[pacman-dev] [PATCH] makepkg: add mtree file into package
Add an mtree file to the package with all file information. This can be added to the local pacman database on install allowing full package verification. Signed-off-by: Allan McRae <allan@archlinux.org> --- Two things I want to query here... 1) bsdtar -czf .MTREE .... When creating the package, we use gzip instead of bsdtar's -z option due to it including time stamps. From memory this was important due to package deltas. So I guess that does not apply here? 2) The timestamps are interesting.... - etc/bash_completion.d/burp time=1335764490.307580112 - etc/bash_completion.d/burp time=1335764490.0 The first is from creating the .MTREE file before compressing the package. The second is creating the mtree file from files on the filesystem after the package is installed. Does anyone know what is going on here? I guess we can just round the times in the mtree file to the nearest second when checking. scripts/makepkg.sh.in | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index d1251b8..fa8ba66 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -1350,8 +1350,6 @@ create_package() { done # tar it up - msg2 "$(gettext "Compressing package...")" - local fullver=$(get_full_version) local pkg_file="$PKGDEST/${nameofpkg}-${fullver}-${pkgarch}${PKGEXT}" local ret=0 @@ -1362,6 +1360,14 @@ create_package() { # when fileglobbing, we want * in an empty directory to expand to # the null string rather than itself shopt -s nullglob + + msg2 "$(gettext "Generating .MTREE file...")" + bsdtar -czf .MTREE --format=mtree \ + --options='!all,use-set,type,uid,gid,mode,size,time,md5' \ + "${comp_files[@]}" * + comp_files+=(".MTREE") + + msg2 "$(gettext "Compressing package...")" # TODO: Maybe this can be set globally for robustness shopt -s -o pipefail # bsdtar's gzip compression always saves the time stamp, making one -- 1.7.10
On 30.04.2012 08:22, Allan McRae wrote:
Add an mtree file to the package with all file information. This can be added to the local pacman database on install allowing full package verification.
Signed-off-by: Allan McRae <allan@archlinux.org> ---
Two things I want to query here...
1) bsdtar -czf .MTREE .... When creating the package, we use gzip instead of bsdtar's -z option due to it including time stamps. From memory this was important due to package deltas. So I guess that does not apply here?
2) The timestamps are interesting.... - etc/bash_completion.d/burp time=1335764490.307580112 - etc/bash_completion.d/burp time=1335764490.0 The first is from creating the .MTREE file before compressing the package. The second is creating the mtree file from files on the filesystem after the package is installed. Does anyone know what is going on here?
Tar saves the time as a UNIX timestamp so the precision is seconds. file systems range from 1 second precision to (for whatever reason) 1 nanosecond. Therefore if you extract the tarball the extra precision you had before will simply be cut off.
I guess we can just round the times in the mtree file to the nearest second when checking.
IMHO convert to int, don't round, but since we also have md5 sums, I think checking should better use those. -- Florian Pritz
On Mon, Apr 30, 2012 at 4:55 AM, Florian Pritz <bluewind@xinu.at> wrote:
On 30.04.2012 08:22, Allan McRae wrote:
Add an mtree file to the package with all file information. This can be added to the local pacman database on install allowing full package verification.
Signed-off-by: Allan McRae <allan@archlinux.org> ---
Two things I want to query here...
1) bsdtar -czf .MTREE .... When creating the package, we use gzip instead of bsdtar's -z option due to it including time stamps. From memory this was important due to package deltas. So I guess that does not apply here?
2) The timestamps are interesting.... - etc/bash_completion.d/burp time=1335764490.307580112 - etc/bash_completion.d/burp time=1335764490.0 The first is from creating the .MTREE file before compressing the package. The second is creating the mtree file from files on the filesystem after the package is installed. Does anyone know what is going on here?
Tar saves the time as a UNIX timestamp so the precision is seconds. file systems range from 1 second precision to (for whatever reason) 1 nanosecond. Therefore if you extract the tarball the extra precision you had before will simply be cut off. POSIX/PAX format tar files can save with nanosecond resolution, so keep that in mind. See the --posix flag to bsdtar (which we aren't currently using).
I guess we can just round the times in the mtree file to the nearest second when checking.
IMHO convert to int, don't round, but since we also have md5 sums, I think checking should better use those. Yes, you'd want to truncate, not round, as I believe this is what is done on extraction or on filesystems that don't support ns resolution. Note that in libarchive, you use two functions to get the two components, so this is trivial. (archive_entry_mtime + archive_entry_mtime_nsec, etc.)
-Dan
participants (3)
-
Allan McRae
-
Dan McGee
-
Florian Pritz