- Pacman-dev - lists.archlinux.org

[Git][pacman/pacman][master] 4 commits: allow freeing partial db package cache
by Allan McRae (＠allan) 07 Feb '24

07 Feb '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 5c75a55c by Andrew Gregory at 2024-02-07T12:27:26+00:00 allow freeing partial db package cache The free function was checking DB_STATUS_PKGCACHE, which is only set once the package cache has been fully built. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> - - - - - edd57c8b by Andrew Gregory at 2024-02-07T12:27:26+00:00 perform cleanup on sync db parsing errors Cleanup was only being performed when libarchive failed to actually read the file. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> - - - - - fde59b99 by Andrew Gregory at 2024-02-07T12:27:26+00:00 be_package: delay freeing archive resource The error path uconditinally tries to free the archive, leading to a double-free segmentation fault if the error path is triggered after already freeing it. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> - - - - - 0a394144 by Andrew Gregory at 2024-02-07T12:27:26+00:00 validate package metadata after loading alpm has certain requirements for package metadata necessary for proper functioning, name and version in particular. These requirements are already enforced in makepkg, but nowhere in alpm. Exceptions are treated as errors for non-local packages because they cannot be installed without potentially resulting in undefined behavior. Exceptions for local packages are treated as warnings because they are already installed, so any damage has already been done, and the user would otherwise have no way to uninstall them. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> - - - - - 10 changed files: - lib/libalpm/be_local.c - lib/libalpm/be_package.c - lib/libalpm/be_sync.c - lib/libalpm/db.c - lib/libalpm/package.c - lib/libalpm/package.h - test/pacman/meson.build - + test/pacman/tests/pkg-meta-invalid-name-file.py - + test/pacman/tests/pkg-meta-invalid-name-local.py - + test/pacman/tests/pkg-meta-invalid-name-sync.py View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/56f1eeef4b97733db3d2b3… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/56f1eeef4b97733db3d2b3… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Remove obsolete Doxyfile directives
by Allan McRae (＠allan) 06 Feb '24

06 Feb '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 56f1eeef by Allan McRae at 2024-02-06T20:03:08+10:00 Remove obsolete Doxyfile directives Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - doc/Doxyfile.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/56f1eeef4b97733db3d2b3b… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/56f1eeef4b97733db3d2b3b… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] 4 commits: makepkg: Emit early error if signature verification fails
by Allan McRae (＠allan) 04 Feb '24

04 Feb '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 3aa096a7 by David Runge at 2024-02-04T10:06:40+01:00 makepkg: Emit early error if signature verification fails Emit an early error message if tag or commit verification with git or detached signature verification with gpg fails. Make `verify_file_signature()` and `verify_git_signature()` return non-zero in this case and set errors to `1`, so that later checks in `check_pgpsigs()`, although still run, can not lead to a positive result. Signed-off-by: David Runge <dvzrv(a)archlinux.org> - - - - - 86ec26b2 by David Runge at 2024-02-04T10:06:42+01:00 makepkg: Improve robustness of signature verification by limiting terms The output of `gpg --quiet --batch --status-fd /dev/stdout --verify <signature_file> <file> 2> /dev/null` or `git verify-commit --raw <commit> 2>&1` may contain binary data, if the signature has been created with an OpenPGP implementation, that e.g. makes use of notations. If the notation string (see `NOTATION_DATA` in /usr/share/doc/gnupg/ DETAILS) contains a trailing binary char, this will break signature verification, as any following entry (e.g. `VALIDSIG`) will be offset. As we are only making use of a narrow set of terms from the statusfile (namely `NEWSIG`, `GOODSIG`, `EXPSIG`, `EXPKEYSIG`, `REVKEYSIG`, `BADSIG`, `ERRSIG`, `VALIDSIG`, `TRUST_UNDEFINED`, `TRUST_NEVER`, `TRUST_MARGINAL`, `TRUST_FULLY`, `TRUST_ULTIMATE`), we are applying a filter, so that only understood terms are written to the file. Signed-off-by: David Runge <dvzrv(a)archlinux.org> - - - - - 16a06470 by David Runge at 2024-02-04T10:06:42+01:00 makepkg: Move check for signature metadata to central location Move the check for the `NEWSIG` metadata keyword contained in the GnuPG based statusfile to `parse_gpg_statusfile()` so that it is also run when creating the statusfile in `verify_file_signature()` and not only when running `verify_git_signature()`. Signed-off-by: David Runge <dvzrv(a)archlinux.org> - - - - - f8c2e59e by David Runge at 2024-02-04T10:06:43+01:00 pacman-key: Make signature verification more robust by checking pipes To ensure we are not dropping the return code of the `gpg` call due to piping into `grep`, we make use of `PIPESTATUS` to check the return code of each command separately. Additionally, we can now distinguish between two states: The signature does not verify (e.g. due to technical reasons) and the signature is not trusted. Signed-off-by: David Runge <dvzrv(a)archlinux.org> - - - - - 2 changed files: - scripts/libmakepkg/integrity/verify_signature.sh.in - scripts/pacman-key.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/bf76b5e89f95ff02191cfc… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/bf76b5e89f95ff02191cfc… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] libalpm: correctly log curl_download_internal return value
by Allan McRae (＠allan) 04 Feb '24

04 Feb '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: bf76b5e8 by morganamilo at 2024-02-04T10:23:34+10:00 libalpm: correctly log curl_download_internal return value Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - lib/libalpm/dload.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/bf76b5e89f95ff02191cfc3… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/bf76b5e89f95ff02191cfc3… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] 2 commits: libalpm/remove.c: prevent undefined behaviour in shift_pacsave error path
by Allan McRae (＠allan) 03 Feb '24

03 Feb '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: f996f301 by Allan McRae at 2024-02-04T09:02:36+10:00 libalpm/remove.c: prevent undefined behaviour in shift_pacsave error path Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - ce528a26 by Allan McRae at 2024-02-04T09:02:36+10:00 libalpm/discspace.c: ensure mount points provide directories In the very unlikely situtation where getmntent() and friends return non-null, but the mount directory is NULL, a null dereference could occur. It is unclear what the best course of action is in this case, so just move on to the next mount point. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 2 changed files: - lib/libalpm/diskspace.c - lib/libalpm/remove.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/2ba08e622b86fa8b0831d7… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/2ba08e622b86fa8b0831d7… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Update maintainers list
by Allan McRae (＠allan) 03 Feb '24

03 Feb '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 2ba08e62 by Daniel M. Capella at 2024-02-04T08:58:33+10:00 Update maintainers list Signed-off-by: Daniel M. Capella <polyzen(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - doc/footer.asciidoc View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/2ba08e622b86fa8b0831d72… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/2ba08e622b86fa8b0831d72… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Add -Wunused_result to debug build compiler flags
by Allan McRae (＠allan) 03 Feb '24

03 Feb '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 4856fb53 by Allan McRae at 2024-02-04T08:53:44+10:00 Add -Wunused_result to debug build compiler flags Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - meson.build View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/4856fb53acc2e59ffef550b… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/4856fb53acc2e59ffef550b… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Ensure paths fit in PATH_MAX when cleaning cache
by Allan McRae (＠allan) 03 Feb '24

03 Feb '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: a6b25247 by Allan McRae at 2024-02-04T08:44:24+10:00 Ensure paths fit in PATH_MAX when cleaning cache If a path length exceeds the PATH_MAX value, then it gets truncated when building the path of the file to delete. This could (in a very unlikely case...) result in the wrong file being deleted. Check the path fittedin the buffer before removing files. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - src/pacman/sync.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/a6b2524762eb3c024f5e6f5… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/a6b2524762eb3c024f5e6f5… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] 4 commits: _alpm_pkg_load_internal: remove unneeded if statement
by Allan McRae (＠allan) 03 Feb '24

03 Feb '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: c64f898c by Allan McRae at 2024-02-04T07:56:00+10:00 _alpm_pkg_load_internal: remove unneeded if statement This statement is always true due to an earlier test. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - dfee7733 by Allan McRae at 2024-02-04T07:56:00+10:00 clean_filename: use strdup instead of malloc and memcpy Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 845dadf1 by Allan McRae at 2024-02-04T07:56:00+10:00 _cache_mtree_open: remove unused variable Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 2079f686 by Allan McRae at 2024-02-04T07:56:00+10:00 alpm_list_reverse: restore original list on failure Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 4 changed files: - lib/libalpm/alpm_list.c - lib/libalpm/be_local.c - lib/libalpm/be_package.c - src/pacman/callback.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/16a2a79728d6b3184fd361… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/16a2a79728d6b3184fd361… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] libalpm/signing.c: prevent underflow in length_check
by Allan McRae (＠allan) 03 Feb '24

03 Feb '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 16a2a797 by Allan McRae at 2024-02-04T07:54:12+10:00 libalpm/signing.c: prevent underflow in length_check The length_check function could underflow if the provided buffer index is greater than the signature buffer length, leading to an out of bounds read. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - lib/libalpm/signing.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/16a2a79728d6b3184fd3615… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/16a2a79728d6b3184fd3615… You're receiving this email because of your account on gitlab.archlinux.org.

1 0