle); @@ -831,21 +866,9 @@ int SYMEXPORT alpm_fetch_pkgurl(alpm_handle_t *handle, const alpm_list_t *urls, payload->allow_resume = 1; payload->handle = handle; payload->trust_remote_name = 1; + payload->download_signature = (handle->siglevel & ALPM_SIG_PACKAGE); + payload->signature_optional = (handle->siglevel & ALPM_SIG_PACKAGE_OPTIONAL); payloads = alpm_list_add(payloads, payload); - - if(download_sigs) { - int len = strlen(url) + 5; - CALLOC(payload, 1, sizeof(*payload), GOTO_ERR(handle, ALPM_ERR_MEMORY, err)); - payload->signature = 1; - MALLOC(payload->fileurl, len, FREE(payload); GOTO_ERR(handle, ALPM_ERR_MEMORY, err)); - snprintf(payload->fileurl, len, "%s.sig", url); - payload->handle = handle; - payload->trust_remote_name = 1; - payload->errors_ok = (handle->siglevel & ALPM_SIG_PACKAGE_OPTIONAL); - /* set hard upper limit of 16KiB */ - payload->max_size = 16 * 1024; - payloads = alpm_list_add(payloads, payload); - } } } diff --git a/lib/libalpm/dload.h b/lib/libalpm/dload.h index 9103c1c6..9491dd8c 100644 --- a/lib/libalpm/dload.h +++ b/lib/libalpm/dload.h @@ -47,11 +47,13 @@ struct dload_payload { int errors_ok; int unlink_on_fail; int trust_remote_name; - int signature; /* specifies if the payload is a signature file */ + int download_signature; /* specifies if an accompanion *.sig file need to be downloaded*/ + int signature_optional; /* *.sig file is optional */ #ifdef HAVE_LIBCURL CURL *curl; char error_buffer[CURL_ERROR_SIZE]; FILE *localf; /* temp download file */ + int signature; /* specifies if this payload is for a signature file */ #endif }; -- 2.27.0

1 0