- Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH 2/2] lint_pkgbuild: increase robustness
by Allan McRae 22 Nov '15

22 Nov '15

Approach the detection of variables of the wrong type using an approach similar to that used for construction of .SRCINFO files. While doing silly things in bash could still result in false negatives, this approach should be very robust to generatinf false positives results. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- scripts/libmakepkg/lint_pkgbuild/variable.sh.in | 67 ++++++++++++++++++++----- 1 file changed, 55 insertions(+), 12 deletions(-) diff --git a/scripts/libmakepkg/lint_pkgbuild/variable.sh.in b/scripts/libmakepkg/lint_pkgbuild/variable.sh.in index 1daac26..80ef895 100644 --- a/scripts/libmakepkg/lint_pkgbuild/variable.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/variable.sh.in @@ -24,7 +24,7 @@ LIBMAKEPKG_LINT_PKGBUILD_VARIABLE_SH=1 LIBRARY=${LIBRARY:-'@libmakepkgdir@'} source "$LIBRARY/util/message.sh" - +source "$LIBRARY/util/pkgbuild.sh" lint_pkgbuild_functions+=('lint_variable') @@ -37,11 +37,16 @@ lint_variable() { replaces sha1sums sha256sums sha384sums sha512sums source) local string=(changelog epoch install pkgdesc pkgrel pkgver url) - local i - for i in ${array[@]}; do - if grep -w -q -e "$i=[^(]" -e "$i+=[^(]" "$BUILDSCRIPT"; then - error "$(gettext "%s should be an array")" "$i" - ret=1 + local i keys out bad + + # global variables + for i in ${array[@]} ${arch_array[@]}; do + eval "keys=(\"\${!$i[@]}\")" + if (( ${#keys[*]} > 0 )); then + if ! declare -p $i | grep -q "declare -a"; then + error "$(gettext "%s should be an array")" "$i" + ret=1 + fi fi done @@ -49,17 +54,55 @@ lint_variable() { [[ $a == "any" ]] && continue for i in ${arch_array[@]}; do - if grep -w -q -e "$i_$a=[^(]" -e "$i_$a+=[^(]" "$BUILDSCRIPT"; then - error "$(gettext "%s_%s should be an array")" "$i" "$a" - ret=1 + v="${i}_${a}" + eval "keys=(\"\${!${v}[@]}\")" + if (( ${#keys[*]} > 0 )); then + if ! declare -p ${v} | grep -q "declare -a"; then + error "$(gettext "%s_%s should be an array")" "$i" "$a" + ret=1 + fi fi done done for i in ${string[@]}; do - if grep -w -q -e "$i=(" -e "$i+=(" "$BUILDSCRIPT"; then - error "$(gettext "%s should not be an array")" "$i" - ret=1 + eval "keys=(\"\${!$i[@]}\")" + if (( ${#keys[*]} > 0 )); then + if declare -p $i | grep -q "declare -a"; then + error "$(gettext "%s should not be an array")" "$i" + ret=1 + fi fi done + + # package function variables + for pkg in ${pkgname[@]}; do + for i in ${array[@]} ${arch_array[@]}; do + if extract_function_variable "package_$pkg" $i 0 out; then + error "$(gettext "%s should be an array")" "$i" + ret=1 + fi + done + + for a in ${arch[@]}; do + [[ $a == "any" ]] && continue + + for i in ${arch_array[@]}; do + if extract_function_variable "package_$pkg" "${i}_${a}" 0 out; then + error "$(gettext "%s_%s should be an array")" "$i" "$a" + ret=1 + fi + done + done + + for i in ${string[@]}; do + if extract_function_variable "package_$pkg" $i 1 out; then + error "$(gettext "%s should not be an array")" "$i" + ret=1 + fi + done + done + + + } -- 2.6.2

2 3

[pacman-dev] [feature request] Ring terminal bell on prompt
by Eric Toombs 19 Nov '15

19 Nov '15

(copied from here: https://bugs.archlinux.org/task/41188 The attachment is there too. I made it a while ago, so that's why I called 4.1.2 current.) I have implemented a boolean option '--bell' that when enabled, causes pacman to ring the terminal bell when there is user input required. I find this tremendously helpful when there are long delays between user input and I am busy doing other things at the same time. Let me know what you think. The patch is attached. It applies to the src/pacman folder of the current (4.1.2) release.

2 4

[pacman-dev] [PATCH] lint_pkgbuild: explicitly return value
by Allan McRae 13 Nov '15

13 Nov '15

Set the return value to be local and always explictly returns it. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- WHO WROTE THIS?! scripts/libmakepkg/lint_pkgbuild/arch.sh.in | 2 +- scripts/libmakepkg/lint_pkgbuild/changelog.sh.in | 4 +++- scripts/libmakepkg/lint_pkgbuild/install.sh.in | 4 +++- scripts/libmakepkg/lint_pkgbuild/pkgbase.sh.in | 4 ++++ scripts/libmakepkg/lint_pkgbuild/util.sh.in | 2 +- 5 files changed, 12 insertions(+), 4 deletions(-) diff --git a/scripts/libmakepkg/lint_pkgbuild/arch.sh.in b/scripts/libmakepkg/lint_pkgbuild/arch.sh.in index b8a8c30..f217515 100644 --- a/scripts/libmakepkg/lint_pkgbuild/arch.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/arch.sh.in @@ -31,7 +31,7 @@ lint_pkgbuild_functions+=('lint_arch') lint_arch() { - local a name list + local a name list ret=0 if [[ $arch == 'any' ]]; then return 0 diff --git a/scripts/libmakepkg/lint_pkgbuild/changelog.sh.in b/scripts/libmakepkg/lint_pkgbuild/changelog.sh.in index 72300a4..70959d0 100644 --- a/scripts/libmakepkg/lint_pkgbuild/changelog.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/changelog.sh.in @@ -41,5 +41,7 @@ lint_changelog() { fi done - check_files_exist 'changelog' "${changelog_list[@]}" + check_files_exist 'changelog' "${changelog_list[@]}" || ret=1 + + return $ret } diff --git a/scripts/libmakepkg/lint_pkgbuild/install.sh.in b/scripts/libmakepkg/lint_pkgbuild/install.sh.in index 21e0bfb..8e5c115 100644 --- a/scripts/libmakepkg/lint_pkgbuild/install.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/install.sh.in @@ -40,5 +40,7 @@ lint_install() { install_list+=("$file") done - check_files_exist 'install' "${install_list[@]}" + check_files_exist 'install' "${install_list[@]}" || ret=1 + + return $ret } diff --git a/scripts/libmakepkg/lint_pkgbuild/pkgbase.sh.in b/scripts/libmakepkg/lint_pkgbuild/pkgbase.sh.in index 0d4361c..53f89ce 100644 --- a/scripts/libmakepkg/lint_pkgbuild/pkgbase.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/pkgbase.sh.in @@ -30,6 +30,8 @@ lint_pkgbuild_functions+=('lint_pkgbase') lint_pkgbase() { + local ret=0 + if [[ ${pkgbase:0:1} = "-" ]]; then error "$(gettext "%s is not allowed to start with a hyphen.")" "pkgname" return 1 @@ -43,4 +45,6 @@ lint_pkgbase() { 'pkgbase' "${i//[[:alnum:]+_.@-]}" ret=1 fi + + return $ret } diff --git a/scripts/libmakepkg/lint_pkgbuild/util.sh.in b/scripts/libmakepkg/lint_pkgbuild/util.sh.in index 448abc8..8760eb6 100644 --- a/scripts/libmakepkg/lint_pkgbuild/util.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/util.sh.in @@ -27,7 +27,7 @@ source "$LIBRARY/util/message.sh" check_files_exist() { - local kind=$1 files=("${@:2}") file ret + local kind=$1 files=("${@:2}") file ret=0 for file in "${files[@]}"; do if [[ $file && ! -f $file ]]; then -- 2.6.2

1 0

[pacman-dev] [PATCH] Fix the implementation of lint_variable.
by David Grayson 13 Nov '15

13 Nov '15

The old implementation had both false negatives and false positives. Because of the -w option to grep, it didn't detect lines like: license=bad Additionally, it did detect irrelevant lines like this: --with-arch=${_arch} The latter is a false positive which made it difficult to build valid packages. Signed-off-by: David Grayson <davidegrayson(a)gmail.com> --- scripts/libmakepkg/lint_pkgbuild/variable.sh.in | 26 ++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/scripts/libmakepkg/lint_pkgbuild/variable.sh.in b/scripts/libmakepkg/lint_pkgbuild/variable.sh.in index 1daac26..eee6b54 100644 --- a/scripts/libmakepkg/lint_pkgbuild/variable.sh.in +++ b/scripts/libmakepkg/lint_pkgbuild/variable.sh.in @@ -28,6 +28,25 @@ source "$LIBRARY/util/message.sh" lint_pkgbuild_functions+=('lint_variable') +lint_var_defined_as_non_array() { + if [[ "${!1+x}" == "" ]]; then + return 1 # not defined + fi + if [[ "$(declare -p $1)" == "declare -a "* ]]; then + return 1 # defined as an array + fi + return 0 +} + +lint_var_defined_as_array() { + if [[ "${!1+x}" == "" ]]; then + return 1 # not defined + fi + if [[ "$(declare -p $1)" == "declare -a "* ]]; then + return 0 # defined as an array + fi + return 1 +} lint_variable() { # TODO: refactor - similar arrays are used elsewhere @@ -39,17 +58,18 @@ lint_variable() { local i for i in ${array[@]}; do - if grep -w -q -e "$i=[^(]" -e "$i+=[^(]" "$BUILDSCRIPT"; then + if lint_var_defined_as_non_array $i; then error "$(gettext "%s should be an array")" "$i" ret=1 fi done + local a for a in ${arch[@]}; do [[ $a == "any" ]] && continue for i in ${arch_array[@]}; do - if grep -w -q -e "$i_$a=[^(]" -e "$i_$a+=[^(]" "$BUILDSCRIPT"; then + if lint_var_defined_as_non_array $i; then error "$(gettext "%s_%s should be an array")" "$i" "$a" ret=1 fi @@ -57,7 +77,7 @@ lint_variable() { done for i in ${string[@]}; do - if grep -w -q -e "$i=(" -e "$i+=(" "$BUILDSCRIPT"; then + if lint_var_defined_as_array $i; then error "$(gettext "%s should not be an array")" "$i" ret=1 fi -- 2.6.2

2 5

[pacman-dev] [PATCH 1/2] makepkg: merge arch dependent variables after PKGBUILD linting
by Allan McRae 13 Nov '15

13 Nov '15

Signed-off-by: Allan McRae <allan(a)archlinux.org> --- scripts/makepkg.sh.in | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 22679f7..42bc228 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -761,10 +761,6 @@ merge_arch_attrs() { source_buildfile() { source_safe "$@" - - if (( !SOURCEONLY )); then - merge_arch_attrs - fi } run_function_safe() { @@ -2004,6 +2000,13 @@ else source_buildfile "$BUILDFILE" fi +# check the PKGBUILD for some basic requirements +lint_pkgbuild || exit 1 + +if (( !SOURCEONLY )); then + merge_arch_attrs +fi + # set defaults if they weren't specified in buildfile pkgbase=${pkgbase:-${pkgname[0]}} basever=$(get_full_version) @@ -2033,9 +2036,6 @@ if have_function pkgver; then PKGVERFUNC=1 fi -# check the PKGBUILD for some basic requirements -lint_pkgbuild || exit 1 - # check we have the software required to process the PKGBUILD check_software || exit 1 -- 2.6.2

1 0

[pacman-dev] [PATCH 1/5] pmrule.py: add FILE_CONTENTS rule
by Andrew Gregory 12 Nov '15

12 Nov '15

Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> --- To be used in NeedsTargets test. test/pacman/README | 1 + test/pacman/pmrule.py | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/test/pacman/README b/test/pacman/README index 6c601b2..a5fdeaa 100644 --- a/test/pacman/README +++ b/test/pacman/README @@ -303,6 +303,7 @@ its DEPENDS field. . FILE rules + FILE_CONTENTS=path/to/file|contents FILE_EXIST=path/to/file FILE_EMPTY=path/to/file FILE_MODIFIED=path/to/file diff --git a/test/pacman/pmrule.py b/test/pacman/pmrule.py index 3bcac86..f8991fd 100644 --- a/test/pacman/pmrule.py +++ b/test/pacman/pmrule.py @@ -120,6 +120,12 @@ def check(self, test): if not (os.path.isfile(filename) and os.path.getsize(filename) == 0): success = 0 + elif case == "CONTENTS": + try: + with open(filename, 'r') as f: + success = f.read() == value + except: + success = 0 elif case == "MODIFIED": for f in test.files: if f.name == key: -- 2.6.2

1 4

[pacman-dev] [PATCH 1/6] order hooks by file name
by Andrew Gregory 11 Nov '15

11 Nov '15

Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> --- lib/libalpm/hook.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/lib/libalpm/hook.c b/lib/libalpm/hook.c index fe4b204..c7b4ee8 100644 --- a/lib/libalpm/hook.c +++ b/lib/libalpm/hook.c @@ -363,6 +363,11 @@ static int _alpm_hook_triggered(alpm_handle_t *handle, struct _alpm_hook_t *hook return 0; } +static int _alpm_hook_cmp(struct _alpm_hook_t *h1, struct _alpm_hook_t *h2) +{ + return strcmp(h1->name, h2->name); +} + static alpm_list_t *find_hook(alpm_list_t *haystack, const void *needle) { while(haystack) { @@ -478,6 +483,9 @@ int _alpm_hook_run(alpm_handle_t *handle, enum _alpm_hook_when_t when) closedir(d); } + hooks = alpm_list_msort(hooks, alpm_list_count(hooks), + (alpm_list_fn_cmp)_alpm_hook_cmp); + for(i = hooks; i; i = i->next) { struct _alpm_hook_t *hook = i->data; if(hook && hook->when == when && _alpm_hook_triggered(handle, hook)) { -- 2.6.2

2 11

[pacman-dev] [PATCH] Use correct format specifiers
by Rikard Falkeborn 11 Nov '15

11 Nov '15

--- lib/libalpm/diskspace.c | 2 +- lib/libalpm/dload.c | 2 +- lib/libalpm/remove.c | 2 +- lib/libalpm/util.c | 2 +- src/pacman/callback.c | 12 ++++++------ src/pacman/conf.c | 4 ++-- src/pacman/util.c | 4 ++-- 7 files changed, 14 insertions(+), 14 deletions(-) diff --git a/lib/libalpm/diskspace.c b/lib/libalpm/diskspace.c index aaa0036..5bb2173 100644 --- a/lib/libalpm/diskspace.c +++ b/lib/libalpm/diskspace.c @@ -349,7 +349,7 @@ static int check_mountpoint(alpm_handle_t *handle, alpm_mountpoint_t *mp) (uintmax_t)cushion, (uintmax_t)mp->fsp.f_bfree); if(needed >= 0 && (fsblkcnt_t)needed > mp->fsp.f_bfree) { _alpm_log(handle, ALPM_LOG_ERROR, - _("Partition %s too full: %jd blocks needed, %jd blocks free\n"), + _("Partition %s too full: %jd blocks needed, %ju blocks free\n"), mp->mount_dir, (intmax_t)needed, (uintmax_t)mp->fsp.f_bfree); return 1; } diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index 63523aa..f3df9cd 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -323,7 +323,7 @@ static void curl_set_handle_opts(struct dload_payload *payload, curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE); curl_easy_setopt(curl, CURLOPT_TIMEVALUE, (long)st.st_mtime); _alpm_log(handle, ALPM_LOG_DEBUG, - "using time condition: %lu\n", (long)st.st_mtime); + "using time condition: %ld\n", (long)st.st_mtime); } else if(stat(payload->tempfile_name, &st) == 0 && payload->allow_resume) { /* a previous partial download exists, resume from end of file. */ payload->tempfile_openmode = "ab"; diff --git a/lib/libalpm/remove.c b/lib/libalpm/remove.c index bc5713a..2fb7993 100644 --- a/lib/libalpm/remove.c +++ b/lib/libalpm/remove.c @@ -599,7 +599,7 @@ static int remove_package_files(alpm_handle_t *handle, } } - _alpm_log(handle, ALPM_LOG_DEBUG, "removing %zd files\n", filelist->count); + _alpm_log(handle, ALPM_LOG_DEBUG, "removing %zu files\n", filelist->count); if(!newpkg) { /* init progress bar, but only on true remove transactions */ diff --git a/lib/libalpm/util.c b/lib/libalpm/util.c index 66a2742..955bf6f 100644 --- a/lib/libalpm/util.c +++ b/lib/libalpm/util.c @@ -1290,7 +1290,7 @@ void *_alpm_greedy_grow(void **data, size_t *current, const size_t required) void _alpm_alloc_fail(size_t size) { - fprintf(stderr, "alloc failure: could not allocate %zd bytes\n", size); + fprintf(stderr, "alloc failure: could not allocate %zu bytes\n", size); } /* vim: set noet: */ diff --git a/src/pacman/callback.c b/src/pacman/callback.c index 9260ece..7a21b22 100644 --- a/src/pacman/callback.c +++ b/src/pacman/callback.c @@ -418,8 +418,8 @@ void cb_question(alpm_question_t *question) alpm_question_select_provider_t *q = &question->select_provider; size_t count = alpm_list_count(q->providers); char *depstring = alpm_dep_compute_string(q->depend); - colon_printf(_n("There is %zd provider available for %s\n", - "There are %zd providers available for %s:\n", count), + colon_printf(_n("There is %zu provider available for %s\n", + "There are %zu providers available for %s:\n", count), count, depstring); free(depstring); select_display(q->providers); @@ -443,10 +443,10 @@ void cb_question(alpm_question_t *question) strftime(created, 12, "%Y-%m-%d", localtime(&time)); if(q->key->revoked) { - q->import = yesno(_("Import PGP key %d%c/%s, \"%s\", created: %s (revoked)?"), + q->import = yesno(_("Import PGP key %u%c/%s, \"%s\", created: %s (revoked)?"), q->key->length, q->key->pubkey_algo, q->key->fingerprint, q->key->uid, created); } else { - q->import = yesno(_("Import PGP key %d%c/%s, \"%s\", created: %s?"), + q->import = yesno(_("Import PGP key %u%c/%s, \"%s\", created: %s?"), q->key->length, q->key->pubkey_algo, q->key->fingerprint, q->key->uid, created); } } @@ -590,8 +590,8 @@ void cb_progress(alpm_progress_t event, const char *pkgname, int percent, } - printf("(%*ld/%*ld) %ls%-*s", digits, (unsigned long)current, - digits, (unsigned long)howmany, wcstr, padwid, ""); + printf("(%*zu/%*zu) %ls%-*s", digits, current, + digits, howmany, wcstr, padwid, ""); free(wcstr); diff --git a/src/pacman/conf.c b/src/pacman/conf.c index f02e361..a2ee9b4 100644 --- a/src/pacman/conf.c +++ b/src/pacman/conf.c @@ -95,8 +95,8 @@ config_t *config_new(void) config_t *newconfig = calloc(1, sizeof(config_t)); if(!newconfig) { pm_printf(ALPM_LOG_ERROR, - _n("malloc failure: could not allocate %zd byte\n", - "malloc failure: could not allocate %zd bytes\n", sizeof(config_t)), + _n("malloc failure: could not allocate %zu byte\n", + "malloc failure: could not allocate %zu bytes\n", sizeof(config_t)), sizeof(config_t)); return NULL; } diff --git a/src/pacman/util.c b/src/pacman/util.c index 5f331e8..3ab71cf 100644 --- a/src/pacman/util.c +++ b/src/pacman/util.c @@ -812,7 +812,7 @@ static alpm_list_t *create_verbose_header(size_t count) alpm_list_t *ret = NULL; char *header; - pm_asprintf(&header, "%s (%zd)", _("Package"), count); + pm_asprintf(&header, "%s (%zu)", _("Package"), count); add_table_cell(&ret, header, CELL_TITLE | CELL_FREE); add_table_cell(&ret, _("Old Version"), CELL_TITLE); @@ -921,7 +921,7 @@ static void _display_targets(alpm_list_t *targets, int verbose) } /* print to screen */ - pm_asprintf(&str, "%s (%zd)", _("Packages"), alpm_list_count(targets)); + pm_asprintf(&str, "%s (%zu)", _("Packages"), alpm_list_count(targets)); printf("\n"); cols = getcols(); -- 2.6.2

2 1

[pacman-dev] [PATCH] Refactor strtrim function
by Silvan Jegen 09 Nov '15

09 Nov '15

Signed-off-by: Silvan Jegen <s.jegen(a)gmail.com> --- src/common/util-common.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/src/common/util-common.c b/src/common/util-common.c index 542dcfd..0b67d85 100644 --- a/src/common/util-common.c +++ b/src/common/util-common.c @@ -144,17 +144,13 @@ size_t strtrim(char *str) } if(pch != str) { size_t len = strlen(pch); - if(len) { - memmove(str, pch, len + 1); - pch = str; - } else { + /* check if there wasn't anything but whitespace in the string. */ + if(len == 0) { *str = '\0'; + return 0; } - } - - /* check if there wasn't anything but whitespace in the string. */ - if(*str == '\0') { - return 0; + memmove(str, pch, len + 1); + pch = str; } end = (str + strlen(str) - 1); -- 2.6.2

1 0

[pacman-dev] [PATCH] makepkg: sums: Add FILE and SIGNED-MSG modes
by Olivier Brunel 07 Nov '15

07 Nov '15

Verifying PGP signatures was only done by expecting them to be detached signature of the source code, which is the case on many occasions. However, some upstreams actually do things a bit differently, specifically there are two other main ways things can be done: - a checksum file is provided, as well as a detached signature of that file. For such cases, this adds a special mode (alongside SKIP) to the sums array: FILE In that case, for filename.ext a file filename.ext.$ALGO is expected to be a standard checksum file - i.e. contain at least a line with the hash, spaces, then the filename - and the hash used will be the one from that file. Obviously this should be used when a detached signature of the file is provided, which will be treated by makepkg just as usual. An example package could be firefox. - a checksum file is provided as a signed message. For such cases, this adds a mode SIGNED-MSG, as it expects a file filename.ext.$ALGO.signed-msg to be the signed message. Upon hash checking, it will "extract" said message from the file via gpg, then use it much like in the FILE case. And during PGP signature checking, *.signed-msg files are verified as signed messages instead of detached signatures. An example package could be harfbuzz. Note that this doesn't change generation (--geninteg) since it can't be done automatically. Signed-off-by: Olivier Brunel <jjk(a)jjacky.com> --- So the .signed-msg extension is obviously not one that will be found upstream, and will force a rename in the source array. A "common" extension that might be found upstream for such files would be .$ALGO.asc (e.g. .sha1.asc), and using that as well could make the source array a bit "simpler" to write, that is e.g: source=(http://www.freedesktop.org/software/harfbuzz/release/${pkgname}-${p… vs: source=(http://www.freedesktop.org/software/harfbuzz/release/${pkgname}-${p… $pkgname-$pkgver.tar.bz2.sha256.signed-msg::http://www.freedesktop.org/software/harfbuzz/release/${pkgname}-${pkgver}.tar.bz2.sha256.asc) I thought of using SIGNED-ASC as mode, and expect such file names, but then in makepkg we can't just identify such files (upon signature checking) simply by names, since it is also a valid name for detached signature of a checksum file (e.g. used in FILE mode), so then it would go: if the source file is missing, and the filename matches *.$ALGO.asc then instead of erroring out process it as a signed message. Felt to me that this wasn't as simple/proper, and so I went with a custom, specific extension. That could be change if you prefer it the other way around, or have a better idea? doc/PKGBUILD.5.txt | 19 +++++++++ scripts/makepkg.sh.in | 104 +++++++++++++++++++++++++++++++++++++------------- 2 files changed, 97 insertions(+), 26 deletions(-) diff --git a/doc/PKGBUILD.5.txt b/doc/PKGBUILD.5.txt index 4ff3b02..4802d2a 100644 --- a/doc/PKGBUILD.5.txt +++ b/doc/PKGBUILD.5.txt @@ -131,6 +131,8 @@ downloaded from version control systems (VCS). For more information, see Files in the source array with extensions `.sig`, `.sign` or, `.asc` are recognized by makepkg as PGP signatures and will be automatically used to verify the integrity of the corresponding source file. +Files with extension `.signed-msg` are treated as signed messages, and verified +as such by makepkg. See below (md5sums) for more on how this can be used. *validpgpkeys (array)*:: An array of PGP fingerprints. If this array is non-empty, makepkg will @@ -153,12 +155,29 @@ contain whitespace characters. in place of a normal hash, the integrity check for that source file will be skipped. To easily generate md5sums, run ``makepkg -g >> PKGBUILD''. If desired, move the md5sums line to an appropriate location. ++ +Two special modes can also be manually put in the array in place of a normal +hash: ++ +- 'FILE' can be used to have makepkg get the hash from a checksum file whose +name shall be the name of the source file, plus extension `.md5` A valid +checksum file is a text file with at least one line with the hash, space(s), +then the filename, much like linkman:md5sum[1] output. ++ +- 'SIGNED-MSG' can be used to have makepkg get the hash from a PGP signed +message whose name shall be the name of the source file, plus extension +`.md5.signed-msg` The actual message is expected to be a checksum file (as with +'FILE'), and the signature will be checked alongside other PGP signatures. *sha1sums, sha256sums, sha384sums, sha512sums (arrays)*:: Alternative integrity checks that makepkg supports; these all behave similar to the md5sums option described above. To enable use and generation of these checksums, be sure to set up the `INTEGRITY_CHECK` option in linkman:makepkg.conf[5]. ++ +Special modes 'FILE' and 'SIGNED-MSG' work the same as described above, only +with the appropriate integrity checks used in file names, e.g. extensions +`.sha1` (with 'FILE') or `.sha512.signed-msg` (with 'SIGNED-MSG') *groups (array)*:: An array of symbolic names that represent groups of packages, allowing diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 22679f7..e4a1ec2 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -209,7 +209,7 @@ source_has_signatures() { get_all_sources_for_arch 'all_sources' for file in "${all_sources[@]}"; do - if [[ ${file%%::*} = *.@(sig?(n)|asc) ]]; then + if [[ ${file%%::*} = *.@(sig?(n)|asc|signed-msg) ]]; then return 0 fi done @@ -380,7 +380,7 @@ generate_one_checksum() { sum="SKIP" ;; *) - if [[ $netfile != *.@(sig?(n)|asc) ]]; then + if [[ $netfile != *.@(sig?(n)|asc|signed-msg) ]]; then local file file="$(get_filepath "$netfile")" || missing_source_file "$netfile" sum="$(openssl dgst -${integ} "$file")" @@ -432,20 +432,67 @@ generate_checksums() { verify_integrity_one() { local source_name=$1 integ=$2 expectedsum=$3 + local sumfile tmp - local file="$(get_filename "$source_name")" - printf ' %s ... ' "$file" >&2 + local filename="$(get_filename "$source_name")" + printf ' %s ... ' "$filename" >&2 if [[ $expectedsum = 'SKIP' ]]; then printf '%s\n' "$(gettext "Skipped")" >&2 return fi - if ! file="$(get_filepath "$file")"; then + if ! file="$(get_filepath "$filename")"; then printf '%s\n' "$(gettext "NOT FOUND")" >&2 return 1 fi + if [[ $expectedsum = 'SIGNED-MSG' ]]; then + sumfile="$file.$integ.signed-msg" + if [ ! -e "$sumfile" ]; then + printf '%s: ' "$(gettext "FAILED")" >&2 + printf "$(gettext "%s missing")" "$(get_filename "$sumfile")" >&2 + printf '\n' >&2 + return 1 + fi + tmp=$(mktemp --dry-run) + gpg --quiet --batch --skip-verify --output "$tmp" "$sumfile" 2> /dev/null + if [ $? -ne 0 ]; then + printf '%s: ' "$(gettext "FAILED")" >&2 + printf "$(gettext "%s invalid")" "$(get_filename "$sumfile")" >&2 + printf '\n' >&2 + return 1 + fi + expectedsum='FILE' + fi + + if [[ $expectedsum = 'FILE' ]]; then + if [ -z "$tmp" ]; then + sumfile="$file.$integ" + else + sumfile="$tmp" + fi + if [ ! -e "$sumfile" ]; then + printf '%s: ' "$(gettext "FAILED")" >&2 + printf "$(gettext "%s missing")" "$(get_filename "$sumfile")" >&2 + printf '\n' >&2 + [ -e "$tmp" ] && rm -f "$tmp" + return 1 + fi + local sum="$(grep "$filename" "$sumfile")" + local nb_lf=${sum//[^$'\n']/} + if [[ $nb_lf -gt 0 ]]; then + printf '%s: ' "$(gettext "FAILED")" >&2 + [[ -n "$tmp" ]] && sumfile="$file.$integ.asc" + printf "$(gettext "%s invalid")" "$(get_filename "$sumfile")" >&2 + printf '\n' >&2 + [ -e "$tmp" ] && rm -f "$tmp" + return 1 + fi + expectedsum="${sum%% *}" + fi + [ -e "$tmp" ] && rm -f "$tmp" + local realsum="$(openssl dgst -${integ} "$file")" realsum="${realsum##* }" if [[ ${expectedsum,,} = "$realsum" ]]; then @@ -602,6 +649,7 @@ check_pgpsigs() { local errors=0 local statusfile=$(mktemp) local all_sources + local integ case $1 in all) @@ -613,7 +661,7 @@ check_pgpsigs() { esac for file in "${all_sources[@]}"; do file="$(get_filename "$file")" - if [[ $file != *.@(sig?(n)|asc) ]]; then + if [[ $file != *.@(sig?(n)|asc|signed-msg) ]]; then continue fi @@ -626,29 +674,33 @@ check_pgpsigs() { fi found=0 - for ext in "" gz bz2 xz lrz lzo Z; do - if sourcefile="$(get_filepath "${file%.*}${ext:+.$ext}")"; then - found=1 - break; + if [[ $file = *.signed-msg ]]; then + gpg --quiet --batch --status-file "$statusfile" --verify < "$file" 2> /dev/null + else + for ext in "" gz bz2 xz lrz lzo Z; do + if sourcefile="$(get_filepath "${file%.*}${ext:+.$ext}")"; then + found=1 + break; + fi + done + if (( ! found )); then + printf '%s\n' "$(gettext "SOURCE FILE NOT FOUND")" >&2 + errors=1 + continue fi - done - if (( ! found )); then - printf '%s\n' "$(gettext "SOURCE FILE NOT FOUND")" >&2 - errors=1 - continue - fi - case "$ext" in - gz) decompress="gzip -c -d -f" ;; - bz2) decompress="bzip2 -c -d -f" ;; - xz) decompress="xz -c -d" ;; - lrz) decompress="lrzip -q -d" ;; - lzo) decompress="lzop -c -d -q" ;; - Z) decompress="uncompress -c -f" ;; - "") decompress="cat" ;; - esac + case "$ext" in + gz) decompress="gzip -c -d -f" ;; + bz2) decompress="bzip2 -c -d -f" ;; + xz) decompress="xz -c -d" ;; + lrz) decompress="lrzip -q -d" ;; + lzo) decompress="lzop -c -d -q" ;; + Z) decompress="uncompress -c -f" ;; + "") decompress="cat" ;; + esac - $decompress < "$sourcefile" | gpg --quiet --batch --status-file "$statusfile" --verify "$file" - 2> /dev/null + $decompress < "$sourcefile" | gpg --quiet --batch --status-file "$statusfile" --verify "$file" - 2> /dev/null + fi # these variables are assigned values in parse_gpg_statusfile success=0 status= -- 2.6.2

2 4