- Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH 1/2] pacman: pacman-conf: removed hputs macro for usage display
by Matthew Sexton 09 Sep '19

09 Sep '19

From: Matthew Sexton <WSDMatty(a)gmail.com> Using the macro got in the way of _() macro for translation All the macro did was make it so the writer didn't have to type \n", stream); at the end of every line. --- src/pacman/pacman-conf.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/src/pacman/pacman-conf.c b/src/pacman/pacman-conf.c index df874029..d9e596b8 100644 --- a/src/pacman/pacman-conf.c +++ b/src/pacman/pacman-conf.c @@ -37,19 +37,17 @@ static void cleanup(void) static void usage(int ret) { FILE *stream = (ret ? stderr : stdout); -#define hputs(x) fputs(x"\n", stream) - hputs("pacman-conf - query pacman's configuration file"); - hputs("usage: pacman-conf [options] [<directive>...]"); - hputs(" pacman-conf (--repo-list|--help|--version)"); - hputs("options:"); - hputs(" -c, --config=<path> set an alternate configuration file"); - hputs(" -R, --rootdir=<path> set an alternate installation root"); - hputs(" -r, --repo=<remote> query options for a specific repo"); - hputs(" -v, --verbose always show directive names"); - hputs(" -l, --repo-list list configured repositories"); - hputs(" -h, --help display this help information"); - hputs(" -V, --version display version information"); -#undef hputs + fputs("pacman-conf - query pacman's configuration file\n", stream); + fputs("usage: pacman-conf [options] [<directive>...]\n", stream); + fputs(" pacman-conf (--repo-list|--help|--version)\n", stream); + fputs("options:\n", stream); + fputs(" -c, --config=<path> set an alternate configuration file\n", stream); + fputs(" -R, --rootdir=<path> set an alternate installation root\n", stream); + fputs(" -r, --repo=<remote> query options for a specific repo\n", stream); + fputs(" -v, --verbose always show directive names\n", stream); + fputs(" -l, --repo-list list configured repositories\n", stream); + fputs(" -h, --help display this help information\n", stream); + fputs(" -V, --version display version information\n", stream); cleanup(); exit(ret); } -- 2.23.0

1 1

[pacman-dev] Proposed Changelog Feature
by Hong Shick Pak 07 Sep '19

07 Sep '19

Hello! I noticed that PKGBUILD supports a 'changelog=' field to specify a file that contains release notes for that package and this is query-able via 'pacman -Qc <package>'. A lot of software these days maintain a CHANGELOG.md or NEWS file that keeps track of notable changes across versions (including pacman). Would it be possible for the PKGBUILD to allow users to specify a file to set for 'changelog=' relative to $srcdir? Of all the packages installed on my system, only 'terraform' and 'powertop' have a changelog set. This change would make it extremely trivial for package maintainers to specify a changelog file if one exists for a project. I think it would be a nice QoL win for Arch users if more packages took advantage of this feature. Let me know if there's an official RFC process for changes! I was not able to find any evidence of one. Hong

4 3

[pacman-dev] Starting Pacman development
by Matthew Sexton 07 Sep '19

07 Sep '19

What are some tasks that someone could tackle to get familiar with the project? I am familiar with C, and have perused Pacman bugs and source. But I don't feel like I know the application enough to really be helpful. And I don't really know where to start. Thank you, WSDMatty

3 3

[pacman-dev] [PATCH] makepkg: Delete logpipe when exiting
by Austin Lund 27 Aug '19

27 Aug '19

The logpipe fifo can remain when exiting on a non-error condition such as recieving signals INT and USR1. This can be seen by doing either a manual CTRL-C to interrupt the build or by sending a signal such as: $ makepkg & sleep 5 ; kill -USR1 $! Remove the fifo in all cases on script exit if it still exists. (Revises previously submitted patch) Signed-off-by: Austin Lund <austin.lund(a)gmail.com> --- scripts/makepkg.sh.in | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 43484db3..fac268a8 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -129,6 +129,10 @@ clean_up() { return 0 fi + if [[ -p $logpipe ]]; then + rm "$logpipe" + fi + if (( (EXIT_CODE == E_OK || EXIT_CODE == E_INSTALL_FAILED) && CLEANUP )); then local pkg file @@ -343,9 +347,6 @@ remove_deps() { } error_function() { - if [[ -p $logpipe ]]; then - rm "$logpipe" - fi # first exit all subshells, then print the error if (( ! BASH_SUBSHELL )); then error "$(gettext "A failure occurred in %s().")" "$1" -- 2.23.0

1 0

[pacman-dev] [PATCH] makepkg: Delete logpipe when cleaning up
by Austin Lund 26 Aug '19

26 Aug '19

There are a number of exit paths where the logpipe fifo remains in the logging directory. Remove it if it exists when cleaning up at exit. Signed-off-by: Austin Lund <austin.lund(a)gmail.com> --- scripts/makepkg.sh.in | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 43484db3..0e0d3461 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -129,6 +129,8 @@ clean_up() { return 0 fi + [[ -p $logpipe ]] && rm "$logpipe" + if (( (EXIT_CODE == E_OK || EXIT_CODE == E_INSTALL_FAILED) && CLEANUP )); then local pkg file @@ -343,9 +345,6 @@ remove_deps() { } error_function() { - if [[ -p $logpipe ]]; then - rm "$logpipe" - fi # first exit all subshells, then print the error if (( ! BASH_SUBSHELL )); then error "$(gettext "A failure occurred in %s().")" "$1" -- 2.23.0

3 6

[pacman-dev] [PATCH] document changes between 5.1 and 5.2
by Eli Schwartz 14 Aug '19

14 Aug '19

Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- Should be complete through to commit 75837a2717c3b5654149393d6ec0e0977a7ddc2f Instead of trying to make judgment calls about what order to list "important" changes in, I have tried to sort everything on a first-committed first-listed basis. This is guaranteed to make nobody happy, which is the best type of compromise -- it means you can do that yourself, Allan. ;) It also means it should be easier to double check that I didn't miss anything. Some news entries touch on multiple commits at once (e.g. grouping all extensions to libmakepkg together) in which case they all got listed with the first occurrence. Given expected updates for WKD stuff, I will be submitting v2+ versions at some point. NEWS | 82 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ README | 7 +++++ 2 files changed, 89 insertions(+) diff --git a/NEWS b/NEWS index ce39e0c5..30b75186 100644 --- a/NEWS +++ b/NEWS @@ -1,5 +1,87 @@ VERSION DESCRIPTION ----------------------------------------------------------------------------- +5.2.0 - ignore .hook suffix when sorting libalpm hooks + - update the minimum requirement of bash to 4.4 + - completely remove the --force option + - scripts: pass on options such as set -x to child processes + - show group and installed status during -Fs + - user-visible log when validity check fails due to access + - port pactest to python3 + - process --needed before group selection when resolving the + dependencies to prompt for (FS#22870) + - don't error when a group exists but all packages are ignored + - bash completion now completes when it should, and doesn't + complete when it shouldn't (FS#59965) + - add the meson build system as an alternative to autotools + - improve error message when gpg support is missing (FS#60880) + - don't emit confusing errors when a package is simultaneously + replaced and upgraded (FS#50875, FS#55534) + - better warning message when skipping duplicate targets (FS#49377) + - libalpm: parse {check, make}depends when reading database + (FS#60347) + - add [ignored] to -Qu output for packages in repos that are not + Usage = Upgrade (FS#59854) + - prevent 301 redirect loop from hanging libalpm + - use standard, consistent units in the download progress + (FS#59201) + - fix segfault when Usage is specified without a value + - completely remove delta support + - include timezones in pacman.log + - renovate and simplify the UI for -F (FS#47949) + - hooks: rename type File to Path, for accuracy + - bash-completion: use POSIX character classes for portability + - correctly report a download failiure for 404s + - fix handling of signals during SIGSEGV + - makepkg: + - add support for lzip, lz4 and zst compressed packages + (FS#56676, FS#59081) + - various improvements to PKGBUILD linting + - when signing packages, report package filename on failure + - fix pkgver() function not aborting on errors + - remove checksum algorithm whirlpoolsum as it has not worked + for a long time + - reject PKGBUILDs with both split and non-split package + functions + - send status messages to stderr rather than stdout (FS#17173) + - ensure debug buildflags are unset when they are supposed to be + - buildenv and executable detection, definitions for the + PKGBUILD schema, and makepkg.conf loading are now part of + libmakepkg + - fix broken check for the fakeroot binary + - improve the error message for invalid dependency versioning + - add routine for linting $SOURCE_DATE_EPOCH + - fix the error code when no PKGBUILD exists + - implement extendable source/signature verification routines + within libmakepkg (FS#49076) + - use --unneeded when removing build deps to allow runtime-only + deps to work well with makepkg -sir (FS#32723) + - if pacman is in use, wait until it is available before + continuing (FS#28840) + - add new checksum algorithm, b2sum + - compute package sizes correctly across different filesystems + - use shared clones for git sources to save space when building + - fix reporting of invalid archive extensions + - correctly handle hg sources with updates on a non-default + branch + - install pkg-config file for libmakepkg's library directory + - propagate error codes when package failed to sign correctly + - be compatible with file 5.37's application/gzip MIME type + - forbid non-ASCII pkgname and pkgver (FS#49342) + - fix exiting on failure without ensuring dependencies are + prompted for removal + - quiet superfluous warnings for missing debug source files for + artificial symbols + - pacman-key: + - just accept one file to verify, and enforce detached sigs + - repo-add: + - add support for zst compressed databases + - print the name of the database when extracting + - do not infinitely loop on malformed arguments with embedded + globs + - add option to prevent downgrading (FS#17752) + - various documentation updates +5.1.3 - Sanitize file name received from Content-Disposition header + during -U 5.1.2 - pacman-conf: add missing DisableDownloadTimeout support - Include version when checking optdepend install status during -Qi (FS#60106) diff --git a/README b/README index d96eae21..a39753fa 100644 --- a/README +++ b/README @@ -630,3 +630,10 @@ API CHANGES BETWEEN 5.0 AND 5.1 - alpm_capabilities() - duplicate and add to list - alpm_list_append_strdup() + +API CHANGES BETWEEN 5.1 AND 5.2 +=============================== +[REMOVED] +- alpm_sync_newversion() +[ADDED] +- alpm_sync_get_new_version() -- 2.22.1

1 0

[pacman-dev] pacman --print bug
by AstroSnail 14 Aug '19

14 Aug '19

Hi, I think I found a bug in pacman. When a package remove operation can't be satisfied, pacman prints an error, describes what went wrong, and does nothing: $ sudo pacman -R linux-api-headers checking dependencies... error: failed to prepare transaction (could not satisfy dependencies) :: glibc: removing linux-api-headers breaks dependency 'linux-api-headers>=4.10' This is obviously correct. When I try to --print a package remove operation that can't be satisfied, pacman prints an error, describes it, and does nothing, without printing the targets: $ pacman -Rp linux-api-headers error: failed to prepare transaction (could not satisfy dependencies) :: glibc: removing linux-api-headers breaks dependency 'linux-api-headers>=4.10' I can understand if this is correct behaviour as well, but at a glance it looks strange. When a package remove operation *can* be satisfied, but only with user confirmation (e.g. a HoldPkg was found in target list), pacman will print warnings and ask for user input before deciding whether or not to continue: $ sudo pacman -Rc linux-api-headers checking dependencies... <snip> warning: pacman is designated as a HoldPkg. warning: glibc is designated as a HoldPkg. :: HoldPkg was found in target list. Do you want to continue? [y/N] This is obviously correct. When I try to --print a package remove operation that *can* be satisfied, but only with user input, pacman prints a prompt for input but doesn't wait, and exits immediately, without even printing the warnings: $ pacman -Rcp linux-api-headers :: HoldPkg was found in target list. Do you want to continue? [y/N] This does not sound like correct behaviour to me.

3 3

[pacman-dev] [PATCH] RFC: support file with seccomp enabled
by Eli Schwartz 13 Aug '19

13 Aug '19

Not all compression types can be detected in the seccomp sandbox, so we need to disable it. This requires either configuring makepkg to know the sandbox is available, or checking for file >= 5.38 in which the sandbox option is a no-op even when seccomp is disabled. - Requires autoconf-archive for autotools version compare macro. - meson version comparison could be made a lot simpler using meson-git. Fixes FS#58626 Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- RELEASE | 1 + build-aux/edit-script.sh.in | 1 + configure.ac | 19 +++++++++++++++++++ meson.build | 10 ++++++++++ meson_options.txt | 3 +++ scripts/Makefile.am | 1 + scripts/libmakepkg/source/file.sh.in | 2 +- 7 files changed, 36 insertions(+), 1 deletion(-) diff --git a/RELEASE b/RELEASE index c9949253..7a9184b4 100644 --- a/RELEASE +++ b/RELEASE @@ -11,6 +11,7 @@ The following checklist should be used for making a pacman release. - Update doc/index.asciidoc - Create a signed git tag (git tag -s vX.Y.Z -m "commit message") - Create and sign release tarballs (generate with "make distcheck") + - In addition to the standard autotools toolchain, autoconf-archive is needed - Update pacman website Transifex updates are handled using the transifex client. The basic process is: diff --git a/build-aux/edit-script.sh.in b/build-aux/edit-script.sh.in index d5495057..640d32f8 100644 --- a/build-aux/edit-script.sh.in +++ b/build-aux/edit-script.sh.in @@ -19,6 +19,7 @@ mode=$3 -e "s|@TEMPLATE_DIR[@]|@TEMPLATE_DIR@|g" \ -e "s|@DEBUGSUFFIX[@]|@DEBUGSUFFIX@|g" \ -e "s|@INODECMD[@]|@INODECMD@|g" \ + -e "s|@FILECMD[@]|@FILECMD@|g" \ -e "s|@SEDINPLACEFLAGS[@]|@SEDINPLACEFLAGS@|g" \ -e "s|@SEDPATH[@]|@SEDPATH@|g" \ -e "s|@configure_input[@]|Generated from ${input##*/}; do not edit by hand.|g" \ diff --git a/configure.ac b/configure.ac index cb2fb2bf..0f3dd3ea 100644 --- a/configure.ac +++ b/configure.ac @@ -120,6 +120,12 @@ AC_ARG_WITH(ldconfig, [set the full path to ldconfig]), [LDCONFIG=$withval], [LDCONFIG=/sbin/ldconfig]) +# Help line for determining whether file is seccomp-enabled +AC_ARG_WITH(file-seccomp, + AS_HELP_STRING([--with-file-seccomp={yes|no|auto}], + [determine whether file is seccomp-enabled @<:@default=auto@:>@]), + [with_file_seccomp=$withval], [with_file_seccomp=auto]) + # Help line for selecting a crypto library AC_ARG_WITH(crypto, AS_HELP_STRING([--with-crypto={openssl|nettle}], @@ -222,6 +228,18 @@ PKG_CHECK_VAR(bashcompdir, [bash-completion], [completionsdir], , PKG_CHECK_MODULES(LIBARCHIVE, [libarchive >= 3.0.0], , AC_MSG_ERROR([*** libarchive >= 3.0.0 is needed to compile pacman!])) +# Check file for seccomp +if test "x$with_file_seccomp" = "xauto"; then + file_version="$(file --version| sed -n 's/^file-$.*$/\1/p')" + AX_COMPARE_VERSION([$file_version], [ge], [5.38], [with_file_seccomp=yes]) +fi +if test "x$with_file_seccomp" = "xyes"; then + FILECMD="file -S" +else + FILECMD="file" +fi +AC_SUBST(FILECMD) + # Check for OpenSSL have_openssl=no have_nettle=no @@ -559,6 +577,7 @@ ${PACKAGE_NAME}: Host Type : ${CHOST} File inode command : ${INODECMD} In-place sed command : ${SEDPATH} ${SEDINPLACEFLAGS} + File seccomp command : ${FILECMD} libalpm version : ${LIB_VERSION} libalpm version info : ${LIB_VERSION_INFO} diff --git a/meson.build b/meson.build index e79ecb6c..f3b5d6da 100644 --- a/meson.build +++ b/meson.build @@ -224,12 +224,20 @@ config_h = configure_file( configuration : conf) add_project_arguments('-include', 'config.h', language : 'c') +filecmd = 'file' default_sedinplaceflags = ' --follow-symlinks -i' inodecmd = 'stat -c \'%i %n\'' strip_binaries = '--strip-all' strip_shared = '--strip-unneeded' strip_static = '--strip-debug' +file_seccomp = get_option('file-seccomp') +# meson-git has find_program('file', required: false, version: '>=5.38') +filever = run_command('sh', '-c', 'file --version | sed -n "s/^file-$.*$/\\1/p"').stdout() +if file_seccomp.enabled() or ( file_seccomp.auto() and filever.version_compare('>= 5.38') ) + filecmd = 'file -S' +endif + os = host_machine.system() if os.startswith('darwin') inodecmd = '/usr/bin/stat -f \'%i %n\'' @@ -272,6 +280,7 @@ substs.set('BUILDSCRIPT', BUILDSCRIPT) substs.set('TEMPLATE_DIR', get_option('makepkg-template-dir')) substs.set('DEBUGSUFFIX', get_option('debug-suffix')) substs.set('INODECMD', inodecmd) +substs.set('FILECMD', filecmd) substs.set('SEDINPLACEFLAGS', sedinplaceflags) substs.set('SEDPATH', SED.path()) substs.set('LIBMAKEPKGDIR', LIBMAKEPKGDIR) @@ -428,6 +437,7 @@ message('\n '.join([ ' Host Type : @0@'.format(chost), ' File inode command : @0@'.format(inodecmd), ' In-place sed command : @0@ @1@'.format(SED.path(), sedinplaceflags), + ' File seccomp command : @0@'.format(filecmd), ' libalpm version : @0@'.format(libalpm_version), ' pacman version : @0@'.format(PACKAGE_VERSION), '', diff --git a/meson_options.txt b/meson_options.txt index 2d640e87..2b92ca1a 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -52,5 +52,8 @@ option('i18n', type : 'boolean', value : true, description : 'enable localization of pacman, libalpm and scripts') # tools +option('file-seccomp', type: 'feature', value: 'auto', + description: 'determine whether file is seccomp-enabled') + option('sedinplaceflags', type : 'string', value : 'auto', description : 'flags to pass to sed to edit a file in-place') diff --git a/scripts/Makefile.am b/scripts/Makefile.am index 0597a0e5..1008fed3 100644 --- a/scripts/Makefile.am +++ b/scripts/Makefile.am @@ -180,6 +180,7 @@ edit = sed \ -e 's|@TEMPLATE_DIR[@]|$(TEMPLATE_DIR)|g' \ -e 's|@DEBUGSUFFIX[@]|$(DEBUGSUFFIX)|g' \ -e "s|@INODECMD[@]|$(INODECMD)|g" \ + -e "s|@FILECMD[@]|$(FILECMD)|g" \ -e 's|@SEDINPLACEFLAGS[@]|$(SEDINPLACEFLAGS)|g' \ -e 's|@SEDPATH[@]|$(SEDPATH)|g' \ -e 's|@SCRIPTNAME[@]|$@|g' \ diff --git a/scripts/libmakepkg/source/file.sh.in b/scripts/libmakepkg/source/file.sh.in index 8492ba11..f6d79f9e 100644 --- a/scripts/libmakepkg/source/file.sh.in +++ b/scripts/libmakepkg/source/file.sh.in @@ -96,7 +96,7 @@ extract_file() { fi # do not rely on extension for file type - local file_type=$(file -bizL -- "$file") + local file_type=$(@FILECMD@ -bizL -- "$file") local ext=${file##*.} local cmd='' case "$file_type" in -- 2.22.0

2 1

[pacman-dev] [PATCH] Set "secure" $HOME
by Jonathon Fernyhough 12 Aug '19

12 Aug '19

By default, $HOME is that of the build user. This is usually not a problem in ephemeral build containers/chroots but can allow some files to escape into the filesystem where `makepkg` is run outside of a chroot. There can also be instances of generated files (e.g. cache, precompiled bytecode) being placed into these locations and which are then relied upon by other parts of the software. As a concrete example, Perl6 and nim have a precompilation cache (though well-behaved in how it is used). `export HOME=/nonexistent` is already used by Debian in their build tooling and so does not represent a divergence from established practice. It also allows for badly-behaved build processes to be more easily spotted and an issue filed upstream where appropriate. Signed-off-by: Jonathon Fernyhough <jonathon(a)manjaro.org> --- scripts/makepkg.sh.in | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 43484db3..04edc38a 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -40,6 +40,8 @@ export COMMAND_MODE='legacy' unset CDPATH # Ensure GREP_OPTIONS doesn't screw with our grep calls unset GREP_OPTIONS +# Prevent build-user-specific files "escaping" into the filesystem +export HOME=/nonexistent declare -r makepkg_version='@PACKAGE_VERSION@' declare -r confdir='@sysconfdir@' -- 2.22.0

3 2

[pacman-dev] Preparing for pacman-5.2
by Allan McRae 12 Aug '19

12 Aug '19

Hi all, It is well beyond time I made another release, so here we go! There is still a few patches that will land. Mostly to do with WKD stuff - these still need a thorough review. Other patches I know of in the queue: - file -S - debug symbol conflicts - RUSTFLAGS Flag anything else with me ASAP. I have pushed string updates to transifex so people can get a head start, although there are only two new strings in "libalpm" and 14 new in "pacman scripts"! There will be a final string freeze once the above patches are dealt with. Allan

1 0