- Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH] Added check option to BUILDENV array in makepkg.conf man page
by Eric Bélanger 14 Jun '11

14 Jun '11

Signed-off-by: Eric Bélanger <snowmaniscool(a)gmail.com> --- doc/makepkg.conf.5.txt | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/doc/makepkg.conf.5.txt b/doc/makepkg.conf.5.txt index 6130249..30ddf0a 100644 --- a/doc/makepkg.conf.5.txt +++ b/doc/makepkg.conf.5.txt @@ -70,7 +70,7 @@ Options This is often used to set the number of jobs used, for example, `-j2`. Other flags that make accepts can also be passed. -**BUILDENV=(**fakeroot !distcc color !ccache**)**:: +**BUILDENV=(**fakeroot !distcc color !ccache check**)**:: This array contains options that affect the build environment, the defaults are shown here. All options should always be left in the array; to enable or disable an option simply remove or place an ``!'' at the front of the -- 1.7.5.4

2 1

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v3.5.3-220-gfb3ad7f
by dan＠archlinux.org 14 Jun '11

14 Jun '11

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via fb3ad7f8823dd3300528b44427d40e17594b1400 (commit) via 01ad3faee934aa805237bf5405e7c74dc1482a17 (commit) via bcd442761b56ca6cce07af2364e724271d917a74 (commit) via c5761bfe4121616a19f9a175d28731a60c3c7868 (commit) from ff7ad5fd7376c133bc646c4d69d06019e0b64044 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit fb3ad7f8823dd3300528b44427d40e17594b1400 Author: Dan McGee <dan(a)archlinux.org> Date: Thu Jun 9 16:00:55 2011 -0500 Add handle argument to alpm_(add|remove)_pkg() This makes these functions consistent with the rest of the transaction related API calls. We do an additional assert to ensure the handle attached to the package is the same as the handle passed in. Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 01ad3faee934aa805237bf5405e7c74dc1482a17 Author: Kerrick Staley <mail(a)kerrickstaley.com> Date: Sun Jun 12 05:20:08 2011 -0500 Added initialization code for database siglevel The siglevel field of a newly created pmdb_t struct is now initialized when it is created in _alpm_db_new(). Signed-off-by: Kerrick Staley <mail(a)kerrickstaley.com> Signed-off-by: Dan McGee <dan(a)archlinux.org> commit bcd442761b56ca6cce07af2364e724271d917a74 Author: Dan McGee <dan(a)archlinux.org> Date: Mon Jun 13 17:36:57 2011 -0500 Fix memory leak if package sig was invalid Signed-off-by: Dan McGee <dan(a)archlinux.org> commit c5761bfe4121616a19f9a175d28731a60c3c7868 Author: Dan McGee <dan(a)archlinux.org> Date: Mon Jun 13 17:43:09 2011 -0500 Fix all current return(x) usages A few of these snuck in as of late, some from the table display patches that were using the previous format before we changed it after the 3.5.X major release. Noticed-by: Kerrick Staley <mail(a)kerrickstaley.com> Signed-off-by: Dan McGee <dan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: lib/libalpm/add.c | 13 +++++++------ lib/libalpm/alpm.h | 6 ++++-- lib/libalpm/be_package.c | 1 + lib/libalpm/db.c | 5 +++-- lib/libalpm/remove.c | 6 ++++-- src/pacman/query.c | 2 +- src/pacman/remove.c | 4 ++-- src/pacman/sync.c | 2 +- src/pacman/upgrade.c | 2 +- src/pacman/util.c | 18 +++++++++--------- 10 files changed, 33 insertions(+), 26 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [PATCH] dload: handle irregular URLs
by Dave Reisner 13 Jun '11

13 Jun '11

URLs might end with a slash and follow redirects, or could be a generated by a script such as /getpkg.php?id=12345. In both cases, we may have a better filename that we can write to, taken from either content-disposition header, or the effective URL. Specific to the first case, we write to a temporary file of the format 'alpmtmp.XXXXXX', where XXXXXX is randomized by mkstemp(3). Since this is a randomly generated file, we cannot support resuming and the file is unlinked in the event of an interrupt. We also run into the possibility of changing out the filename from under alpm on a -U operation, so callers of _alpm_download can optionally pass a pointer to a *char to be filled in by curl_download_internal with the actual filename we wrote to. Any sync operation will pass a NULL pointer here, as we rely on specific names for packages from a mirror. Fixes FS#22645. Signed-off-by: Dave Reisner <d(a)falconindy.com> --- There's one hack in here that I'm not happy with, so feedback is welcome. Basically, the signature file is guaranteed to have a length, because we simply append '.sig' to the URL. In the case of a URL ending with a /, this results in downloading a file called '.sig'. This patchwork hardcodes the edge case and forces the use of a temporary file. It's not ideal, but it works. Any other comments are also, of course, welcome. d lib/libalpm/be_sync.c | 4 +- lib/libalpm/dload.c | 120 ++++++++++++++++++++++++++++++++++++++++++------- lib/libalpm/dload.h | 2 +- lib/libalpm/sync.c | 2 +- 4 files changed, 107 insertions(+), 21 deletions(-) diff --git a/lib/libalpm/be_sync.c b/lib/libalpm/be_sync.c index a75cbda..c12fff1 100644 --- a/lib/libalpm/be_sync.c +++ b/lib/libalpm/be_sync.c @@ -127,7 +127,7 @@ int SYMEXPORT alpm_db_update(int force, pmdb_t *db) CALLOC(fileurl, len, sizeof(char), RET_ERR(PM_ERR_MEMORY, -1)); snprintf(fileurl, len, "%s/%s.db", server, db->treename); - ret = _alpm_download(fileurl, syncpath, force, 0, 0); + ret = _alpm_download(fileurl, syncpath, NULL, force, 0, 0); if(ret == 0 && (check_sig == PM_PGP_VERIFY_ALWAYS || check_sig == PM_PGP_VERIFY_OPTIONAL)) { @@ -135,7 +135,7 @@ int SYMEXPORT alpm_db_update(int force, pmdb_t *db) /* if we downloaded a DB, we want the .sig from the same server */ snprintf(fileurl, len, "%s/%s.db.sig", server, db->treename); - sig_ret = _alpm_download(fileurl, syncpath, 1, 0, errors_ok); + sig_ret = _alpm_download(fileurl, syncpath, NULL, 1, 0, errors_ok); /* errors_ok suppresses error messages, but not the return code */ sig_ret = errors_ok ? 0 : sig_ret; } diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index 0ba3bc1..b37ca02 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -152,15 +152,45 @@ static int utimes_long(const char *path, long time) return 0; } +static size_t parse_headers(void *ptr, size_t size, size_t nmemb, void *user) +{ + size_t realsize = size * nmemb; + const char *fptr, *endptr = NULL; + const char * const cd_header = "Content-Disposition:"; + const char * const fn_key = "filename="; + char **cd_filename = (char**)user; + + if(strncasecmp(cd_header, ptr, strlen(cd_header)) == 0) { + if((fptr = strstr(ptr, fn_key))) { + fptr += strlen(fn_key); + + /* find the end of the field, which is either a semi-colon, or the end of + * the data. As per curl_easy_setopt(3), we cannot count on headers being + * null terminated, so we look for the closing \r\n */ + endptr = fptr + strcspn(fptr, ";\r\n") - 1; + + /* remove quotes */ + if(*fptr == '"' && *endptr == '"') { + fptr++; + endptr--; + } + + STRNDUP(*cd_filename, fptr, endptr - fptr + 1, RET_ERR(PM_ERR_MEMORY, realsize)); + } + } + + return realsize; +} static int curl_download_internal(const char *url, const char *localpath, - int force, int allow_resume, int errors_ok) + char **final_file, int force, int allow_resume, int errors_ok) { - int ret = -1; + int ret = -1, should_unlink = 0; FILE *localf = NULL; const char *useragent; const char *open_mode = "wb"; - char *destfile, *tempfile; + char *destfile = NULL, *tempfile = NULL, *effective_url; + char *cd_filename = NULL; /* filename from content-disposition header */ /* RFC1123 states applications should support this length */ char hostname[256]; char error_buffer[CURL_ERROR_SIZE]; @@ -177,10 +207,31 @@ static int curl_download_internal(const char *url, const char *localpath, RET_ERR(PM_ERR_SERVER_BAD_URL, -1); } - destfile = get_fullpath(localpath, dlfile.filename, ""); - tempfile = get_fullpath(localpath, dlfile.filename, ".part"); - if(!destfile || !tempfile) { - goto cleanup; + if(strlen(dlfile.filename) > 0 && strcmp(dlfile.filename, ".sig") != 0) { + destfile = get_fullpath(localpath, dlfile.filename, ""); + tempfile = get_fullpath(localpath, dlfile.filename, ".part"); + if(!destfile || !tempfile) { + goto cleanup; + } + } else { /* URL isn't to a file and ended with a slash */ + int fd; + char randpath[PATH_MAX]; + + /* we can't support resuming this kind of download, so a partial transfer + * will be destroyed */ + should_unlink = 1; + + /* create a random filename, which is opened with O_EXCL */ + snprintf(randpath, PATH_MAX, "%salpmtmp.XXXXXX", localpath); + if((fd = mkstemp(randpath)) == -1 || !(localf = fdopen(fd, "w+"))) { + unlink(randpath); + close(fd); + _alpm_log(PM_LOG_ERROR, _("failed to create temporary file for download\n")); + goto cleanup; + } + /* localf now points to our alpmtmp.XXXXXX */ + STRDUP(tempfile, randpath, RET_ERR(PM_ERR_MEMORY, -1)); + dlfile.filename = strrchr(randpath, '/') + 1; } error_buffer[0] = '\0'; @@ -199,6 +250,8 @@ static int curl_download_internal(const char *url, const char *localpath, curl_easy_setopt(handle->curl, CURLOPT_PROGRESSDATA, (void *)&dlfile); curl_easy_setopt(handle->curl, CURLOPT_LOW_SPEED_LIMIT, 1024L); curl_easy_setopt(handle->curl, CURLOPT_LOW_SPEED_TIME, 10L); + curl_easy_setopt(handle->curl, CURLOPT_HEADERFUNCTION, parse_headers); + curl_easy_setopt(handle->curl, CURLOPT_WRITEHEADER, &cd_filename); useragent = getenv("HTTP_USER_AGENT"); if(useragent != NULL) { @@ -217,9 +270,11 @@ static int curl_download_internal(const char *url, const char *localpath, dlfile.initial_size = (double)st.st_size; } - localf = fopen(tempfile, open_mode); if(localf == NULL) { - goto cleanup; + localf = fopen(tempfile, open_mode); + if(localf == NULL) { + goto cleanup; + } } curl_easy_setopt(handle->curl, CURLOPT_WRITEDATA, localf); @@ -266,6 +321,7 @@ static int curl_download_internal(const char *url, const char *localpath, curl_easy_getinfo(handle->curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD, &remote_size); curl_easy_getinfo(handle->curl, CURLINFO_SIZE_DOWNLOAD, &bytes_dl); curl_easy_getinfo(handle->curl, CURLINFO_CONDITION_UNMET, &timecond); + curl_easy_getinfo(handle->curl, CURLINFO_EFFECTIVE_URL, &effective_url); /* time condition was met and we didn't download anything. we need to * clean up the 0 byte .part file that's left behind. */ @@ -286,6 +342,26 @@ static int curl_download_internal(const char *url, const char *localpath, goto cleanup; } + if(cd_filename) { + /* content-disposition header has a better name for our file */ + free(destfile); + destfile = get_fullpath(localpath, cd_filename, ""); + } else { + const char *effective_filename = strrchr(effective_url, '/'); + if(effective_filename) { + effective_filename++; + + /* if destfile was never set, we wrote to a tempfile. even if destfile is + * set, we may have followed some redirects and the effective url may + * have a better suggestion as to what to name our file. in either case, + * refactor destfile to this newly derived name. */ + if(!destfile || strcmp(effective_filename, strrchr(destfile, '/') + 1) != 0) { + free(destfile); + destfile = get_fullpath(localpath, effective_filename, ""); + } + } + } + ret = 0; cleanup: @@ -296,10 +372,18 @@ cleanup: if(ret == 0) { rename(tempfile, destfile); + if(final_file) { + *final_file = strdup(strrchr(destfile, '/') + 1); + } + } + + if(dload_interrupted && should_unlink) { + unlink(tempfile); } FREE(tempfile); FREE(destfile); + FREE(cd_filename); /* restore the old signal handlers */ sigaction(SIGINT, &sig_int[OLD], NULL); @@ -313,12 +397,13 @@ cleanup: } #endif -int _alpm_download(const char *url, const char *localpath, +int _alpm_download(const char *url, const char *localpath, char **final_file, int force, int allow_resume, int errors_ok) { if(handle->fetchcb == NULL) { #ifdef HAVE_LIBCURL - return curl_download_internal(url, localpath, force, allow_resume, errors_ok); + return curl_download_internal(url, localpath, final_file, force, allow_resume, + errors_ok); #else RET_ERR(PM_ERR_EXTERNAL_DOWNLOAD, -1); #endif @@ -335,16 +420,15 @@ int _alpm_download(const char *url, const char *localpath, char SYMEXPORT *alpm_fetch_pkgurl(pmhandle_t *handle, const char *url) { char *filepath; - const char *filename, *cachedir; + const char *cachedir; + char *final_file = NULL; int ret; - filename = get_filename(url); - /* find a valid cache dir to download to */ cachedir = _alpm_filecache_setup(handle); /* download the file */ - ret = _alpm_download(url, cachedir, 0, 1, 0); + ret = _alpm_download(url, cachedir, &final_file, 0, 1, 0); if(ret == -1) { _alpm_log(PM_LOG_WARNING, _("failed to download %s\n"), url); return NULL; @@ -362,7 +446,7 @@ char SYMEXPORT *alpm_fetch_pkgurl(pmhandle_t *handle, const char *url) CALLOC(sig_url, len, sizeof(char), RET_ERR(PM_ERR_MEMORY, NULL)); snprintf(sig_url, len, "%s.sig", url); - ret = _alpm_download(sig_url, cachedir, 1, 0, errors_ok); + ret = _alpm_download(sig_url, cachedir, &final_file, 1, 0, errors_ok); if(ret == -1 && !errors_ok) { _alpm_log(PM_LOG_WARNING, _("failed to download %s\n"), sig_url); /* Warn now, but don't return NULL. We will fail later during package @@ -374,7 +458,9 @@ char SYMEXPORT *alpm_fetch_pkgurl(pmhandle_t *handle, const char *url) } /* we should be able to find the file the second time around */ - filepath = _alpm_filecache_find(handle, filename); + filepath = _alpm_filecache_find(handle, final_file); + FREE(final_file); + return filepath; } diff --git a/lib/libalpm/dload.h b/lib/libalpm/dload.h index f4fd14c..c5d05b0 100644 --- a/lib/libalpm/dload.h +++ b/lib/libalpm/dload.h @@ -32,7 +32,7 @@ struct fileinfo { }; int _alpm_download(const char *url, const char *localpath, - int force, int allow_resume, int errors_ok); + char **final_file, int force, int allow_resume, int errors_ok); #endif /* _ALPM_DLOAD_H */ diff --git a/lib/libalpm/sync.c b/lib/libalpm/sync.c index 16be6d9..12a8c90 100644 --- a/lib/libalpm/sync.c +++ b/lib/libalpm/sync.c @@ -794,7 +794,7 @@ static int download_files(pmhandle_t *handle, alpm_list_t **deltas) CALLOC(fileurl, len, sizeof(char), RET_ERR(PM_ERR_MEMORY, -1)); snprintf(fileurl, len, "%s/%s", server_url, filename); - ret = _alpm_download(fileurl, cachedir, 0, 1, 0); + ret = _alpm_download(fileurl, cachedir, NULL, 0, 1, 0); FREE(fileurl); if(ret != -1) { break; -- 1.7.5.4

2 2

Re: [pacman-dev] GPG remote signing
by Kerrick Staley 13 Jun '11

13 Jun '11

On Fri, Jun 10, 2011 at 5:45 PM, Dan McGee <dpmcgee(a)gmail.com> wrote: > I've done a fair amount of research on what we might be able to do > with this during the afternoon here. Some observations below. This is > mainly addressing point four in Thomas' prior email > (http://mailman.archlinux.org/mailman/private/arch-dev/2011-May/014193.html) Could you please explain what the situation is? I do not have access to the arch-dev archives. In particular, what do you mean by "location A" and "location B"? You want developers to be able to sign databases without copying them to their local machines, correct? I vote for (4), then. (1) provides complete security against an attacker with access to the main server, but it may be hassling. (2), (3), and (4) ultimately don't provide any security against an attacker with access to the main server (at least until the attack is discovered), but with (2) and (3) keys will need to be revoked after an attack (the developer's and the server's, respectively), whereas with (4) nothing will have to be done (except secure the server). Also, an attack against (4) would probably be harder to mount for the attacker and easier to notice for the developers. It seems there will be a locking issue as Denis mentions, but I don't fully understand the problem, so I can't say. -Kerrick Staley By the way, an (overdue) disclaimer: I'm just an idiot with no formal background in cryptographic systems, so I don't necessarily know what I'm talking about.

4 5

Re: [pacman-dev] Finishing off the package signing issue -- Update
by Kerrick Staley 12 Jun '11

12 Jun '11

I inadvertently broke my email account when I configured git-send-mail, and I only just realized it. Everything I've sent to the list since then didn't go through, so I'm resending this message, originally sent June 6. On Wed, Jun 1, 2011 at 3:59 PM, Dan McGee <dpmcgee(a)gmail.com> wrote: > * Lazy DB loading makes things much more difficult. I'm not willing to > sacrifice this for signing, so striking a balance between when we > check sigs and ensuring frontends (and our backend code!) are well > aware the database won't be loaded due to a failed signature check is > really important. This is probably the single biggest blocker, and > perhaps why those not involved until now seem to think this is going > at a snail's pace. If you'd like to see how big of a task this is, I > will send my three different approaches in various stages of > completion to the mailing list, none of which I am super happy with. Can you please send this code, and elaborate a little more on the problem? > * Architecting checks to be done in parallel in the future; we had a > demo patchset posted for this when only doing md5 checks but I want to > make sure we can do this again later for all types of package > verification. I think once we have a solution for the trustdb locking issue, parallel signature checking won't be hard. Thanks, Kerrick Staley

1 0

[pacman-dev] [PATCH] doc/PKGBUILD: misc changes
by Florian Pritz 11 Jun '11

11 Jun '11

Signed-off-by: Florian Pritz <bluewind(a)xinu.at> --- doc/PKGBUILD.5.txt | 81 +++++++++++++++++++++++++-------------------------- 1 files changed, 40 insertions(+), 41 deletions(-) diff --git a/doc/PKGBUILD.5.txt b/doc/PKGBUILD.5.txt index c0fa594..dab81e8 100644 --- a/doc/PKGBUILD.5.txt +++ b/doc/PKGBUILD.5.txt @@ -16,12 +16,12 @@ PKGBUILD Description ----------- -This manual page is meant to describe general rules about PKGBUILDs. Once a +This manual page describes general rules about PKGBUILDs. Once a PKGBUILD is written, the actual package is built using makepkg and installed with pacman. -NOTE: An example PKGBUILD, useful for reference, is located in '{pkgdatadir}'. -Also located there are other example files such as a ChangeLog and an install +NOTE: An example PKGBUILD, useful for reference, is located in '{pkgdatadir}' +along with other example files such as a ChangeLog and an install script. You can copy the provided PKGBUILD.proto file to a new package build directory and make customizations to suit your needs. @@ -30,18 +30,18 @@ Options and Directives ---------------------- The following is a list of standard options and directives available for use in a PKGBUILD. These are all understood and interpreted by makepkg, and most -will be directly transferred to the built package. +of them will be directly transferred to the built package. If you need to create any custom variables for use in your build process, it is -recommended to name your custom variables with an '_' (underscore) prefix. +recommended to prefix their name with an '_' (underscore). This will prevent any possible name clashes with internal makepkg variables. For example, to store the base kernel version in a variable, use something similar to `$_basekernver`. *pkgname (array)*:: - The name of the package. This has be a unix-friendly name as it will be - used in the package filename. Members of the array are not allowed to start - with hyphens. + The name of the package or an array of names for split packages. + Because it will be used in the package filename, this has to be unix-friendly. + Members of the array are not allowed to start with hyphens. *pkgver*:: The version of the software as released from the author (e.g. '2.7.1'). @@ -50,13 +50,13 @@ similar to `$_basekernver`. *pkgrel*:: This is the release number specific to the Arch Linux release. This allows package maintainers to make updates to the package's configure - flags, for example. A pkgrel of '1' is typically used for each upstream - software release and is incremented for intermediate PKGBUILD updates. The + flags, for example. This is typically (re)set to '1' for each new upstream + software release and incremented for intermediate PKGBUILD updates. The variable is not allowed to contain hyphens. *pkgdesc*:: This should be a brief description of the package and its functionality. - Try to keep the description to one line of text. + Try to keep the description to one line of text and not use the package's name. *epoch*:: Used to force the package to be seen as newer than any previous versions @@ -69,18 +69,18 @@ similar to `$_basekernver`. *url*:: This field contains a URL that is associated with the software being - packaged. This is typically the project's website. + packaged. Typically the project's website. *license (array)*:: This field specifies the license(s) that apply to the package. - Commonly-used licenses are found in '/usr/share/licenses/common'. If you + Commonly used licenses can be found in '/usr/share/licenses/common'. If you see the package's license there, simply reference it in the license field (e.g. `license=('GPL')`). If the package provides a license not - found in '/usr/share/licenses/common', then you should include the license + available in '/usr/share/licenses/common', then you should include it in the package itself and set `license=('custom')` or `license=('custom:LicenseName')`. The license should be placed in - '$pkgdir/usr/share/licenses/$pkgname' when building the package. If - multiple licenses are applicable for a package, list all of them: + '$pkgdir/usr/share/licenses/$pkgname/' when building the package. If + multiple licenses are applicable, list all of them: `license=('GPL' 'FDL')`. *install*:: @@ -97,22 +97,21 @@ similar to `$_basekernver`. *source (array)*:: An array of source files required to build the package. Source files - must either reside in the same directory as the PKGBUILD file, or be a - fully-qualified URL that makepkg will use to download the file. In order - to make the PKGBUILD as useful as possible, use the $pkgname and $pkgver - variables if possible when specifying the download location. Any files - that are compressed will automatically be extracted, unless found in - the noextract array listed below. + must either reside in the same directory as the PKGBUILD, or be a + fully-qualified URL that makepkg can use to download the file. + To make the PKGBUILD as useful as possible, use the $pkgname and $pkgver + variables if possible when specifying the download location. Compressed files + will be extracted automatically, unless found in + the noextract array described below. + -It is also possible to specify an optional filename, which is helpful +It is also possible to overwrite the filename, which is helpful with weird URLs and for handling multiple source files with the same name. The syntax is: `source=('filename::url')`. *noextract (array)*:: An array of filenames corresponding to those from the source array. Files listed here will not be extracted with the rest of the source files. This - is useful for packages which use compressed data which is downloaded but - not necessary to uncompress. + is useful for packages that use compressed data directly. *md5sums (array)*:: This array contains an MD5 hash for every source file specified in the @@ -135,16 +134,16 @@ name. The syntax is: `source=('filename::url')`. *arch (array)*:: Defines on which architectures the given package is available (e.g. `arch=('i686' 'x86_64')`). Packages that contain no architecture specific - files may use arch=('any'). + files should use arch=('any'). *backup (array)*:: - A space-delimited array of filenames, without preceding slashes, that + An array of filenames, without preceding slashes, that should be backed up if the package is removed or upgraded. This is commonly used for packages placing configuration files in /etc. See Handling Config Files in linkman:pacman[8] for more information. *depends (array)*:: - An array of packages that this package depends on to run. Packages in + An array of packages this package depends on to run. Entries in this list should be surrounded with single quotes and contain at least the package name. Entries can also include a version requirement of the form 'name<>version', where <> is one of five comparisons: >= (greater @@ -152,12 +151,12 @@ name. The syntax is: `source=('filename::url')`. than), or < (less than). *makedepends (array)*:: - An array of packages that this package depends on to build, but are not + An array of packages this package depends on to build, but are not needed at runtime. Packages in this list follow the same format as depends. *checkdepends (array)*:: - An array of packages that this package depends on to run its test suite, + An array of packages this package depends on to run its test suite, but are not needed at runtime. Packages in this list follow the same format as depends. These dependencies are only considered when the check() function is present and is to be run by makepkg. @@ -177,7 +176,7 @@ name. The syntax is: `source=('filename::url')`. same format as depends. Versioned conflicts are also supported. *provides (array)*:: - An array of ``virtual provisions'' that this package provides. This allows + An array of ``virtual provisions'' this package provides. This allows a package to provide dependencies other than its own package name. For example, the dcron package can provide 'cron', which allows packages to depend on 'cron' rather than 'dcron OR fcron'. @@ -188,7 +187,7 @@ name. The syntax is: `source=('filename::url')`. provided. *replaces (array)*:: - An array of packages that this package should replace, and can be used + An array of packages this package should replace. This can be used to handle renamed/combined packages. For example, if the 'j2re' package is renamed to 'jre', this directive allows future upgrades to continue as expected even though the package has moved. Sysupgrade is currently @@ -248,7 +247,7 @@ name. The syntax is: `source=('filename::url')`. build() Function ---------------- -In addition to the above directives, the optional build() bash function usually +In addition to the above directives, the optional build() function usually comprises the remainder of the PKGBUILD. This is directly sourced and executed by makepkg, so anything that bash or the system has available is available for use here. The function is run in `bash -e` mode, meaning any command that exits @@ -256,22 +255,22 @@ with a non-zero status will cause the function to exit. Be sure any exotic commands used are covered by `makedepends`. All of the above variables such as `pkgname` and `pkgver` are available for use -in the build function. In addition, makepkg defines three variables for your -use during the build and install process. These three variables are as follows: +in the build function. In addition, makepkg defines ithe following three +variables for use during the build and install process: *startdir*:: - This contains the absolute path to the directory where the PKGBUILD was + This contains the absolute path to the directory where the PKGBUILD is located, which is usually the output of `$(pwd)` when makepkg is started. *srcdir*:: - This points to the directory where makepkg extracts or copies all source + This points to the directory where makepkg extracts to or copies to all source files. *pkgdir*:: This points to the directory where makepkg bundles the installed package (this directory will become the root directory of your built package). -If you create any variables of your own in the build function, it is +If you create any variables on your own in the build function, it is recommended to use the bash `local` keyword to scope the variable to inside the build function. @@ -301,8 +300,8 @@ Each split package uses a corresponding packaging function with name `package_foo()`, where `foo` is the name of the split package. All options and directives for the split packages default to the global values -given within the PKGBUILD. However, some of these can be overridden within each -split package's packaging function. The following variables can be overridden: +given in the PKGBUILD. However, the following ones can be overwridden within +each split package's packaging function: `pkgver`, `pkgrel`, `pkgdesc`, `arch`, `license`, `groups`, `depends`, `optdepends`, `provides`, `conflicts`, `replaces`, `backup`, `options`, `install` and `changelog`. @@ -363,7 +362,7 @@ makepkg supports building development versions of packages without having to manually update the pkgver in the PKGBUILD. This was formerly done using the separate utility 'versionpkg'. In order to utilize this functionality, your PKGBUILD must use correct variable names depending on the SCM being fetched -from. +from (e.g.: "makepkg-git", "mplayer-svn"). *CVS*:: The generated pkgver will be the date the package is built. -- 1.7.5.4

3 9

[pacman-dev] GPG remote signing
by Dan McGee 11 Jun '11

11 Jun '11

I've done a fair amount of research on what we might be able to do with this during the afternoon here. Some observations below. This is mainly addressing point four in Thomas' prior email (http://mailman.archlinux.org/mailman/private/arch-dev/2011-May/014193.html) There are hacks for forwarding a gpg-agent socket involving socat (original one here http://superuser.com/questions/161973/how-can-i-forward-a-gpg-key-via-ssh-a…, more secure one here http://www.debian-administration.org/users/dkg/weblog/68) The problem? gpg 2.0.x and down (the current version) store only passphrases in gpg-agent; either way, the gpg2/gpg binary itself still needs access to the secure keyring to perform the encryption and generate a signature for the file. So this seems like a dead end for the time being. Rumor is 2.1 will fix this problem (http://www.debian-administration.org/users/dkg/weblog/68#comment_5) but I don't think we're in a position to wait for that. I've seen suggestions revolving around signing remote files that say the following instead- rather than sign the large file directly by either putting your key out there, or pulling the big file to you, sign a secure digest of the file. Something such as dropping the SHA512 hash into a file, copying that to the machine with the key, and then signing that instead. In a way, this is what GPG signing does anyway (gpg --edit-key <yours>, showprefs, look at the "Digest" line; also, the --show-mds option). The problem is GPG doesn't allow you to separate the digest generation from the actual signing process, which sucks. This doesn't fully work for us- at least right now. I see a few possibilities as to how to proceed. 1) suck it up, sign your packages locally. 2) live dangerously, copy your secret key out, use it to sign, delete it from that location (you better have a passphrase). 3) do the above "sign the hash trick"; one would then upload the package from location A, and the "special signature", we'll call it, from location B. When these two files are on the main server, a master key/verification program (running in a walled-off VM with very little access) would basically say "is this special signature valid, and is it blessed by our trust", and if so, truly sign the package (and the special signature would not longer be needed). This is somewhat similar to what Debian does with their dsc files (signing a little more than a single hash, see for yourself: http://ftp.us.debian.org/debian/pool/main/m/magit/magit_0.7-1.1.dsc) 4) do the above "sign the hash trick"; and teach pacman how to verify both "real" signatures and "special" signatures on files. 5) ??? Thoughts? Other ideas? Things I'm forgetting? I'll withhold my preference of option for now to prevent biasing any comments; the above should not be seen as order of preference. -Dan

2 1

[pacman-dev] Status of sodeps?
by Florian Pritz 09 Jun '11

09 Jun '11

It's been quite a while since I last brought this up so what's the current status? Older discussions and the link to my repo are here [1]. [1] https://wiki.archlinux.org/index.php/Pacman_Roadmap#sodepends -- Florian Pritz -- {flo,bluewind}(a)server-speed.net

5 11

[pacman-dev] [PATCH] Add handle argument to alpm_(add|remove)_pkg()
by Dan McGee 09 Jun '11

09 Jun '11

This makes these functions consistent with the rest of the transaction related API calls. We do an additional assert to ensure the handle attached to the package is the same as the handle passed in. Signed-off-by: Dan McGee <dan(a)archlinux.org> --- lib/libalpm/add.c | 8 ++++---- lib/libalpm/alpm.h | 6 ++++-- lib/libalpm/remove.c | 8 ++++---- src/pacman/remove.c | 4 ++-- src/pacman/sync.c | 2 +- src/pacman/upgrade.c | 2 +- 6 files changed, 16 insertions(+), 14 deletions(-) diff --git a/lib/libalpm/add.c b/lib/libalpm/add.c index abce175..6f93c61 100644 --- a/lib/libalpm/add.c +++ b/lib/libalpm/add.c @@ -50,16 +50,16 @@ #include "handle.h" /** Add a package to the transaction. */ -int SYMEXPORT alpm_add_pkg(pmpkg_t *pkg) +int SYMEXPORT alpm_add_pkg(pmhandle_t *handle, pmpkg_t *pkg) { const char *pkgname, *pkgver; - pmhandle_t *handle; pmtrans_t *trans; pmpkg_t *local; /* Sanity checks */ - ASSERT(pkg != NULL, return -1); - handle = pkg->handle; + ASSERT(handle != NULL, return -1); + ASSERT(pkg != NULL, RET_ERR(handle, PM_ERR_WRONG_ARGS, -1)); + ASSERT(handle == pkg->handle, RET_ERR(handle, PM_ERR_WRONG_ARGS, -1)); trans = handle->trans; ASSERT(trans != NULL, RET_ERR(handle, PM_ERR_TRANS_NULL, -1)); ASSERT(trans->state == STATE_INITIALIZED, diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index 37bea6d..b62c62d 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -873,16 +873,18 @@ int alpm_sync_sysupgrade(pmhandle_t *handle, int enable_downgrade); /** Add a package to the transaction. * If the package was loaded by alpm_pkg_load(), it will be freed upon * alpm_trans_release() invocation. + * @param handle the context handle * @param pkg the package to add * @return 0 on success, -1 on error (pm_errno is set accordingly) */ -int alpm_add_pkg(pmpkg_t *pkg); +int alpm_add_pkg(pmhandle_t *handle, pmpkg_t *pkg); /** Add a package removal action to the transaction. + * @param handle the context handle * @param pkg the package to uninstall * @return 0 on success, -1 on error (pm_errno is set accordingly) */ -int alpm_remove_pkg(pmpkg_t *pkg); +int alpm_remove_pkg(pmhandle_t *handle, pmpkg_t *pkg); /** @} */ diff --git a/lib/libalpm/remove.c b/lib/libalpm/remove.c index 8a1bbcb..52f60fc 100644 --- a/lib/libalpm/remove.c +++ b/lib/libalpm/remove.c @@ -44,15 +44,15 @@ #include "deps.h" #include "handle.h" -int SYMEXPORT alpm_remove_pkg(pmpkg_t *pkg) +int SYMEXPORT alpm_remove_pkg(pmhandle_t *handle, pmpkg_t *pkg) { const char *pkgname; - pmhandle_t *handle; pmtrans_t *trans; /* Sanity checks */ - ASSERT(pkg != NULL, return -1); - handle = pkg->handle; + ASSERT(handle != NULL, return -1); + ASSERT(pkg != NULL, RET_ERR(handle, PM_ERR_WRONG_ARGS, -1)); + ASSERT(handle == pkg->handle, RET_ERR(handle, PM_ERR_WRONG_ARGS, -1)); trans = handle->trans; ASSERT(trans != NULL, RET_ERR(handle, PM_ERR_TRANS_NULL, -1)); ASSERT(trans->state == STATE_INITIALIZED, diff --git a/src/pacman/remove.c b/src/pacman/remove.c index 595263a..2c4a3fc 100644 --- a/src/pacman/remove.c +++ b/src/pacman/remove.c @@ -38,7 +38,7 @@ static int remove_target(const char *target) alpm_list_t *p; if((info = alpm_db_get_pkg(db_local, target)) != NULL) { - if(alpm_remove_pkg(info) == -1) { + if(alpm_remove_pkg(config->handle, info) == -1) { pm_fprintf(stderr, PM_LOG_ERROR, "'%s': %s\n", target, alpm_strerror(alpm_errno(config->handle))); return -1; @@ -54,7 +54,7 @@ static int remove_target(const char *target) } for(p = alpm_grp_get_pkgs(grp); p; p = alpm_list_next(p)) { pmpkg_t *pkg = alpm_list_getdata(p); - if(alpm_remove_pkg(pkg) == -1) { + if(alpm_remove_pkg(config->handle, pkg) == -1) { pm_fprintf(stderr, PM_LOG_ERROR, "'%s': %s\n", target, alpm_strerror(alpm_errno(config->handle))); return -1; diff --git a/src/pacman/sync.c b/src/pacman/sync.c index 36c7799..539e651 100644 --- a/src/pacman/sync.c +++ b/src/pacman/sync.c @@ -616,7 +616,7 @@ static pmdb_t *get_db(const char *dbname) static int process_pkg(pmpkg_t *pkg) { - int ret = alpm_add_pkg(pkg); + int ret = alpm_add_pkg(config->handle, pkg); if(ret == -1) { enum _pmerrno_t err = alpm_errno(config->handle); diff --git a/src/pacman/upgrade.c b/src/pacman/upgrade.c index ef273cf..35624eb 100644 --- a/src/pacman/upgrade.c +++ b/src/pacman/upgrade.c @@ -82,7 +82,7 @@ int pacman_upgrade(alpm_list_t *targets) trans_release(); return 1; } - if(alpm_add_pkg(pkg) == -1) { + if(alpm_add_pkg(config->handle, pkg) == -1) { pm_fprintf(stderr, PM_LOG_ERROR, "'%s': %s\n", targ, alpm_strerror(alpm_errno(config->handle))); alpm_pkg_free(pkg); -- 1.7.5.2

1 0

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v3.5.3-216-gff7ad5f
by dan＠archlinux.org 09 Jun '11

09 Jun '11

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via ff7ad5fd7376c133bc646c4d69d06019e0b64044 (commit) via ff8e519d4b011a6f23c0366d45c396fcd1f9af97 (commit) via 7d27cf8364b9c5d9a8d89017173f8c88d40cedd5 (commit) via 24000b83c9a9ba2f25a46914d2919293dc865a2e (commit) via 17a6ac567502975d3a98a34ed58d79c05eb7b8d1 (commit) via 7968d30510de5a6031af39da498be5c821290b82 (commit) via e826c143d3e9d21485f72c5490b2a907c936024e (commit) via 9d6568da0f55fb05ea5c28e06efb51046fd270bf (commit) via 451cd2c88dcdec793ce7159331adcc2d049381e1 (commit) from dfaeb6bb2ca8311ac418a16c30006eb7d0534d71 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit ff7ad5fd7376c133bc646c4d69d06019e0b64044 Author: Dan McGee <dan(a)archlinux.org> Date: Thu Jun 9 15:15:15 2011 -0500 commit_single_pkg(): Use handle object directly Commit e68f5d9a3067141 did something a bit silly and changed the scriptlet calls to use 'newpkg->handle' rather than the 'handle' argument passed in. Use the handle directly. Signed-off-by: Dan McGee <dan(a)archlinux.org> commit ff8e519d4b011a6f23c0366d45c396fcd1f9af97 Author: Dan McGee <dan(a)archlinux.org> Date: Tue Jun 7 13:39:52 2011 -0500 Require handle for alpm_sync_sysupgrade() Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 7d27cf8364b9c5d9a8d89017173f8c88d40cedd5 Author: Dan McGee <dan(a)archlinux.org> Date: Tue Jun 7 13:34:30 2011 -0500 Require handle for alpm_db_register_sync() Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 24000b83c9a9ba2f25a46914d2919293dc865a2e Author: Dan McGee <dan(a)archlinux.org> Date: Tue Jun 7 13:29:05 2011 -0500 Require handle argument to all alpm_trans_*() methods Begin enforcing the need to pass a handle. This allows us to remove one more extern handle declaration from the backend. Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 17a6ac567502975d3a98a34ed58d79c05eb7b8d1 Author: Dan McGee <dan(a)archlinux.org> Date: Tue Jun 7 13:15:43 2011 -0500 Require handle argument to all alpm_option_(get|set)_*() methods This requires a lot of line changes, but not many functional changes as more often than not our handle variable is already available in some fashion. Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 7968d30510de5a6031af39da498be5c821290b82 Author: Dan McGee <dan(a)archlinux.org> Date: Tue Jun 7 12:41:33 2011 -0500 Require handle argument to alpm_logaction() This is the first in a series of patches to update the API to remove the implicit global handle variable. Signed-off-by: Dan McGee <dan(a)archlinux.org> commit e826c143d3e9d21485f72c5490b2a907c936024e Author: Dan McGee <dan(a)archlinux.org> Date: Thu Jun 9 13:41:08 2011 -0500 Kill all remaining 'PATH_MAX + 1' usages The few remaining instances were utilized for buffers in calls to snprintf() and realpath(). Both of these functions will always ensure the returned value is padded with '\0', so there is no need for the extra byte. Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 9d6568da0f55fb05ea5c28e06efb51046fd270bf Author: Dan McGee <dan(a)archlinux.org> Date: Thu Jun 9 13:34:13 2011 -0500 _alpm_lstat: only duplicate string if necessary The vast majority of the time we will just be passing the same string value on to the lstat() call. The only time we need to duplicate it is if the path ends in '/'. In one run using a profiler, only 400 of the 200,000 calls (0.2%) required the string to be copied first. Signed-off-by: Dan McGee <dan(a)archlinux.org> commit 451cd2c88dcdec793ce7159331adcc2d049381e1 Author: Allan McRae <allan(a)archlinux.org> Date: Wed Jun 8 23:49:57 2011 +1000 Fix bracket type in makefile Signed-off-by: Allan McRae <allan(a)archlinux.org> Signed-off-by: Dan McGee <dan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: lib/libalpm/add.c | 48 +++++----- lib/libalpm/alpm.h | 132 +++++++++++++----------- lib/libalpm/be_local.c | 2 +- lib/libalpm/be_package.c | 2 +- lib/libalpm/be_sync.c | 2 +- lib/libalpm/conflict.c | 6 +- lib/libalpm/db.c | 7 +- lib/libalpm/delta.c | 11 +- lib/libalpm/delta.h | 2 +- lib/libalpm/deps.c | 6 +- lib/libalpm/diskspace.c | 2 +- lib/libalpm/dload.c | 6 +- lib/libalpm/handle.c | 251 ++++++++++++++++++---------------------------- lib/libalpm/log.c | 6 +- lib/libalpm/package.c | 4 +- lib/libalpm/remove.c | 6 +- lib/libalpm/signing.c | 19 ++-- lib/libalpm/signing.h | 3 +- lib/libalpm/sync.c | 33 +++--- lib/libalpm/trans.c | 31 +++--- lib/libalpm/util.c | 41 ++++---- lib/libalpm/util.h | 6 +- scripts/Makefile.am | 2 +- src/pacman/callback.c | 6 +- src/pacman/conf.c | 46 +++++---- src/pacman/database.c | 2 +- src/pacman/deptest.c | 3 +- src/pacman/package.c | 5 +- src/pacman/pacman.c | 20 ++-- src/pacman/query.c | 21 ++-- src/pacman/remove.c | 10 +- src/pacman/sync.c | 44 ++++---- src/pacman/upgrade.c | 16 ++-- src/pacman/util.c | 13 ++- src/util/cleanupdelta.c | 4 +- src/util/pactree.c | 6 +- src/util/testdb.c | 13 +-- src/util/testpkg.c | 2 +- 38 files changed, 396 insertions(+), 443 deletions(-) hooks/post-receive -- The official pacman repository

1 0