- Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH] libalpm: Add support for trigger dropins
by Daan De Meyer 21 Aug '20

21 Aug '20

In some scenarios, instead of adding their own hooks, packages want to augment hooks already installed by other packages with extra triggers. Currently, this requires modifying the existing hook file which is error prone and hard to manage for package managers. A concrete example where packages would want to extend an existing hook is using systemd's kernel-install script on Arch Linux. An example pacman hook for kernel-install could be the following: ``` [Trigger] Operation = Install Operation = Upgrade Type = Path Target = usr/lib/modules/*/vmlinuz Target = usr/lib/kernel/install.d/* [Trigger] Operation = Install Operation = Upgrade Type = Package Target = systemd [Action] Description = Adding kernel and initramfs images to /boot... When = PostTransaction Exec = /etc/pacman.d/scripts/mkosi-kernel-add NeedsTargets ``` This hook would run on installation and upgrades of kernel packages and every package that installs kernel-install scripts (which includes dracut and mkinitcpio). It's also fairly generic in that it doesn't include specifics of other packages except its source package (and implicitly the install directory of kernel packages). However, both mkinitcpio and dracut use the concept of hooks that can be installed by other packages to extend their functionality. In mkinitcpio these are stored in /usr/lib/initcpio. When a package is installed that installs extra hooks for mkinitcpio, the kernel-install hook will not trigger. We can fix this by adding /usr/lib/initcpio/* to the kernel-install pacman hook but this requires either modifying the kernel-install hook when installing mkinitpcio or adding all possible directories for all possible packages that want to add triggers to the kernel-install hook in the systemd package itself. Neither of these are attractive solutions. The first one isn't because we'd have to modify the hook when installing packages, the second isn't because it would be a huge maintenance burden and doesn't include for AUR or private repository packages. Instead, this commit adds support for trigger dropin directories that allow extra triggers to be added in separate files. When parsing hooks, we now also look in a .d directory for extra triggers (for mkinitcpio.hook, we look in mkinitcpio.hook.d). Trigger files are required to have the .trigger extension and follow the same ini format as regular hooks files. However, only [Trigger] sections are allowed. With this feature, packages can now install extra triggers for an existing hook into the trigger dropin directory for that package. These extra triggers can be tracked by the package manager and uninstalled along with the package. Signed-off-by: Daan De Meyer <daan.j.demeyer(a)gmail.com> --- lib/libalpm/hook.c | 149 ++++++++++++++++++++++++++++++++++++++++++--- lib/libalpm/hook.h | 1 + 2 files changed, 141 insertions(+), 9 deletions(-) diff --git a/lib/libalpm/hook.c b/lib/libalpm/hook.c index aca8707e..e3d833d2 100644 --- a/lib/libalpm/hook.c +++ b/lib/libalpm/hook.c @@ -44,6 +44,7 @@ struct _alpm_trigger_t { enum _alpm_hook_op_t op; enum _alpm_trigger_type_t type; alpm_list_t *targets; + char *name; }; struct _alpm_hook_t { @@ -66,6 +67,7 @@ static void _alpm_trigger_free(struct _alpm_trigger_t *trigger) { if(trigger) { FREELIST(trigger->targets); + free(trigger->name); free(trigger); } } @@ -146,16 +148,16 @@ static int _alpm_hook_validate(alpm_handle_t *handle, return ret; } -static int _alpm_hook_parse_cb(const char *file, int line, +#define error(...) _alpm_log(handle, ALPM_LOG_ERROR, __VA_ARGS__); return 1; +#define warning(...) _alpm_log(handle, ALPM_LOG_WARNING, __VA_ARGS__); + +static int _alpm_trigger_parse_cb(const char *file, int line, const char *section, char *key, char *value, void *data) { struct _alpm_hook_cb_ctx *ctx = data; alpm_handle_t *handle = ctx->handle; struct _alpm_hook_t *hook = ctx->hook; -#define error(...) _alpm_log(handle, ALPM_LOG_ERROR, __VA_ARGS__); return 1; -#define warning(...) _alpm_log(handle, ALPM_LOG_WARNING, __VA_ARGS__); - if(!section && !key) { error(_("error while reading hook %s: %s\n"), file, strerror(errno)); } else if(!section) { @@ -166,8 +168,6 @@ static int _alpm_hook_parse_cb(const char *file, int line, struct _alpm_trigger_t *t; CALLOC(t, sizeof(struct _alpm_trigger_t), 1, return 1); hook->triggers = alpm_list_add(hook->triggers, t); - } else if(strcmp(section, "Action") == 0) { - /* no special processing required */ } else { error(_("hook %s line %d: invalid section %s\n"), file, line, section); } @@ -205,6 +205,37 @@ static int _alpm_hook_parse_cb(const char *file, int line, } else { error(_("hook %s line %d: invalid option %s\n"), file, line, key); } + } + + return 0; +} + +static int _alpm_hook_parse_cb(const char *file, int line, + const char *section, char *key, char *value, void *data) +{ + struct _alpm_hook_cb_ctx *ctx = data; + alpm_handle_t *handle = ctx->handle; + struct _alpm_hook_t *hook = ctx->hook; + + if(!section && !key) { + error(_("error while reading hook %s: %s\n"), file, strerror(errno)); + } else if(!section) { + error(_("hook %s line %d: invalid option %s\n"), file, line, key); + } else if(!key) { + /* beginning a new section */ + if(strcmp(section, "Trigger") == 0) { + if (_alpm_trigger_parse_cb(file, line, section, key, value, data) != 0) { + return 1; + } + } else if(strcmp(section, "Action") == 0) { + /* no special processing required */ + } else { + error(_("hook %s line %d: invalid section %s\n"), file, line, section); + } + } else if(strcmp(section, "Trigger") == 0) { + if (_alpm_trigger_parse_cb(file, line, section, key, value, data) != 0) { + return 1; + } } else if(strcmp(section, "Action") == 0) { if(strcmp(key, "When") == 0) { if(hook->when != 0) { @@ -249,12 +280,12 @@ static int _alpm_hook_parse_cb(const char *file, int line, } } -#undef error -#undef warning - return 0; } +#undef error +#undef warning + static int _alpm_hook_trigger_match_file(alpm_handle_t *handle, struct _alpm_hook_t *hook, struct _alpm_trigger_t *t) { @@ -466,6 +497,17 @@ static alpm_list_t *find_hook(alpm_list_t *haystack, const void *needle) return NULL; } +static alpm_list_t *find_trigger(alpm_list_t *haystack, const void *needle) { + while (haystack) { + struct _alpm_trigger_t *t = haystack->data; + if (t && t->name && strcmp(t->name, needle) == 0) { + return haystack; + } + haystack = haystack->next; + } + return NULL; +} + static ssize_t _alpm_hook_feed_targets(char *buf, ssize_t needed, alpm_list_t **pos) { size_t remaining = needed, written = 0;; @@ -529,6 +571,87 @@ static int _alpm_hook_run_hook(alpm_handle_t *handle, struct _alpm_hook_t *hook) } } +static int _alpm_hook_parse_triggers(alpm_handle_t *handle, struct _alpm_hook_t *hook, + const char *hook_path) +{ + char path[PATH_MAX]; + size_t dirlen; + struct dirent *entry; + DIR *d; + size_t suflen = strlen(ALPM_TRIGGER_SUFFIX); + int ret = 0; + + if((dirlen = strlen(hook_path) + 3) >= PATH_MAX) { + _alpm_log(handle, ALPM_LOG_ERROR, _("could not open directory: %s%s: %s\n"), + hook_path, ".d", strerror(ENAMETOOLONG)); + return -1; + } + sprintf(path, "%s.d/", hook_path); + + if(!(d = opendir(path))) { + if(errno == ENOENT) { + return 0; + } else { + _alpm_log(handle, ALPM_LOG_ERROR, + _("could not open directory: %s: %s\n"), path, strerror(errno)); + return -1; + } + } + + while((errno = 0, entry = readdir(d))) { + struct _alpm_hook_cb_ctx ctx = { handle, hook }; + size_t name_len; + struct stat buf; + + if(strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) { + continue; + } + + if((name_len = strlen(entry->d_name)) >= PATH_MAX - dirlen) { + _alpm_log(handle, ALPM_LOG_ERROR, _("could not open file: %s%s: %s\n"), + path, entry->d_name, strerror(ENAMETOOLONG)); + ret = -1; + continue; + } + memcpy(path + dirlen, entry->d_name, name_len + 1); + + if(name_len < suflen + || strcmp(entry->d_name + name_len - suflen, ALPM_TRIGGER_SUFFIX) != 0) { + _alpm_log(handle, ALPM_LOG_DEBUG, "skipping non-trigger file %s\n", path); + continue; + } + + if(find_trigger(hook->triggers, entry->d_name)) { + _alpm_log(handle, ALPM_LOG_DEBUG, "skipping overridden trigger %s\n", path); + continue; + } + + if(stat(path, &buf) != 0) { + _alpm_log(handle, ALPM_LOG_ERROR, + _("could not stat file %s: %s\n"), path, strerror(errno)); + ret = -1; + continue; + } + + if(S_ISDIR(buf.st_mode)) { + _alpm_log(handle, ALPM_LOG_DEBUG, "skipping directory %s\n", path); + continue; + } + + if(parse_ini(path, _alpm_trigger_parse_cb, &ctx) != 0) { + _alpm_log(handle, ALPM_LOG_DEBUG, "parsing trigger file %s failed\n", path); + ret = -1; + continue; + } + + STRDUP(hook->name, entry->d_name, ret = -1); + } + + closedir(d); + + return ret; +} + int _alpm_hook_run(alpm_handle_t *handle, alpm_hook_when_t when) { alpm_event_hook_t event = { .when = when }; @@ -605,6 +728,14 @@ int _alpm_hook_run(alpm_handle_t *handle, alpm_hook_when_t when) CALLOC(ctx.hook, sizeof(struct _alpm_hook_t), 1, ret = -1; closedir(d); goto cleanup); + if (_alpm_hook_parse_triggers(handle, ctx.hook, path) != 0) { + _alpm_log(handle, ALPM_LOG_DEBUG, + "parsing trigger dropins for hook file %s failed\n", path); + _alpm_hook_free(ctx.hook); + ret = -1; + continue; + } + _alpm_log(handle, ALPM_LOG_DEBUG, "parsing hook file %s\n", path); if(parse_ini(path, _alpm_hook_parse_cb, &ctx) != 0 || _alpm_hook_validate(handle, ctx.hook, path)) { diff --git a/lib/libalpm/hook.h b/lib/libalpm/hook.h index ff5de4f2..4a3bc409 100644 --- a/lib/libalpm/hook.h +++ b/lib/libalpm/hook.h @@ -23,6 +23,7 @@ #include "alpm.h" #define ALPM_HOOK_SUFFIX ".hook" +#define ALPM_TRIGGER_SUFFIX ".trigger" int _alpm_hook_run(alpm_handle_t *handle, alpm_hook_when_t when); -- 2.28.0

1 1

[pacman-dev] Arch Conf 2020
by Allan McRae 21 Aug '20

21 Aug '20

Hi all, Anyone want to do a pacman talk for Arch Conf 2020? Potentially jointly? https://lists.archlinux.org/pipermail/arch-events/2020-August/000645.html A

1 0

[pacman-dev] Making a beta release
by Allan McRae 19 Aug '20

19 Aug '20

Hi all, With the parallel downloader implementation roughly done, I'd like to make a beta release for some wider testing. Is there anything that people particularly want to land before such a testing release? Allan

2 1

[pacman-dev] Anatol is inactive due to situation in Belarus
by Anatol Pomozov 14 Aug '20

14 Aug '20

Hello folks My name is Anatol Pomozov and I am an Arch Linux developer. I've been quiet for a couple of weeks now and will probably stay away from my Arch Linux/pacman (+bcc:pacman-dev@) duties for a bit more. Please feel free to take care of my packages if it's needed. The reason for this decision is a situation that happens in my home country. I am a belarusian. My home country, my beautiful Belarus is essentially taken hostage by a usurpator Lukashenko. He has been "ruling" the country for 26 years already. Lukashenko cancelled results of the last election (where he took ~10% of votes) and declared that he is going to stay in power for another 5 years. All his political opponents were put into a jail or hiding from him abroad. Anyone who demands fair elections is terrorized by his personal army. Many people are tortured in jail. You can see what happens in Belarus in these clips https://www.youtube.com/watch?v=XG3D6881AXY https://www.youtube.com/watch?v=-6tCGnM0xiQ https://www.youtube.com/watch?v=E0VLjQvCxcc I live abroad and I am safe now. But my parents and relatives are in Belarus and they were essentially taken hostage by the Lukashenko's government. The last few weeks were stressful for me and I want to focus on my extended family as much as possible. I understand that Arch maillist might not be the place for political statements but this is something personal and something important for me. There is no place for such violence and there is no place for dictators in Europe of the 21st century. Please support Belarusian people in their fight against the usurpator. Talk to your governor/mayor/deputy/..., ask them to contact Belarusian government to stop the violence. Talk to the press, explain to them what is going on in Belarus right now. Anything that brings peace to Belarus will be helpful. Thank you. Жыве Беларусь!

1 0

[pacman-dev] [PATCH] remove more autotools files
by Eli Schwartz 11 Aug '20

11 Aug '20

We forgot to remove m4/ in commit 454ea024383eab60295e4c4fdf2c329475887b2c and now it's tragically reminding me of autotools! Also take this opportunity to drop some symlinks in lib/libalpm/ for libcommon source files. In autotools these were built specifically for libalpm and needed to be available in that directory, but the meson setup just has libalpm depend on libcommon. So these pseudo source files aren't needed anymore. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- lib/libalpm/ini.c | 1 - lib/libalpm/ini.h | 1 - lib/libalpm/util-common.c | 1 - lib/libalpm/util-common.h | 1 - m4/.gitignore | 3 - m4/acinclude.m4 | 179 ---------------------------- m4/gpgme.m4 | 238 -------------------------------------- 7 files changed, 424 deletions(-) delete mode 120000 lib/libalpm/ini.c delete mode 120000 lib/libalpm/ini.h delete mode 120000 lib/libalpm/util-common.c delete mode 120000 lib/libalpm/util-common.h delete mode 100644 m4/.gitignore delete mode 100644 m4/acinclude.m4 delete mode 100644 m4/gpgme.m4 diff --git a/lib/libalpm/ini.c b/lib/libalpm/ini.c deleted file mode 120000 index b16d2f27..00000000 --- a/lib/libalpm/ini.c +++ /dev/null @@ -1 +0,0 @@ -../../src/common/ini.c \ No newline at end of file diff --git a/lib/libalpm/ini.h b/lib/libalpm/ini.h deleted file mode 120000 index e395fa04..00000000 --- a/lib/libalpm/ini.h +++ /dev/null @@ -1 +0,0 @@ -../../src/common/ini.h \ No newline at end of file diff --git a/lib/libalpm/util-common.c b/lib/libalpm/util-common.c deleted file mode 120000 index cf965176..00000000 --- a/lib/libalpm/util-common.c +++ /dev/null @@ -1 +0,0 @@ -../../src/common/util-common.c \ No newline at end of file diff --git a/lib/libalpm/util-common.h b/lib/libalpm/util-common.h deleted file mode 120000 index 988c2acc..00000000 --- a/lib/libalpm/util-common.h +++ /dev/null @@ -1 +0,0 @@ -../../src/common/util-common.h \ No newline at end of file diff --git a/m4/.gitignore b/m4/.gitignore deleted file mode 100644 index 4bc6b527..00000000 --- a/m4/.gitignore +++ /dev/null @@ -1,3 +0,0 @@ -*.m4 -!acinclude.m4 -!gpgme.m4 diff --git a/m4/acinclude.m4 b/m4/acinclude.m4 deleted file mode 100644 index 845c8286..00000000 --- a/m4/acinclude.m4 +++ /dev/null @@ -1,179 +0,0 @@ -dnl acinclude.m4 - configure macros used by pacman and libalpm -dnl Add some custom macros for pacman and libalpm - -dnl GCC_STACK_PROTECT_LIB -dnl adds -lssp to LIBS if it is available -dnl ssp is usually provided as part of libc, but was previously a separate lib -dnl It does not hurt to add -lssp even if libc provides SSP - in that case -dnl libssp will simply be ignored. -AC_DEFUN([GCC_STACK_PROTECT_LIB],[ - AC_CACHE_CHECK([whether libssp exists], ssp_cv_lib, - [ssp_old_libs="$LIBS" - LIBS="$LIBS -lssp" - AC_TRY_LINK(,, ssp_cv_lib=yes, ssp_cv_lib=no) - LIBS="$ssp_old_libs" - ]) - if test $ssp_cv_lib = yes; then - LIBS="$LIBS -lssp" - fi -]) - -dnl GCC_STACK_PROTECT_CC -dnl checks -fstack-protector-all with the C compiler, if it exists then updates -dnl CFLAGS and defines ENABLE_SSP_CC -AC_DEFUN([GCC_STACK_PROTECT_CC],[ - AC_LANG_ASSERT(C) - if test "X$CC" != "X"; then - AC_CACHE_CHECK([whether ${CC} accepts -fstack-protector-all], - ssp_cv_cc, - [ssp_old_cflags="$CFLAGS" - CFLAGS="$CFLAGS -fstack-protector-all" - AC_TRY_COMPILE(,, ssp_cv_cc=yes, ssp_cv_cc=no) - CFLAGS="$ssp_old_cflags" - ]) - if test $ssp_cv_cc = yes; then - CFLAGS="$CFLAGS -fstack-protector-all" - AC_DEFINE([ENABLE_SSP_CC], 1, [Define if SSP C support is enabled.]) - fi - fi -]) - -dnl GCC_STACK_CLASH_PROTECTION -dnl check -fstack-clash-protection with the C compiler, if it exists then -dnl updates CFLAGS -AC_DEFUN([GCC_STACK_CLASH_PROTECTION],[ - AC_LANG_ASSERT(C) - if test "X$CC" != "X"; then - AC_CACHE_CHECK([whether ${CC} accepts -fstack-clash-protection], - scp_cv_cc, - [scp_old_cflags="$CFLAGS" - CFLAGS="$CFLAGS -fstack-clash-protection" - AC_TRY_COMPILE(,, scp_cv_cc=yes, scp_cv_cc=no) - CFLAGS="$scp_old_cflags" - ]) - if test $scp_cv_cc = yes; then - CFLAGS="$CFLAGS -fstack-clash-protection" - fi - fi -]) - -dnl GCC_FORTIFY_SOURCE_CC -dnl checks -D_FORTIFY_SOURCE with the C compiler, if it exists then updates -dnl CPPFLAGS -AC_DEFUN([GCC_FORTIFY_SOURCE_CC],[ - AC_LANG_ASSERT(C) - if test "X$CC" != "X"; then - AC_MSG_CHECKING(for FORTIFY_SOURCE support) - fs_old_cppflags="$CPPFLAGS" - fs_old_cflags="$CFLAGS" - CPPFLAGS="$CPPFLAGS -D_FORTIFY_SOURCE=2" - CFLAGS="$CFLAGS -Werror" - AC_TRY_COMPILE([#include <features.h>], [ - int main() { - #if !(__GNUC_PREREQ (4, 1) ) - #error No FORTIFY_SOURCE support - #endif - return 0; - } - ], [ - AC_MSG_RESULT(yes) - CFLAGS="$fs_old_cflags" - ], [ - AC_MSG_RESULT(no) - CPPFLAGS="$fs_old_cppflags" - CFLAGS="$fs_old_cflags" - ]) - fi -]) - -dnl GCC_VISIBILITY_CC -dnl checks -fvisibility=internal with the C compiler, if it exists then -dnl defines ENABLE_VISIBILITY_CC in both configure script and Makefiles -AC_DEFUN([GCC_VISIBILITY_CC],[ - AC_LANG_ASSERT(C) - if test "X$CC" != "X"; then - AC_CACHE_CHECK([whether ${CC} accepts -fvisibility=internal], - visibility_cv_cc, - [visibility_old_cflags="$CFLAGS" - CFLAGS="$CFLAGS -fvisibility=internal" - AC_TRY_COMPILE(,, visibility_cv_cc=yes, visibility_cv_cc=no) - CFLAGS="$visibility_old_cflags" - ]) - if test $visibility_cv_cc = yes; then - AC_DEFINE([ENABLE_VISIBILITY_CC], 1, [Define if symbol visibility C support is enabled.]) - fi - AM_CONDITIONAL([ENABLE_VISIBILITY_CC], test "x$visibility_cv_cc" = "xyes") - fi -]) - -dnl CFLAGS_ADD(PARAMETER, VARIABLE) -dnl Adds parameter to VARIABLE if the compiler supports it. For example, -dnl CFLAGS_ADD([-Wall],[WARN_FLAGS]). -AC_DEFUN([CFLAGS_ADD], -[AS_VAR_PUSHDEF([my_cflags], [cflags_cv_warn_$1])dnl -AC_CACHE_CHECK([whether compiler handles $1], [my_cflags], [ - save_CFLAGS="$CFLAGS" - CFLAGS="${CFLAGS} -Werror=unknown-warning-option" - AC_COMPILE_IFELSE([AC_LANG_PROGRAM([])], - [], - [CFLAGS="$save_CFLAGS"]) - CFLAGS="${CFLAGS} $1" - AC_COMPILE_IFELSE([AC_LANG_PROGRAM([])], - [AS_VAR_SET([my_cflags], [yes])], - [AS_VAR_SET([my_cflags], [no])]) - CFLAGS="$save_CFLAGS" -]) -AS_VAR_PUSHDEF([new_cflags], [[$2]])dnl -AS_VAR_IF([my_cflags], [yes], [AS_VAR_APPEND([new_cflags], [" $1"])]) -AS_VAR_POPDEF([new_cflags])dnl -AS_VAR_POPDEF([my_cflags])dnl -m4_ifval([$2], [AS_LITERAL_IF([$2], [AC_SUBST([$2])], [])])dnl -]) - -dnl Checks for getmntinfo and determines whether it uses statfs or statvfs -AC_DEFUN([FS_STATS_TYPE], - [AC_CACHE_CHECK([filesystem statistics type], fs_stats_cv_type, - [AC_CHECK_FUNC(getmntinfo, - [AC_COMPILE_IFELSE( - [AC_LANG_PROGRAM([[ -# include <sys/param.h> -# include <sys/mount.h> -#if HAVE_SYS_UCRED_H -#include <sys/ucred.h> -#endif -extern int getmntinfo (struct statfs **, int); -]], - [])], - [fs_stats_cv_type="struct statfs"], - [fs_stats_cv_type="struct statvfs"])], - [AC_CHECK_FUNC(getmntent, - [fs_stats_cv_type="struct statvfs"])] - )] - ) - AC_DEFINE_UNQUOTED(FSSTATSTYPE, [$fs_stats_cv_type], - [Defined as the filesystem stats type ('statvfs' or 'statfs')]) - if test $ac_cv_func_getmntinfo = yes; then - if test "$fs_stats_cv_type" = "struct statvfs"; then - AC_DEFINE([HAVE_GETMNTINFO_STATVFS], 1, [Define if getmntinfo() uses statvfs.]) - else - AC_DEFINE([HAVE_GETMNTINFO_STATFS], 1, [Define if getmntinfo() uses statfs.]) - fi - fi -]) - -dnl Checks for PATH_MAX and defines it if not present -AC_DEFUN([PATH_MAX_DEFINED], - [AC_CACHE_CHECK([PATH_MAX defined], path_max_cv_defined, - [AC_EGREP_CPP(yes, [[ -#include <limits.h> -#if defined(PATH_MAX) -yes -#endif -]], - [path_max_cv_defined=yes], - [path_max_cv_defined=no])] - ) - if test $path_max_cv_defined = no; then - AC_DEFINE([PATH_MAX], 4096, [Define if PATH_MAX is undefined by limits.h.]) - fi -]) diff --git a/m4/gpgme.m4 b/m4/gpgme.m4 deleted file mode 100644 index fe17f21a..00000000 --- a/m4/gpgme.m4 +++ /dev/null @@ -1,238 +0,0 @@ -# gpgme.m4 - autoconf macro to detect GPGME. -# Copyright (C) 2002, 2003, 2004 g10 Code GmbH -# -# This file is free software; as a special exception the author gives -# unlimited permission to copy and/or distribute it, with or without -# modifications, as long as this notice is preserved. -# -# This file is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY, to the extent permitted by law; without even the -# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. - - -AC_DEFUN([_AM_PATH_GPGME_CONFIG], -[ AC_ARG_WITH(gpgme-prefix, - AC_HELP_STRING([--with-gpgme-prefix=PFX], - [prefix where GPGME is installed (optional)]), - gpgme_config_prefix="$withval", gpgme_config_prefix="") - if test "x$gpgme_config_prefix" != x ; then - GPGME_CONFIG="$gpgme_config_prefix/bin/gpgme-config" - fi - AC_PATH_PROG(GPGME_CONFIG, gpgme-config, no) - - if test "$GPGME_CONFIG" != "no" ; then - gpgme_version=`$GPGME_CONFIG --version` - fi - gpgme_version_major=`echo $gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$.*/\1/'` - gpgme_version_minor=`echo $gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$.*/\2/'` - gpgme_version_micro=`echo $gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$.*/\3/'` -]) - -dnl AM_PATH_GPGME([MINIMUM-VERSION, -dnl [ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND ]]]) -dnl Test for libgpgme and define GPGME_CFLAGS and GPGME_LIBS. -dnl -AC_DEFUN([AM_PATH_GPGME], -[ AC_REQUIRE([_AM_PATH_GPGME_CONFIG])dnl - tmp=ifelse([$1], ,1:0.4.2,$1) - if echo "$tmp" | grep ':' >/dev/null 2>/dev/null ; then - req_gpgme_api=`echo "$tmp" | sed 's/$.*$:$.*$/\1/'` - min_gpgme_version=`echo "$tmp" | sed 's/$.*$:$.*$/\2/'` - else - req_gpgme_api=0 - min_gpgme_version="$tmp" - fi - - AC_MSG_CHECKING(for GPGME - version >= $min_gpgme_version) - ok=no - if test "$GPGME_CONFIG" != "no" ; then - req_major=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\1/'` - req_minor=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\2/'` - req_micro=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\3/'` - if test "$gpgme_version_major" -gt "$req_major"; then - ok=yes - else - if test "$gpgme_version_major" -eq "$req_major"; then - if test "$gpgme_version_minor" -gt "$req_minor"; then - ok=yes - else - if test "$gpgme_version_minor" -eq "$req_minor"; then - if test "$gpgme_version_micro" -ge "$req_micro"; then - ok=yes - fi - fi - fi - fi - fi - fi - if test $ok = yes; then - # If we have a recent GPGME, we should also check that the - # API is compatible. - if test "$req_gpgme_api" -gt 0 ; then - tmp=`$GPGME_CONFIG --api-version 2>/dev/null || echo 0` - if test "$tmp" -gt 0 ; then - if test "$req_gpgme_api" -ne "$tmp" ; then - ok=no - fi - fi - fi - fi - if test $ok = yes; then - GPGME_CFLAGS=`$GPGME_CONFIG --cflags` - GPGME_LIBS=`$GPGME_CONFIG --libs` - AC_MSG_RESULT(yes) - ifelse([$2], , :, [$2]) - else - GPGME_CFLAGS="" - GPGME_LIBS="" - AC_MSG_RESULT(no) - ifelse([$3], , :, [$3]) - fi - AC_SUBST(GPGME_CFLAGS) - AC_SUBST(GPGME_LIBS) -]) - -dnl AM_PATH_GPGME_PTHREAD([MINIMUM-VERSION, -dnl [ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND ]]]) -dnl Test for libgpgme and define GPGME_PTHREAD_CFLAGS -dnl and GPGME_PTHREAD_LIBS. -dnl -AC_DEFUN([AM_PATH_GPGME_PTHREAD], -[ AC_REQUIRE([_AM_PATH_GPGME_CONFIG])dnl - tmp=ifelse([$1], ,1:0.4.2,$1) - if echo "$tmp" | grep ':' >/dev/null 2>/dev/null ; then - req_gpgme_api=`echo "$tmp" | sed 's/$.*$:$.*$/\1/'` - min_gpgme_version=`echo "$tmp" | sed 's/$.*$:$.*$/\2/'` - else - req_gpgme_api=0 - min_gpgme_version="$tmp" - fi - - AC_MSG_CHECKING(for GPGME pthread - version >= $min_gpgme_version) - ok=no - if test "$GPGME_CONFIG" != "no" ; then - if `$GPGME_CONFIG --thread=pthread 2> /dev/null` ; then - req_major=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\1/'` - req_minor=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\2/'` - req_micro=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\3/'` - if test "$gpgme_version_major" -gt "$req_major"; then - ok=yes - else - if test "$gpgme_version_major" -eq "$req_major"; then - if test "$gpgme_version_minor" -gt "$req_minor"; then - ok=yes - else - if test "$gpgme_version_minor" -eq "$req_minor"; then - if test "$gpgme_version_micro" -ge "$req_micro"; then - ok=yes - fi - fi - fi - fi - fi - fi - fi - if test $ok = yes; then - # If we have a recent GPGME, we should also check that the - # API is compatible. - if test "$req_gpgme_api" -gt 0 ; then - tmp=`$GPGME_CONFIG --api-version 2>/dev/null || echo 0` - if test "$tmp" -gt 0 ; then - if test "$req_gpgme_api" -ne "$tmp" ; then - ok=no - fi - fi - fi - fi - if test $ok = yes; then - GPGME_PTHREAD_CFLAGS=`$GPGME_CONFIG --thread=pthread --cflags` - GPGME_PTHREAD_LIBS=`$GPGME_CONFIG --thread=pthread --libs` - AC_MSG_RESULT(yes) - ifelse([$2], , :, [$2]) - else - GPGME_PTHREAD_CFLAGS="" - GPGME_PTHREAD_LIBS="" - AC_MSG_RESULT(no) - ifelse([$3], , :, [$3]) - fi - AC_SUBST(GPGME_PTHREAD_CFLAGS) - AC_SUBST(GPGME_PTHREAD_LIBS) -]) - - -dnl AM_PATH_GPGME_GLIB([MINIMUM-VERSION, -dnl [ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND ]]]) -dnl Test for libgpgme-glib and define GPGME_GLIB_CFLAGS and GPGME_GLIB_LIBS. -dnl -AC_DEFUN([AM_PATH_GPGME_GLIB], -[ AC_REQUIRE([_AM_PATH_GPGME_CONFIG])dnl - tmp=ifelse([$1], ,1:0.4.2,$1) - if echo "$tmp" | grep ':' >/dev/null 2>/dev/null ; then - req_gpgme_api=`echo "$tmp" | sed 's/$.*$:$.*$/\1/'` - min_gpgme_version=`echo "$tmp" | sed 's/$.*$:$.*$/\2/'` - else - req_gpgme_api=0 - min_gpgme_version="$tmp" - fi - - AC_MSG_CHECKING(for GPGME - version >= $min_gpgme_version) - ok=no - if test "$GPGME_CONFIG" != "no" ; then - req_major=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\1/'` - req_minor=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\2/'` - req_micro=`echo $min_gpgme_version | \ - sed 's/$[[0-9]]*$\.$[[0-9]]*$\.$[[0-9]]*$/\3/'` - if test "$gpgme_version_major" -gt "$req_major"; then - ok=yes - else - if test "$gpgme_version_major" -eq "$req_major"; then - if test "$gpgme_version_minor" -gt "$req_minor"; then - ok=yes - else - if test "$gpgme_version_minor" -eq "$req_minor"; then - if test "$gpgme_version_micro" -ge "$req_micro"; then - ok=yes - fi - fi - fi - fi - fi - fi - if test $ok = yes; then - # If we have a recent GPGME, we should also check that the - # API is compatible. - if test "$req_gpgme_api" -gt 0 ; then - tmp=`$GPGME_CONFIG --api-version 2>/dev/null || echo 0` - if test "$tmp" -gt 0 ; then - if test "$req_gpgme_api" -ne "$tmp" ; then - ok=no - fi - fi - fi - fi - if test $ok = yes; then - GPGME_GLIB_CFLAGS=`$GPGME_CONFIG --glib --cflags` - GPGME_GLIB_LIBS=`$GPGME_CONFIG --glib --libs` - AC_MSG_RESULT(yes) - ifelse([$2], , :, [$2]) - else - GPGME_GLIB_CFLAGS="" - GPGME_GLIB_LIBS="" - AC_MSG_RESULT(no) - ifelse([$3], , :, [$3]) - fi - AC_SUBST(GPGME_GLIB_CFLAGS) - AC_SUBST(GPGME_GLIB_LIBS) -]) - -- 2.28.0

2 1

[pacman-dev] [PATCH] Highlight changed part of new version numbers to let users easily distiguish between major, minor, bugfix and internal updates
by Lars Øyvind Hagland 10 Aug '20

10 Aug '20

Signed-off-by: Lars Øyvind Hagland <larsoc(a)gmail.com> --- src/pacman/util.c | 55 ++++++++++++++++++++++++++++++++++++++++++----- src/pacman/util.h | 2 ++ 2 files changed, 52 insertions(+), 5 deletions(-) diff --git a/src/pacman/util.c b/src/pacman/util.c index e9187529..d3c89ecb 100644 --- a/src/pacman/util.c +++ b/src/pacman/util.c @@ -531,7 +531,12 @@ static void table_print_line(const alpm_list_t *line, short col_padding, if(cell->mode & CELL_TITLE) { printf("%s%*s%s", config->colstr.title, cell_width, str, config->colstr.nocolor); } else { - printf("%*s", cell_width, str); + // printf includes ANSI control chars in width, pad manually with actual width + if (cell_width > 0) { + printf("%*s%s", cell_width - (int)cell->len, "", str); + } else { + printf("%s%*s", str, -cell_width - (int)cell->len, ""); + } } need_padding = 1; } @@ -860,8 +865,10 @@ static alpm_list_t *create_verbose_row(pm_target_t *target) target->remove != NULL ? alpm_pkg_get_version(target->remove) : ""); add_table_cell(&ret, str, CELL_NORMAL | CELL_FREE); - pm_asprintf(&str, "%s", - target->install != NULL ? alpm_pkg_get_version(target->install) : ""); + str = version_colorize_diff( + target->install ? alpm_pkg_get_version(target->install) : "", + target->remove ? alpm_pkg_get_version(target->remove) : "", + config->colstr.title); add_table_cell(&ret, str, CELL_NORMAL | CELL_FREE); /* and size */ @@ -886,7 +893,7 @@ static alpm_list_t *create_verbose_row(pm_target_t *target) /* prepare a list of pkgs to display */ static void _display_targets(alpm_list_t *targets, int verbose) { - char *str; + char *str, *version; off_t isize = 0, rsize = 0, dlsize = 0; unsigned short cols; alpm_list_t *i, *names = NULL, *header = NULL, *rows = NULL; @@ -918,8 +925,12 @@ static void _display_targets(alpm_list_t *targets, int verbose) } if(target->install) { + version = version_colorize_diff(alpm_pkg_get_version(target->install), + target->remove ? alpm_pkg_get_version(target->remove) : "", + config->colstr.nocolor); pm_asprintf(&str, "%s%s-%s%s", alpm_pkg_get_name(target->install), config->colstr.faint, - alpm_pkg_get_version(target->install), config->colstr.nocolor); + version, config->colstr.nocolor); + free(version); } else if(isize == 0) { pm_asprintf(&str, "%s%s-%s%s", alpm_pkg_get_name(target->remove), config->colstr.faint, alpm_pkg_get_version(target->remove), config->colstr.nocolor); @@ -1676,6 +1687,40 @@ int colon_printf(const char *fmt, ...) return ret; } +/** Highlight the changed part of the version string + * + * Inserts an ANSI color tag before the first changed version part and a + * no-color tag at the end. + * + * @param version The new version string + * @param old_version The old version string + * @param color The color of the highlighted part + * @return Pointer to the new string + */ +char *version_colorize_diff(const char *version, const char *old_version, const char *color) +{ + char *ret; + char start[strlen(version)], end[strlen(version)]; + unsigned long pos = 0; + + while ((pos < strlen(version)) + && (pos < strlen(old_version)) + && (version[pos] == old_version[pos])) + pos++; + while (pos > 0 + && version[pos] != '.' + && version[pos] != '-') + pos--; + if (pos != 0) + pos++; + + strncpy(start, version, pos); + start[pos] = '\0'; // strncpy does not add delimiter + strcpy(end, &version[pos]); + pm_asprintf(&ret, "%s%s%s%s", start, color, end, config->colstr.nocolor); + return ret; +} + int pm_printf(alpm_loglevel_t level, const char *format, ...) { int ret; diff --git a/src/pacman/util.h b/src/pacman/util.h index c97048fb..7597da40 100644 --- a/src/pacman/util.h +++ b/src/pacman/util.h @@ -81,6 +81,8 @@ int yesno(const char *format, ...) __attribute__((format(printf, 1, 2))); int noyes(const char *format, ...) __attribute__((format(printf, 1, 2))); char *arg_to_string(int argc, char *argv[]); char *safe_fgets_stdin(char *s, int size); +char *version_colorize_diff(const char *version, const char *old_version, const char *color); + void console_cursor_hide(void); void console_cursor_show(void); void console_cursor_move_up(unsigned int lines); -- 2.27.0

2 1

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.2.1-113-gf53ac85f
by Allan McRae 10 Aug '20

10 Aug '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via f53ac85ff6cd2f74f8157f23a5e21650cd17f372 (commit) via 62246b9355867ab83566998303c921af6b1e38ef (commit) via 2403fc97325908043917732b32adf87a2eaff603 (commit) via 74aacf44958e1343b910b3fbdcf753393857f070 (commit) from 2a352dc059f696eeda1e18116e468994c1a38430 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f53ac85ff6cd2f74f8157f23a5e21650cd17f372 Author: Anatol Pomozov <anatol.pomozov(a)gmail.com> Date: Fri Jul 31 09:53:15 2020 -0700 Enable sha256/md5 hash verification if detached signatures are used Pacman has multiple ways to verify package content integrity: - gpg signature - sha256 - md5 These verification mechanisms overlap each other. gpg signatures already contain hash value of the package content. So if a package signature is present then pacman ignored the other 2 hash values. This worked well with signtures embedded into pacman database. Recently pacman got an ability to handle detached signatures (*.sig files located next to the package files). If pacman verifies detached signature only then one can replace pkg+sig files with some other content and pacman still processes it as a valid package. To prevent it we need to verify database<->package integrity using hash values stored in the database. This commit fixes FS#67232 The new debug output is: checking package integrity... debug: found cached pkg: /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: sha256sum: 77baf61c62c5570b3a37cf0c3b16c5d9a97dde6fedd1a3528bf0cc5f96dd5e52 debug: checking sha256sum for /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: sig data: <from .sig> debug: checking signature for /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: 1 signatures returned debug: fingerprint: B5971F2C5C10A9A08C60030F786C63F330D7CB92 Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 62246b9355867ab83566998303c921af6b1e38ef Author: Anatol Pomozov <anatol.pomozov(a)gmail.com> Date: Fri Jul 31 09:54:42 2020 -0700 Fix error during keyring checking With current master version the 'keyring checking' step produces an error: debug: returning error 6 from alpm_pkg_get_sig (../lib/libalpm/package.c: 274) : wrong or NULL argument passed The package signature is still checked later at the integrity verification step though. This commit fixes keyring checking and now the debug log looks like this: debug: found cached pkg: /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: found detached signature /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst.sig with size 566 debug: found signature key: 786C63F330D7CB92 debug: looking up key 786C63F330D7CB92 locally debug: key lookup success, key exists Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 2403fc97325908043917732b32adf87a2eaff603 Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Wed Aug 5 10:02:10 2020 -0400 repo-add: use more libmakepkg to handle common compression routines Currently the list of supported formats for an archive, is maintained in two places. And repo-add does not actually get updated. :( In the process, remove some of the logical duplication when calling bsdtar/compress_as. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 74aacf44958e1343b910b3fbdcf753393857f070 Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Wed Aug 5 10:02:09 2020 -0400 libmakepkg: extend compress.sh to also permit checking validity get_compression_command() can now be used to do upfront checks for whether a given extension is known to do something successfully. This is useful when writing tools in which an unknown compression type is a fatal error. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: lib/libalpm/be_package.c | 2 +- lib/libalpm/package.c | 4 +-- scripts/libmakepkg/util/compress.sh.in | 53 +++++++++++++++++++++++++--------- scripts/repo-add.sh.in | 32 ++++++++------------ 4 files changed, 54 insertions(+), 37 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [PATCH] Fix error during keyring checking
by Anatol Pomozov 10 Aug '20

10 Aug '20

With current master version the 'keyring checking' step produces an error: debug: returning error 6 from alpm_pkg_get_sig (../lib/libalpm/package.c: 274) : wrong or NULL argument passed The package signature is still checked later at the integrity verification step though. This commit fixes keyring checking and now the debug log looks like this: debug: found cached pkg: /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: found detached signature /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst.sig with size 566 debug: found signature key: 786C63F330D7CB92 debug: looking up key 786C63F330D7CB92 locally debug: key lookup success, key exists Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- lib/libalpm/package.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/lib/libalpm/package.c b/lib/libalpm/package.c index 0885b27b..a4356518 100644 --- a/lib/libalpm/package.c +++ b/lib/libalpm/package.c @@ -270,9 +270,7 @@ const char SYMEXPORT *alpm_pkg_get_base64_sig(alpm_pkg_t *pkg) int SYMEXPORT alpm_pkg_get_sig(alpm_pkg_t *pkg, unsigned char **sig, size_t *sig_len) { - if(pkg != NULL) { - RET_ERR(pkg->handle, ALPM_ERR_WRONG_ARGS, -1); - } + ASSERT(pkg != NULL, return -1); if(pkg->base64_sig) { int ret = alpm_decode_signature(pkg->base64_sig, sig, sig_len); -- 2.28.0

2 3

[pacman-dev] [PATCH v3 1/2] libmakepkg: extend compress.sh to also permit checking validity
by Eli Schwartz 09 Aug '20

09 Aug '20

get_compression_command() can now be used to do upfront checks for whether a given extension is known to do something successfully. This is useful when writing tools in which an unknown compression type is a fatal error. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- v3: split commit, this first part implements a function useful for checking if we have a known good compression type scripts/libmakepkg/util/compress.sh.in | 53 +++++++++++++++++++------- 1 file changed, 40 insertions(+), 13 deletions(-) diff --git a/scripts/libmakepkg/util/compress.sh.in b/scripts/libmakepkg/util/compress.sh.in index 16420beb..d35a01fa 100644 --- a/scripts/libmakepkg/util/compress.sh.in +++ b/scripts/libmakepkg/util/compress.sh.in @@ -24,6 +24,7 @@ LIBMAKEPKG_UTIL_COMPRESS_SH=1 LIBRARY=${LIBRARY:-'@libmakepkgdir@'} source "$LIBRARY/util/message.sh" +source "$LIBRARY/util/pkgbuild.sh" # Wrapper around many stream compression formats, for use in the middle of a @@ -31,20 +32,46 @@ source "$LIBRARY/util/message.sh" compress_as() { # $1: final archive filename extension for compression type detection - local ext=".tar${1##*.tar}" + local cmd ext=${1#${1%.tar*}} + + if ! get_compression_command "$ext" cmd; then + warning "$(gettext "'%s' is not a valid archive extension.")" "${ext:-${1##*/}}" + cat + else + "${cmd[@]}" + fi +} + +# Retrieve the compression command for an archive extension, or cat for .tar, +# and save it to an existing array name. If the extension cannot be found, +# clear the array and return failure. +get_compression_command() { + local extarray ext=$1 outputvar=$2 + local resolvecmd=() fallback=() case "$ext" in - *.tar.gz) ${COMPRESSGZ[@]:-gzip -c -f -n} ;; - *.tar.bz2) ${COMPRESSBZ2[@]:-bzip2 -c -f} ;; - *.tar.xz) ${COMPRESSXZ[@]:-xz -c -z -} ;; - *.tar.zst) ${COMPRESSZST[@]:-zstd -c -z -q -} ;; - *.tar.lrz) ${COMPRESSLRZ[@]:-lrzip -q} ;; - *.tar.lzo) ${COMPRESSLZO[@]:-lzop -q} ;; - *.tar.Z) ${COMPRESSZ[@]:-compress -c -f} ;; - *.tar.lz4) ${COMPRESSLZ4[@]:-lz4 -q} ;; - *.tar.lz) ${COMPRESSLZ[@]:-lzip -c -f} ;; - *.tar) cat ;; - *) warning "$(gettext "'%s' is not a valid archive extension.")" \ - "$ext"; cat ;; + *.tar.gz) fallback=(gzip -c -f -n) ;; + *.tar.bz2) fallback=(bzip2 -c -f) ;; + *.tar.xz) fallback=(xz -c -z -) ;; + *.tar.zst) fallback=(zstd -c -z -q -) ;; + *.tar.lrz) fallback=(lrzip -q) ;; + *.tar.lzo) fallback=(lzop -q) ;; + *.tar.Z) fallback=(compress -c -f) ;; + *.tar.lz4) fallback=(lz4 -q) ;; + *.tar.lz) fallback=(lzip -c -f) ;; + *.tar) fallback=(cat) ;; + # do not respect unknown COMPRESS* env vars + *) array_build "$outputvar" resolvecmd; return 1 ;; esac + + ext=${ext#*.tar.} + if [[ -n $ext ]]; then + extarray="COMPRESS${ext^^}[@]" + resolvecmd=("${!extarray}") + fi + if (( ${#resolvecmd[@]} == 0 )); then + resolvecmd=("${fallback[@]}") + fi + + array_build "$outputvar" resolvecmd } -- 2.28.0

2 2

[pacman-dev] [PATCH v2] Enable sha256/md5 hash verification if detached signatures are used
by Anatol Pomozov 31 Jul '20

31 Jul '20

Pacman has multiple ways to verify package content integrity: - gpg signature - sha256 - md5 These verification mechanisms overlap each other. gpg signatures already contain hash value of the package content. So if a package signature is present then pacman ignored the other 2 hash values. This worked well with signtures embedded into pacman database. Recently pacman got an ability to handle detached signatures (*.sig files located next to the package files). If pacman verifies detached signature only then one can replace pkg+sig files with some other content and pacman still processes it as a valid package. To prevent it we need to verify database<->package integrity using hash values stored in the database. This commit fixes FS#67232 The new debug output is: checking package integrity... debug: found cached pkg: /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: sha256sum: 77baf61c62c5570b3a37cf0c3b16c5d9a97dde6fedd1a3528bf0cc5f96dd5e52 debug: checking sha256sum for /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: sig data: <from .sig> debug: checking signature for /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: 1 signatures returned debug: fingerprint: B5971F2C5C10A9A08C60030F786C63F330D7CB92 Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- lib/libalpm/be_package.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/libalpm/be_package.c b/lib/libalpm/be_package.c index f98832f4..4dde7167 100644 --- a/lib/libalpm/be_package.c +++ b/lib/libalpm/be_package.c @@ -311,7 +311,7 @@ int _alpm_pkg_validate_internal(alpm_handle_t *handle, } } - if(syncpkg && !has_sig) { + if(syncpkg && (!has_sig || !syncpkg->base64_sig)) { if(syncpkg->md5sum && !syncpkg->sha256sum) { _alpm_log(handle, ALPM_LOG_DEBUG, "md5sum: %s\n", syncpkg->md5sum); _alpm_log(handle, ALPM_LOG_DEBUG, "checking md5sum for %s\n", pkgfile); -- 2.28.0

1 0