- Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH 0/8] [RFC] Signature checking overhaul
by Allan McRae 07 Nov '12

07 Nov '12

The main change here is that pacman will now check the needed keys are in the keyring before doing package validation. Example output: :: Retrieving packages ... systemd-sysvcompat-... 5.4 KiB 671K/s 00:00 [######################] 100% (1/1) checking keys in keyring [######################] 100% :: Import PGP key 2048R/F56C0C53, "Dave Reisner <d(a)falconindy.com>", created: 2011-06-26? [Y/n] (1/1) checking package integrity [######################] 100% (1/1) loading package files [######################] 100% This removed the repeat validation after key downloading and made the following much easier to implement: 1) packages with bad signatures get the "pkg is corrupt, delete?" type message 2) pacman -U now downloads a signature if needed. These patches need a very good review... Allan McRae (8): Make key_in_keychain available in library Move key importing into separate function Add function to extract key id from signatures Make decode_signature available to the library Check keys are in keyring before package validation Remove retry path from signature validation Prompt to delete packages with signature fails Import key if needed when installing package from file lib/libalpm/alpm.h | 9 ++- lib/libalpm/be_package.c | 40 ++++++++++ lib/libalpm/signing.c | 197 ++++++++++++++++++++++++++++++++++++++--------- lib/libalpm/signing.h | 7 ++ lib/libalpm/sync.c | 87 ++++++++++++++++++--- src/pacman/callback.c | 9 +++ 6 files changed, 300 insertions(+), 49 deletions(-) -- 1.8.0

3 14

[pacman-dev] [PATCH 1/2] Restore ability for $PACMAN to include arguments and document it
by Martin Panter 03 Nov '12

03 Nov '12

Unmangled version: https://github.com/vadmium/pacman-arch/commit/70b1327.patch >From 70b1327c0443818d163e10b649ba882a4fd5a0f3 Mon Sep 17 00:00:00 2001 From: Martin Panter <vadmium à gmail·com> Date: Wed, 31 Oct 2012 03:05:42 +0000 Subject: [PATCH] Restore ability for $PACMAN to include arguments and document it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Judging by the “${PACMAN%% *}” incantation from revision 66c6d28 (makepkg: allow to specify an alternative pacman command), it looks like this was consciously intended. Currently, including arguments in $PACMAN means the --syncdeps operation may be attempted, but each Pacman invocation will probably fail. However in other cases the operation would be skipped if $PACMAN cannot be found. Looks like this inconsistency comes from revision 622326b (makepkg: fix sudo/su calling of pacman). --- doc/makepkg.8.txt | 3 ++- scripts/makepkg.sh.in | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/doc/makepkg.8.txt b/doc/makepkg.8.txt index 9d19e38..8b440a3 100644 --- a/doc/makepkg.8.txt +++ b/doc/makepkg.8.txt @@ -196,7 +196,8 @@ Environment Variables The command that will be used to check for missing dependencies and to install and remove packages. Pacman's -Qq, -Rns, -S, -T, and -U operations must be supported by this command. If the variable is not - set or empty, makepkg will fall back to `pacman'. + set or empty, makepkg will fall back to `pacman'. The variable may + include command arguments, separated with spaces. **PKGDEST=**"/path/to/folder":: Folder where the resulting packages will be stored. Overrides the diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index d387b7d..3b4f27f 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -873,9 +873,9 @@ source_has_signatures() { run_pacman() { local cmd if [[ ! $1 = -@(T|Qq) ]]; then - cmd=("$PACMAN" $PACMAN_OPTS "$@") + cmd=($PACMAN $PACMAN_OPTS "$@") else - cmd=("$PACMAN" "$@") + cmd=($PACMAN "$@") fi if (( ! ASROOT )) && [[ ! $1 = -@(T|Qq) ]]; then if type -p sudo >/dev/null; then -- 1.7.12

2 3

[pacman-dev] [PATCH 2/2] Save path to Pacman, which could be lost during --syncdeps operation
by Martin Panter 03 Nov '12

03 Nov '12

Unmangled version: https://github.com/vadmium/pacman-arch/commit/b984a8b.patch Turns out it wasn’t too hard to allow spaces in the path returned from “command -v”, while handling any extra arguments. >From b984a8b2cb3daa05177420d1a9d83648d6c0aa0d Mon Sep 17 00:00:00 2001 From: Martin Panter <vadmium à gmail·com> Date: Wed, 31 Oct 2012 02:45:36 +0000 Subject: [PATCH] Save path to Pacman, which could be lost during --syncdeps operation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Access to the Pacman command could be lost when /etc/profile is invoked and $PATH is reset. Tested to make sure the following scenarios behave sensibly, where “roopwn” is in ~/bin/: PACMAN="pacman --config /etc/pacman.conf" makepkg --syncdeps --install PACMAN="nonexistent --dummy" makepkg --syncdeps --install PACMAN="nonexistent --dummy" makepkg PACMAN="roopwn --verbose" makepkg --syncdeps --install --- scripts/makepkg.sh.in | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 3b4f27f..2b224b8 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -873,9 +873,9 @@ source_has_signatures() { run_pacman() { local cmd if [[ ! $1 = -@(T|Qq) ]]; then - cmd=($PACMAN $PACMAN_OPTS "$@") + cmd=("${PACMAN[@]}" $PACMAN_OPTS "$@") else - cmd=($PACMAN "$@") + cmd=("${PACMAN[@]}" "$@") fi if (( ! ASROOT )) && [[ ! $1 = -@(T|Qq) ]]; then if type -p sudo >/dev/null; then @@ -898,7 +898,7 @@ check_deps() { if (( ret == 127 )); then #unresolved deps printf "%s\n" "$pmout" elif (( ret )); then - error "$(gettext "'%s' returned a fatal error (%i): %s")" "$PACMAN" "$ret" "$pmout" + error "$(gettext "'%s' returned a fatal error (%i): %s")" "${PACMAN[*]}" "$ret" "$pmout" return "$ret" fi } @@ -920,7 +920,7 @@ handle_deps() { msg "$(gettext "Installing missing dependencies...")" if ! run_pacman -S --asdeps $deplist; then - error "$(gettext "'%s' failed to install missing dependencies.")" "$PACMAN" + error "$(gettext "'%s' failed to install missing dependencies.")" "${PACMAN[*]}" exit 1 # TODO: error code fi fi @@ -1899,9 +1899,9 @@ install_package() { (( ! INSTALL )) && return if (( ! SPLITPKG )); then - msg "$(gettext "Installing package %s with %s...")" "$pkgname" "$PACMAN -U" + msg "$(gettext "Installing package %s with %s...")" "$pkgname" "${PACMAN[*]} -U" else - msg "$(gettext "Installing %s package group with %s...")" "$pkgbase" "$PACMAN -U" + msg "$(gettext "Installing %s package group with %s...")" "$pkgbase" "${PACMAN[*]} -U" fi local fullver pkgarch pkg pkglist @@ -2457,8 +2457,9 @@ if [[ $MAKEPKG_CONF = "$confdir/makepkg.conf" && -r ~/.makepkg.conf ]]; then source_safe ~/.makepkg.conf fi -# set pacman command if not already defined -PACMAN=${PACMAN:-pacman} +# Set pacman command if not already defined. Convert to Bash array so that +# spaces can be included in the path while any arguments are retained. +PACMAN=(${PACMAN:-pacman}) # check if messages are to be printed using color unset ALL_OFF BOLD BLUE GREEN RED YELLOW @@ -2728,7 +2729,11 @@ if (( NODEPS || (NOBUILD && !DEP_BIN ) )); then if (( NODEPS )); then warning "$(gettext "Skipping dependency checks.")" fi -elif type -p "${PACMAN%% *}" >/dev/null; then +elif output="$(command -v "$PACMAN")"; then + # Save full path to Pacman in case the --syncdeps operation modifies + # the $PATH and makes it inaccessible + PACMAN="$output" + if (( RMDEPS && ! INSTALL )); then original_pkglist=($(run_pacman -Qq)) # required by remove_dep fi @@ -2757,7 +2762,7 @@ elif type -p "${PACMAN%% *}" >/dev/null; then exit 1 fi else - warning "$(gettext "%s was not found in %s; skipping dependency checks.")" "${PACMAN%% *}" "PATH" + warning "$(gettext "%s was not found in %s; skipping dependency checks.")" "$PACMAN" "PATH" fi # ensure we have a sane umask set -- 1.7.12

3 6

[pacman-dev] Tar backend for local db
by Allan McRae 01 Nov '12

01 Nov '12

I was thinking about the local database backend in pacman and how we could improve it. The tar-based backed for sync dbs have been quite a success. Ever since we did that, I have been wanting to do the same with the local database. But there were two issues: 1) tar is not designed for removing and updating files in place 2) with a directory/files per package structure, we are quite robust to corruption as a single file effects only a single package. Well... I have a cunning plan... How about we do both! Have the local database in a tarball but also extracted. All reading is done from the tarball, so -Q operations would be fast due to not require reading from lots of small files. With an operation that adds/removes/updates a package, the local database is still read from the tarball, but the modifications are done on the files backend and then the tarball is recreated at the end. We could even be efficient during the recreation and read all the old files from the old tarball and only read the new files from the filesystem (which will be in the kernel cache...). This would also give another use for "pacman -D" - an option could be added to recreate the local db tarball - in case it became corrupt or the files were manually edited. What do people think?

8 12

[pacman-dev] Fwd: [PATCH] Hack to detect Pacman-command-no-found error
by Martin Panter 31 Oct '12

31 Oct '12

[Resending after subscribing my address. If this works perhaps a note should be added saying you have to subscribe to be able to send to the list?] Original [patch] in case it gets garbled: https://github.com/vadmium/pacman-arch/commit/0a71ece.patch If the spirit of the change is appropriate but you’re not happy about using the ”test” command, I’m happy to learn how to use the Bash-specific way with double square brackets. Or someone who already knows can translate it :) >From 0a71ece90951894953ffd7bae741d69af927bf3f Mon Sep 17 00:00:00 2001 From: Martin Panter <vadmium à gmail·com> Date: Thu, 18 Oct 2012 06:31:07 +0000 Subject: [PATCH] Hack to detect Pacman-command-no-found error Bash also uses exit code 127 for command-not-found errors, which can occur if we lose access to the command given by $PACMAN. For instance after invoking /etc/profile, $PATH may be reset. --- scripts/makepkg.sh.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index d387b7d..307ceeb 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -895,7 +895,7 @@ check_deps() { pmout=$(run_pacman -T "$@") ret=$? - if (( ret == 127 )); then #unresolved deps + if test "$ret" -eq 127 -a -n "$pmout"; then #unresolved deps printf "%s\n" "$pmout" elif (( ret )); then error "$(gettext "'%s' returned a fatal error (%i): %s")" "$PACMAN" "$ret" "$pmout" -- 1.7.12

2 3

[pacman-dev] Changing from double quotes to single quotes
by Alexander Rødseth 30 Oct '12

30 Oct '12

Hi, Patch 1 and 4 are for changing quotes from double to single for the pkgdesc in PKGBUILD.proto and PKGBUILD-split.proto. Since few packages perform variable replacement in the package description, I think it would make sense to make single quotes the default. Patch 2 is for doing the same for the url. Patch 3 and 5 are for removing quotes when using cd and make. I was informed that this is safe to do when using $pkgdir. Best regards, Alexander Rødseth

4 14

[pacman-dev] Getting fingerprint of key used to make signature
by Allan McRae 29 Oct '12

29 Oct '12

Can anyone figure out how to take the PGP signature and extract the key ID used to make it in gpgme _without_ completely verifying the signature? Allan

1 0

[pacman-dev] [PATCH] Do not warn about missing database if being downloaded
by Allan McRae 29 Oct '12

29 Oct '12

When a configured repo database is not already downloaded, a warning message such as "warning: database file for 'testing' does not exist" is printed. Disable this warning when the database is scheduled to be downloaded in the transaction. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- lib/libalpm/alpm.h | 4 +++- lib/libalpm/be_sync.c | 3 +-- src/pacman/callback.c | 6 ++++++ 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index 66cd6b0..fb4d845 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -358,7 +358,9 @@ typedef enum _alpm_event_t { ALPM_EVENT_DISKSPACE_DONE, /** An optdepend for another package is being removed * The requiring package and its dependency are passed to the callback */ - ALPM_EVENT_OPTDEP_REQUIRED + ALPM_EVENT_OPTDEP_REQUIRED, + /** A configured repository database is missing */ + ALPM_EVENT_DATABASE_MISSING } alpm_event_t; /** Event callback */ diff --git a/lib/libalpm/be_sync.c b/lib/libalpm/be_sync.c index 033f8b7..f980246 100644 --- a/lib/libalpm/be_sync.c +++ b/lib/libalpm/be_sync.c @@ -89,8 +89,7 @@ static int sync_db_validate(alpm_db_t *db) if(_alpm_access(db->handle, NULL, dbpath, R_OK) != 0 && errno == ENOENT) { db->status &= ~DB_STATUS_EXISTS; db->status |= DB_STATUS_MISSING; - _alpm_log(db->handle, ALPM_LOG_WARNING, - "database file for '%s' does not exist\n", db->treename); + EVENT(db->handle, ALPM_EVENT_DATABASE_MISSING, db->treename, NULL); goto valid; } db->status |= DB_STATUS_EXISTS; diff --git a/src/pacman/callback.c b/src/pacman/callback.c index a51aa4b..a249a6e 100644 --- a/src/pacman/callback.c +++ b/src/pacman/callback.c @@ -243,6 +243,12 @@ void cb_event(alpm_event_t event, void *data1, void *data2) printf(_(":: %s optionally requires %s\n"), alpm_pkg_get_name(data1), alpm_dep_compute_string(data2)); break; + case ALPM_EVENT_DATABASE_MISSING: + if(!config->op_s_sync) { + pm_printf(ALPM_LOG_WARNING, + "database file for '%s' does not exist\n", (char *)data1); + } + break; /* all the simple done events, with fallthrough for each */ case ALPM_EVENT_FILECONFLICTS_DONE: case ALPM_EVENT_CHECKDEPS_DONE: -- 1.8.0

1 0

[pacman-dev] [PATCH] pactree: unindent first limb
by Andrew Gregory 26 Oct '12

26 Oct '12

Removing the leader for the toplevel package shifted the name left but not it's limb. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> --- For the pactree-cleanup branch. src/util/pactree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/pactree.c b/src/util/pactree.c index 7b8fd93..0c1710f 100644 --- a/src/util/pactree.c +++ b/src/util/pactree.c @@ -336,7 +336,7 @@ static void print_text(const char *pkg, const char *provision, tdepth *depth, int last) { const char* tip = ""; - int level = 0; + int level = 1; if(!pkg && !provision) { /* not much we can do */ return; -- 1.8.0

1 0

[pacman-dev] [PATCH] makepkg: use --apparent-size when du supports it
by Allan McRae 23 Oct '12

23 Oct '12

Amazingly, using "sleep 1" to convince btrfs to report correct file sizes is only a 90% fix. Sometimes more sleep is needed. Instead we use the --apparent-size argument to du to get actual file sizes. This is used only on Linux as the various BSDs do not support this argument. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- configure.ac | 2 ++ scripts/Makefile.am | 1 + scripts/makepkg.sh.in | 7 +------ 3 files changed, 4 insertions(+), 6 deletions(-) diff --git a/configure.ac b/configure.ac index 03fb015..2323669 100644 --- a/configure.ac +++ b/configure.ac @@ -300,11 +300,13 @@ GCC_GNU89_INLINE_CC INODECMD="stat -c '%i %n'" SIZECMD="stat -c %s" SEDINPLACE="sed -i" +DUFLAGS="-sk --apparent-size" case "${host_os}" in *bsd*) INODECMD="stat -f '%i %n'" SIZECMD="stat -f %z" SEDINPLACE="sed -i \"\"" + DUFLAGS="-sk" ;; esac diff --git a/scripts/Makefile.am b/scripts/Makefile.am index 2bd6411..da7047b 100644 --- a/scripts/Makefile.am +++ b/scripts/Makefile.am @@ -58,6 +58,7 @@ edit = sed \ -e 's|@SIZECMD[@]|$(SIZECMD)|g' \ -e 's|@SEDINPLACE[@]|$(SEDINPLACE)|g' \ -e 's|@DUPATH[@]|$(DUPATH)|g' \ + -e 's|@DUFLAGS[@]|$(DUFLAGS)|g' \ -e 's|@SCRIPTNAME[@]|$@|g' \ -e 's|@configure_input[@]|Generated from $@.sh.in; do not edit by hand.|g' diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 5822843..1e9068b 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -1704,12 +1704,7 @@ write_pkginfo() { local packager="Unknown Packager" fi - # btrfs's delayed allocation causes the stat buffers from the kernel to "lie" - # to us momentarily and report 0 blocks allocated (which is how du calculates - # size). Sleeping for a second here is about the dirtiest thing possible, - # but avoids reporting entirely bogus install sizes. - sleep 1 - local size="$(@DUPATH@ -sk)" + local size="$(@DUPATH@ @DUFLAGS@)" size="$(( ${size%%[^0-9]*} * 1024 ))" msg2 "$(gettext "Generating %s file...")" ".PKGINFO" -- 1.8.0

1 0