- Pacman-dev - lists.archlinux.org

[Git][pacman/pacman][master] 14 commits: Revert commits providing a default sandboxuser
by Allan McRae (＠allan) 10 Oct '25

10 Oct '25

Allan McRae pushed to branch master at Pacman / Pacman Commits: 3a5ae573 by Allan McRae at 2025-10-10T19:05:23+10:00 Revert commits providing a default sandboxuser Reverts commits 7ccf316ceb767ddbd2c967a529551a8c1a78a53e and 692f7a2cfec0eb8e96e682d536631034abea4d61. - - - - - 25b64206 by Allan McRae at 2025-10-10T19:05:23+10:00 Record calling user ID in handle This will be used to check for permissions when deciding to enable features that require root access (e.g. sandboxing). Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 18e96ca3 by Allan McRae at 2025-10-10T19:05:23+10:00 Add utility function to check whether the sandbox should be used Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 2ae63606 by Allan McRae at 2025-10-10T19:05:23+10:00 Only use temporary directories for downloading when in the sandbox Completely separating the sandbox and non-sandbox download setup provides more flexibility for non-root users of libalpm, and provides a proper "fix" for leftover download directories with interupted downloads when not using the sandbox. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 0fd09020 by morganamilo at 2025-10-10T19:05:23+10:00 libalpm: set errno and log when setting up temp download dir Before: % pacman -Syy :: Synchronising package databases... error: failed to synchronize all databases (unexpected error) After: % pacman -Syy :: Synchronising package databases... error: failed to create temporary download directory /var/lib/pacman/sync/download-P77oXs: Permission denied error: failed to synchronize all databases (failed to retrieve some files) Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - c18e472e by morganamilo at 2025-10-10T19:05:23+10:00 libalpm: add new errno for download initialization The error string "failed to retrieve some files" implies that the download may have begun and some files may have been partially downloaded. If we know no download actually took place we can be more clear about this. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 77611e7f by Remi Gacogne at 2025-10-10T19:05:23+10:00 libalpm: Better error messages when landlock setup fails As suggested by @l0kod in the comments of #167. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 4f1561c3 by Remi Gacogne at 2025-10-10T19:05:23+10:00 libalpm: Capitalize "Landlock" Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 12a4efa0 by Remi Gacogne at 2025-10-10T19:05:23+10:00 libalpm: Failure to setup Landlock is an error Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - ba95143b by Remi Gacogne at 2025-10-10T19:05:23+10:00 libalpm: Add an error message for seccomp setup failures Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 46461dc6 by Allan McRae at 2025-10-10T19:05:23+10:00 Remove sandbox "tests" Landlock and syscall filtering never worked under fakeroot, so we were effectively only testing the download directory creation with these tests. Remove these tests so that we can make sandbox setup failures into errors. While this reduced CI on that code path, it is also likely the primary code path used by pacman developers, so will have limited impact. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 933cd290 by Allan McRae at 2025-10-10T19:05:23+10:00 Remove old TESTS file Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - eede4c36 by Remi Gacogne at 2025-10-10T19:05:23+10:00 libalpm: Failure to enable Landlock or seccomp is a download error Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - ee9a2d88 by Remi Gacogne at 2025-10-10T19:05:23+10:00 Add finegrained configuration and CLI options to control sandboxing Add the "DisableSandboxFilesystem" and "DisableSandboxSyscalls" configuration options to disable Landlock and syscall filtering respectively. The "DisableSandbox" option becomes an alias for disabling both the finegrained options. Also add similar command line options. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 25 changed files: - doc/pacman.8.asciidoc - doc/pacman.conf.5.asciidoc - etc/pacman.conf.in - lib/libalpm/alpm.c - lib/libalpm/alpm.h - lib/libalpm/be_sync.c - lib/libalpm/dload.c - lib/libalpm/error.c - lib/libalpm/handle.c - lib/libalpm/handle.h - lib/libalpm/sandbox.c - lib/libalpm/sandbox.h - lib/libalpm/sandbox_fs.c - lib/libalpm/sandbox_syscalls.c - lib/libalpm/sync.c - lib/libalpm/util.c - lib/libalpm/util.h - src/pacman/conf.c - src/pacman/conf.h - src/pacman/pacman-conf.c - src/pacman/pacman.c - test/pacman/meson.build - − test/pacman/tests/TESTS - − test/pacman/tests/sandbox-download-basic.py - − test/pacman/tests/sandbox-download-upgrade.py View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/94df6f26b2cfefea5ec10a… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/94df6f26b2cfefea5ec10a… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] 6 commits: Simplify website by removing asciidoc-overrides
by Allan McRae (＠allan) 10 Oct '25

10 Oct '25

Allan McRae pushed to branch master at Pacman / Pacman Commits: 1eaaabdd by Allan McRae at 2025-10-10T18:52:45+10:00 Simplify website by removing asciidoc-overrides Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 40b4290b by Josh at 2025-10-10T18:52:45+10:00 Update index.asciidoc with formatting and new TOC Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 319ac6a4 by Allan McRae at 2025-10-10T18:52:45+10:00 Ensure styles are embedded within webpages Embed the needed asciidoc CSS and JS into the web pages so that we do not need to copy files from an asciidoc installation for a functional website. Also delete the website tarball target as it is not used. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 78da946b by Allan McRae at 2025-10-10T18:52:45+10:00 Remove release candidates and beta releases from index Also even up columns of the releases table. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - b217cd78 by Allan McRae at 2025-10-10T18:52:45+10:00 index.asciidoc: Update history to include sandboxing Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 94df6f26 by Allan McRae at 2025-10-10T18:52:45+10:00 Update website to use latest release branch Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 4 changed files: - .gitlab-ci.yml - − doc/asciidoc-override.css - doc/index.asciidoc - doc/meson.build View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/49063b118e53fc433fed2d… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/49063b118e53fc433fed2d… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] repo-add: Fix broken usage entry
by Allan McRae (＠allan) 09 Oct '25

09 Oct '25

Allan McRae pushed to branch master at Pacman / Pacman Commits: 49063b11 by morganamilo at 2025-10-09T06:22:06+01:00 repo-add: Fix broken usage entry - - - - - 1 changed file: - scripts/repo-add.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/49063b118e53fc433fed2dd… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/49063b118e53fc433fed2dd… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Add valgrind suppression for openssl-3.6
by Allan McRae (＠allan) 08 Oct '25

08 Oct '25

Allan McRae pushed to branch master at Pacman / Pacman Commits: be102197 by Allan McRae at 2025-10-08T10:05:08+10:00 Add valgrind suppression for openssl-3.6 Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - valgrind.supp View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/be1021974093ded2c2992f8… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/be1021974093ded2c2992f8… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Add missing length check when parsing signature files
by Allan McRae (＠allan) 08 Oct '25

08 Oct '25

Allan McRae pushed to branch master at Pacman / Pacman Commits: 14f00a46 by Allan McRae at 2025-10-06T15:25:26+10:00 Add missing length check when parsing signature files Fixes #270. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - lib/libalpm/signing.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/14f00a468c8a074fe971972… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/14f00a468c8a074fe971972… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Bump minimum GPGME version
by Allan McRae (＠allan) 06 Oct '25

06 Oct '25

Allan McRae pushed to branch master at Pacman / Pacman Commits: a99d36ad by Allan McRae at 2025-10-06T14:55:27+10:00 Bump minimum GPGME version Version 1.18.0 (released 2022-08-10) to account for the use of GPGME_KEYLIST_MODE_LOCATE_EXTERNAL. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - meson.build View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/a99d36ade0f8e573949a2ad… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/a99d36ade0f8e573949a2ad… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] 2 commits: libalpm: fix importing keys from keyserver
by Allan McRae (＠allan) 06 Oct '25

06 Oct '25

Allan McRae pushed to branch master at Pacman / Pacman Commits: d2266c4f by morganamilo at 2025-10-06T14:51:33+10:00 libalpm: fix importing keys from keyserver commit 95a7d416ce50446339c10c59b9ea25125a816adf broke key_search_keyserver() by removing the `ret = 1` at the end of the function, causing the caller to allways think the funciton failed even when it did not. Due to WKD being the primary method to import keys this was unnoticed. - - - - - 21e31edf by morganamilo at 2025-10-06T14:51:33+10:00 libalpm: reimport expired keys If the user does not update for a while some of the keys in the keyring may expire. Pacman does not import new versions of these keys because they are already in the keying. This leads to users needing to first update their keyring to get the new keys. So when keys are expired, prompt to reimport them, in hopes that there's a newer version of the key on the keyserver. - - - - - 1 changed file: - lib/libalpm/signing.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/b1237d827fac03928f6a87… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/b1237d827fac03928f6a87… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] 2 commits: Ensure length of log passed from sandbox is within bounds
by Allan McRae (＠allan) 06 Oct '25

06 Oct '25

Allan McRae pushed to branch master at Pacman / Pacman Commits: 268474fd by Allan McRae at 2025-10-06T13:58:59+10:00 Ensure length of log passed from sandbox is within bounds Fixes #265. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - b1237d82 by Allan McRae at 2025-10-06T13:58:59+10:00 Ensure filename passed from sandbox is a reasonable size Fixes #265. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - lib/libalpm/sandbox.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/655be2f3e5280ac513f44d… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/655be2f3e5280ac513f44d… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] libalpm: use correct siglevel for -U
by Allan McRae (＠allan) 19 Aug '25

19 Aug '25

Allan McRae pushed to branch master at Pacman / Pacman Commits: 655be2f3 by morganamilo at 2025-08-09T00:17:17+01:00 libalpm: use correct siglevel for -U -U should use RemoteFileSigLevel but was incorrectly using SigLevel. - - - - - 1 changed file: - lib/libalpm/dload.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/655be2f3e5280ac513f44db… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/655be2f3e5280ac513f44db… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] libalpm: edit docs for check_pgp_signature
by Allan McRae (＠allan) 05 Aug '25

05 Aug '25

Allan McRae pushed to branch master at Pacman / Pacman Commits: 5ccae096 by morganamilo at 2025-08-05T15:57:06+10:00 libalpm: edit docs for check_pgp_signature The old wording implied that the function would return -1 if the signature was invalid (alpm_sigresult_t->validity). When really it means if a correctly formatted signature exists at all. - - - - - 1 changed file: - lib/libalpm/alpm.h View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/5ccae096bb34160f960ce29… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/5ccae096bb34160f960ce29… You're receiving this email because of your account on gitlab.archlinux.org.

1 0