- Pacman-dev - lists.archlinux.org

[pacman-dev] inconsistent behaviour in handle.c
by Rémy Oudompheng 27 Mar '11

27 Mar '11

Hello, The functions defined in handle.c seem to have an inconsistent behaviour. Many of them check that handle is not NULL before acting, and set pm_errno to PM_ERR_HANDLE_NULL if so. But others do not, and segfault if used before alpm_initialize() is called. Is there a rationale behind that or should it be patched? Regards, Rémy.

2 1

[pacman-dev] [namcap] Released version 3.0.3
by Rémy Oudompheng 27 Mar '11

27 Mar '11

Hello, I have released and packaged namcap 3.0.3. It includes Dan's patches for the PKGBUILD analysis and a fix for the dangling symlink detection. I hope this will be the last bugfix release before the move from [testing] to [extra]. Regards, Rémy.

3 3

[pacman-dev] [RFC] Replacing wget with curl in makepkg
by Dave Reisner 27 Mar '11

27 Mar '11

The attached patch proposes to replace wget with curl as the default DLAGENT in makepkg for http, https, and ftp. This seems like the sane choice given our switch from fetch to curl. dave

3 2

[pacman-dev] pacman-key imports and key trust levels
by Ray Kohler 26 Mar '11

26 Mar '11

So, after a couple of days of messing around (and fixing random things here and there), I was able to go end-to-end, verifying a signed repo DB, and then installing a signed package from that repo. Very nice! I ended up testing out the failure case on verifying signatures a bit more than I wanted, though, as I something surprised me: When importing keys with pacman-key, they keys themselves are imported fine, but they are not marked as sufficiently trusted that the signatures are worth anything. I just imported my "real" GPG pubring (which has nothing in it but my own key) with "pacman-key -a ~/.gnupg/pubring.gpg", and used that same key to sign a package and add that package to a signed repo. GPGme returns "unknown key" when asked to verify these sigs, so pacman flunks them as "invalid signature". After editing the trustdb to mark this key as "ultimate" (hey, it's my own key after all), everything worked. So, my question is, where does the fault lie? Did I make some wrong assumption? Should pacman-key set high levels of trust on keys it imports? Should alpm configure GPGme with trust-level=always? While I'm talking about signing stuff - I noticed an open question on what to do with the downloaded DB if sig verification fails. I suggest it be deleted, and the sig be deleted also. These are generally small files, and it feels really wrong to keep a file "live" on my disk which has been declared untrustworthy.

4 4

[pacman-dev] [PATCH] Renamed --trust to --edit-key
by Richard Alex Hofer 26 Mar '11

26 Mar '11

Hi, I'm very new here, but hope this saves someone a minute or two. Fixes the first thing on the TODO list "TODO: rename the --trust option to --edit-key". Tried sending this before, but I think I messed something up. Also, looks like the date is way off. From fb1fe43baa5e46de09d102a29669de250bd4d065 Mon Sep 17 00:00:00 2001 From: Richard A Hofer <atomic.quark(a)gmail.com> Date: Fri, 25 Mar 2011 17:39:30 -0400 Subject: [PATCH] Renamed --trust to --edit-key and -t to -k (for Key) --- scripts/pacman-key.sh.in | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 5746e64..bb05429 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -66,7 +66,7 @@ usage() { echo "$(gettext " -h, --help This help")" echo "$(gettext " -l, --list List keys")" echo "$(gettext " -r, --receive <keyserver> <keyid(s)> Fetch the specified keyids")" - echo "$(gettext " -t, --trust <keyid(s)> Set the trust level of the given keyids")" + echo "$(gettext " -k, --edit-key <keyid(s)> Set the trust level of the given keyids")" echo "$(gettext " -u, --updatedb Update the trustdb of pacman")" echo "$(gettext " -V, --version Show program version")" echo "$(gettext " --adv <params> Use pacman's keyring with advanced gpg commands")" @@ -290,7 +290,7 @@ case "${command}" in shift ${GPG_PACMAN} --keyserver "${keyserver}" --recv-keys "$@" ;; - -t|--trust) + -k|--edit-key) if (( $# == 0 )); then error "$(gettext "You need to specify at least one key identifier")" exit 1 -- 1.7.4.1

3 2

[pacman-dev] [PATCH] makepkg: command line options for signing packages
by Allan McRae 26 Mar '11

26 Mar '11

From: Denis A. Altoé Falqueto <denisfalqueto(a)gmail.com> Three new command line options were added: --sign: forces the generation of a signature for the resulting package, taking precedence over the value in makepkg.conf --nosign: do not sign the resulting package --key <key>: use a different key than the user's default for signing the package. A check is performed to ensure the user has (provided) a valid gpg for signing. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- This is a patch originially supplied by Denis a few weeks back that got a bit lost with preparing for release of pacman-3.5. I made some minor changes: 1) removed the short option for --sign. This is overriding the default set in makepkg.conf so no need for a short option 2) changed --signwithkey to just --key as I found the longer option name too long 3) simplified the checking for if we need to sign the package @Denis: I'm sure you would have made these changes if I had asked, but with the delay from me in re-review this patch, I figured it was only fair for me to make the small changes and get it done! scripts/makepkg.sh.in | 41 ++++++++++++++++++++++++++++++++++++----- 1 files changed, 36 insertions(+), 5 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 5742c49..c8ac6a4 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -28,7 +28,7 @@ # makepkg uses quite a few external programs during its execution. You # need to have at least the following installed for makepkg to function: # awk, bsdtar (libarchive), bzip2, coreutils, fakeroot, file, find (findutils), -# gettext, grep, gzip, openssl, sed, tput (ncurses), xz +# gettext, gpg, grep, gzip, openssl, sed, tput (ncurses), xz # gettext initialization export TEXTDOMAIN='pacman' @@ -75,6 +75,7 @@ CHECKFUNC=0 PKGFUNC=0 SPLITPKG=0 PKGLIST=() +SIGNPKG='' # Forces the pkgver of the current PKGBUILD. Used by the fakeroot call # when dealing with svn/cvs/etc PKGBUILDs. @@ -1106,7 +1107,7 @@ create_package() { } create_signature() { - if [[ $(check_buildenv sign) != "y" ]]; then + if [[ $SIGNPKG != 'y' ]]; then return fi local ret=0 @@ -1116,7 +1117,15 @@ create_signature() { error "$(gettext "Cannot find the gpg binary! Is gnupg installed?")" exit 1 # $E_MISSING_PROGRAM fi - gpg --detach-sign --use-agent "$filename" || ret=$? + + local SIGNWITHKEY="" + if [[ -n $SIGNKEY ]]; then + SIGNWITHKEY="-u ${SIGNKEY}" + fi + # The signature will be generated directly in ascii-friendly format + gpg --detach-sign --use-agent ${SIGNWITHKEY} "$filename" &>/dev/null || ret=$? + + if (( ! ret )); then msg2 "$(gettext "Created signature file %s.")" "$filename.sig" else @@ -1615,8 +1624,11 @@ usage() { printf "$(gettext " --check Run the check() function in the %s")\n" "$BUILDSCRIPT" printf "$(gettext " --config <file> Use an alternate config file (instead of '%s')")\n" "$confdir/makepkg.conf" printf "$(gettext " --holdver Prevent automatic version bumping for development %ss")\n" "$BUILDSCRIPT" + echo "$(gettext " --key <key> Specify a key to use for gpg signing instead of the default")" printf "$(gettext " --nocheck Do not run the check() function in the %s")\n" "$BUILDSCRIPT" + echo "$(gettext " --nosign Do not create a signature for the package")" echo "$(gettext " --pkg <list> Only build listed packages from a split package")" + echo "$(gettext " --sign Sign the resulting package with gpg")" echo "$(gettext " --skipinteg Do not fail when integrity checks are missing")" echo "$(gettext " --source Generate a source-only tarball without downloaded sources")" echo @@ -1653,8 +1665,8 @@ ARGLIST=("$@") OPT_SHORT="AcCdefFghiLmop:rRsV" OPT_LONG="allsource,asroot,ignorearch,check,clean,cleancache,nodeps" OPT_LONG+=",noextract,force,forcever:,geninteg,help,holdver" -OPT_LONG+=",install,log,nocolor,nobuild,nocheck,pkg:,rmdeps" -OPT_LONG+=",repackage,skipinteg,source,syncdeps,version,config:" +OPT_LONG+=",install,key:,log,nocolor,nobuild,nocheck,nosign,pkg:,rmdeps" +OPT_LONG+=",repackage,skipinteg,sign,source,syncdeps,version,config:" # Pacman Options OPT_LONG+=",noconfirm,noprogressbar" OPT_TEMP="$(parse_options $OPT_SHORT $OPT_LONG "$@" || echo 'PARSE_OPTIONS FAILED')" @@ -1688,15 +1700,18 @@ while true; do -g|--geninteg) GENINTEG=1 ;; --holdver) HOLDVER=1 ;; -i|--install) INSTALL=1 ;; + --key) shift; SIGNKEY=$1 ;; -L|--log) LOGGING=1 ;; -m|--nocolor) USE_COLOR='n' ;; --nocheck) RUN_CHECK='n' ;; + --nosign) SIGNPKG='n' ;; -o|--nobuild) NOBUILD=1 ;; -p) shift; BUILDFILE=$1 ;; --pkg) shift; PKGLIST=($1) ;; -r|--rmdeps) RMDEPS=1 ;; -R|--repackage) REPKG=1 ;; --skipinteg) SKIPINTEG=1 ;; + --sign) SIGNPKG='y' ;; --source) SOURCEONLY=1 ;; -s|--syncdeps) DEP_BIN=1 ;; @@ -1927,6 +1942,22 @@ if [[ -n "${PKGLIST[@]}" ]]; then pkgname=("${PKGLIST[@]}") fi +# check if gpg signature is to be created and if signing key is valid +if [[ -z "$SIGNPKG" && $(check_buildenv sign) == 'y' ]]; then + SIGNPKG='y' +fi +if [[ $SIGNPKG == 'y' ]]; then + if ! gpg --list-key ${SIGNKEY} &>/dev/null; then + if [[ ! -z $SIGNKEY ]]; then + error "$(gettext "The key ${SIGNKEY} does not exist in your keyring.")" + else + error "$(gettext "There is no key in your keyring.")" + fi + exit 1 + fi +fi + + if (( ! SPLITPKG )); then fullver=$(get_full_version $epoch $pkgver $pkgrel) if [[ -f $PKGDEST/${pkgname}-${fullver}-${CARCH}${PKGEXT} \ -- 1.7.4.1

1 0

[pacman-dev] [PATCH] Skip md5sum check if signature check is successful
by Peter Tseng 26 Mar '11

26 Mar '11

Been sitting on the TODO list for a while, and figured I'd give it a shot. This simply moves the md5sum check to after the signature check, then adds a variable to indicate that signature check was okay. Yes, my first attempt to submit, and it's a simple one, but you gotta start somewhere. If it fails miserably, feel free to tear it apart. I'll respond to feedback and hopefully move on to submit more in the future... Signed-off-by: Peter Tseng <archlinux(a)leftylink.com> --- lib/libalpm/sync.c | 19 +++++++++++-------- 1 files changed, 11 insertions(+), 8 deletions(-) diff --git a/lib/libalpm/sync.c b/lib/libalpm/sync.c index 5428e40..2b1c6cb 100644 --- a/lib/libalpm/sync.c +++ b/lib/libalpm/sync.c @@ -828,6 +828,7 @@ int _alpm_sync_commit(pmtrans_t *trans, pmdb_t *db_local, alpm_list_t **data) for(i = trans->add; i; i = i->next, current++) { pmpkg_t *spkg = i->data; int percent = (current * 100) / numtargs; + int sig_check_ok = 0; if(spkg->origin == PKG_FROM_FILE) { continue; /* pkg_load() has been already called, this package is valid */ } @@ -839,14 +840,7 @@ int _alpm_sync_commit(pmtrans_t *trans, pmdb_t *db_local, alpm_list_t **data) const char *md5sum = alpm_pkg_get_md5sum(spkg); const pmpgpsig_t *pgpsig = alpm_pkg_get_pgpsig(spkg); - /* check md5sum first */ - if(test_md5sum(trans, filepath, md5sum) != 0) { - errors++; - *data = alpm_list_add(*data, strdup(filename)); - FREE(filepath); - continue; - } - /* check PGP signature next */ + /* check PGP signature first */ pmdb_t *sdb = alpm_pkg_get_db(spkg); if(sdb->pgp_verify != PM_PGP_VERIFY_NEVER) { @@ -857,8 +851,17 @@ int _alpm_sync_commit(pmtrans_t *trans, pmdb_t *db_local, alpm_list_t **data) *data = alpm_list_add(*data, strdup(filename)); FREE(filepath); continue; + } else { + sig_check_ok = 1; } } + /* check md5sum next */ + if(!sig_check_ok && test_md5sum(trans, filepath, md5sum) != 0) { + errors++; + *data = alpm_list_add(*data, strdup(filename)); + FREE(filepath); + continue; + } /* load the package file and replace pkgcache entry with it in the target list */ /* TODO: alpm_pkg_get_db() will not work on this target anymore */ _alpm_log(PM_LOG_DEBUG, "replacing pkgcache entry with package file for target %s\n", spkg->name); -- 1.7.4.1

1 0

[pacman-dev] [PATCH] Update usage instruction strings
by Dan McGee 25 Mar '11

25 Mar '11

* Address FS#23433 by documenting -d vs. -dd * Drop the useless "as well", "also", "too", and "that won't break packages" strings from -R usage * Fix alignment of multiline strings in source (no string change) Signed-off-by: Dan McGee <dan(a)archlinux.org> --- src/pacman/pacman.c | 17 +++++++++-------- 1 files changed, 9 insertions(+), 8 deletions(-) diff --git a/src/pacman/pacman.c b/src/pacman/pacman.c index 2847fd5..0ad0354 100644 --- a/src/pacman/pacman.c +++ b/src/pacman/pacman.c @@ -114,6 +114,7 @@ static void usage(int op, const char * const myname) char const * const str_usg = _("usage"); char const * const str_opr = _("operation"); + /* please limit your strings to 80 characters in width */ if(op == PM_OP_MAIN) { printf("%s: %s <%s> [...]\n", str_usg, myname, str_opr); printf(_("operations:\n")); @@ -132,10 +133,10 @@ static void usage(int op, const char * const myname) printf("%s: %s {-R --remove} [%s] <%s>\n", str_usg, myname, str_opt, str_pkg); printf("%s:\n", str_opt); addlist(_(" -c, --cascade remove packages and all packages that depend on them\n")); - addlist(_(" -n, --nosave remove configuration files as well\n")); - addlist(_(" -s, --recursive remove dependencies also (that won't break packages)\n" - " (-ss includes explicitly installed dependencies too)\n")); - addlist(_(" -u, --unneeded remove unneeded packages (that won't break packages)\n")); + addlist(_(" -n, --nosave remove configuration files\n")); + addlist(_(" -s, --recursive remove unnecessary dependencies\n" + " (-ss includes explicitly installed dependencies)\n")); + addlist(_(" -u, --unneeded remove unneeded packages\n")); } else if(op == PM_OP_UPGRADE) { printf("%s: %s {-U --upgrade} [%s] <%s>\n", str_usg, myname, str_opt, str_file); printf("%s:\n", str_opt); @@ -186,16 +187,16 @@ static void usage(int op, const char * const myname) addlist(_(" --asexplicit install packages as explicitly installed\n")); addlist(_(" --ignore <pkg> ignore a package upgrade (can be used more than once)\n")); addlist(_(" --ignoregroup <grp>\n" - " ignore a group upgrade (can be used more than once)\n")); + " ignore a group upgrade (can be used more than once)\n")); /* pass through */ case PM_OP_REMOVE: - addlist(_(" -d, --nodeps skip dependency checks\n")); + addlist(_(" -d, --nodeps skip dependency version checks (-dd to skip all checks)\n")); addlist(_(" -k, --dbonly only modify database entries, not package files\n")); addlist(_(" --noprogressbar do not show a progress bar when downloading files\n")); addlist(_(" --noscriptlet do not execute the install scriptlet if one exists\n")); - addlist(_(" --print only print the targets instead of performing the operation\n")); + addlist(_(" --print print the targets instead of performing the operation\n")); addlist(_(" --print-format <string>\n" - " specify how the targets should be printed\n")); + " specify how the targets should be printed\n")); break; } -- 1.7.4.1

1 0

[pacman-dev] [PATCH] Make log redirection saner
by Jan Steffens 25 Mar '11

25 Mar '11

My main motivation was to remove the "sync", which can stall for minutes on a busy machine (FS#23378). I also cleaned up the redirection. Signed-off-by: Jan Steffens <jan.steffens(a)gmail.com> --- scripts/makepkg.sh.in | 11 +++++------ 1 files changed, 5 insertions(+), 6 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 5742c49..0b3891e 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -794,15 +794,14 @@ run_function() { # ensure overridden package variables survive tee with split packages logpipe=$(mktemp -u "$startdir/logpipe.XXXXXXXX") mkfifo "$logpipe" - exec 3>&1 - tee "$BUILDLOG" < "$logpipe" & - exec 1>"$logpipe" 2>"$logpipe" + tee "$BUILDLOG" < "$logpipe" & teepid=$! + restoretrap=$(trap -p ERR) trap 'error_function $pkgfunc' ERR - $pkgfunc 2>&1 + $pkgfunc &>"$logpipe" eval $restoretrap - sync - exec 1>&3 2>&3 3>&- + + wait $teepid rm "$logpipe" else restoretrap=$(trap -p ERR) -- 1.7.4.1

3 3

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v3.5.1-71-g86e7f60
by dan＠archlinux.org 25 Mar '11

25 Mar '11

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via 86e7f6075671e08c456f389d8ecba47190c03f0f (commit) via c37c9c5dcae06c1585b4da4c0b838f5b44e1498e (commit) via 14474a32c90b2202f1faf69ea20abbcdedfe4c29 (commit) via e68e994eb2c32c4b7ad5288f8f4b8809e1c39c9b (commit) via cfa2eebdafc4d2341621e24ce61dd5a74a0de9fc (commit) via 351942c71b80adaac614ed1c353d0e8e6f49ac8b (commit) from a8b22e16efbffee84ff8647846196958d871c64b (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 86e7f6075671e08c456f389d8ecba47190c03f0f Merge: cfa2eeb c37c9c5 Author: Dan McGee <dan(a)archlinux.org> Date: Thu Mar 24 21:18:09 2011 -0500 Merge branch 'maint' commit cfa2eebdafc4d2341621e24ce61dd5a74a0de9fc Author: Ray Kohler <ataraxia937(a)gmail.com> Date: Thu Mar 24 18:05:30 2011 -0400 Fix use of relative paths for packages in repo-add Move checksum and pgpsig calcluation before changing into the tmpdir, otherwise we can't find the files if a relative path was used. Signed-off-by: Ray Kohler <ataraxia937(a)gmail.com> Signed-off-by: Dan McGee <dan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: doc/index.txt | 1 + lib/libalpm/alpm.c | 9 +++++++++ lib/libalpm/db.c | 8 ++------ scripts/makepkg.sh.in | 10 +++++----- scripts/repo-add.sh.in | 31 +++++++++++++++++-------------- src/pacman/pacman.c | 4 ++++ 6 files changed, 38 insertions(+), 25 deletions(-) hooks/post-receive -- The official pacman repository

1 0