This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via deac9731884a83ad91eab9f27b288f406f56c87b (commit) via 445aa3b52cfcd5630ec10d2ae2c8eeffa2b5c5de (commit) via bbab90836b2f7d8b03c862f35bc6e3ff2bd628d2 (commit) via 3c410309644ecc4800a9aa6d96693a5630515701 (commit) via fd9ff672b0010650297e645c4fd1bd1cc320e3ef (commit) via acf95f6b3b6e2bef174da51e799bd07ce9f4cfd0 (commit) via 137a4086de310e2d31cb719806e01cd9eb414ec0 (commit) via 488ca2426568163721153822af8269447e481c7d (commit) via 5782b8356c9b9d2c5e21694de22b1441277574b7 (commit) via e49abc9860cfe9470a5828d3bb0ad38fd57a0fad (commit) via b0dac754d27b45e4346b010e674f7faa466e0025 (commit) via 289fdf0d1d9c88f0c8a6502cc311599c63a04723 (commit) via f6c55b3c3f395839c0973c36b7a7e05984636a61 (commit) via 1ada16f0177f9bfcaed95cf3b71b7029290a5f1d (commit) via 2d7a41539b73b373b63d7e2d61ed519e19878799 (commit) from 94204d108984c46966c681a05f232d830812d440 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit deac9731884a83ad91eab9f27b288f406f56c87b Author: Levente Polyak <anthraxx@archlinux.org> Date: Sat Jul 18 17:58:23 2015 +0200 ensure matching database and package version While loading each package ensure that the internal version matches the expected database version to avoid the possibility to circumvent the version check. This issue can be used by an attacker to trick the software into installing an older version. The behavior can be exploited by a man-in-the-middle attack through specially crafted database tarball containing a higher version, yet actually delivering an older and vulnerable version, which was previously shipped. Signed-off-by: Levente Polyak <anthraxx@archlinux.org> Signed-off-by: Remi Gacogne <rgacogne@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org> commit 445aa3b52cfcd5630ec10d2ae2c8eeffa2b5c5de Author: Dave Reisner <dreisner@archlinux.org> Date: Sun Jul 19 09:50:40 2015 -0400 dont remove x bit when marking pkgdir RO f170a94c137d355 potentially causes $pkgdirbase/$pkg to be undeleteable with -R or -C if a previous build was interrupted. We simply can't traverse to this directory, and rm blows up. Signed-off-by: Allan McRae <allan@archlinux.org> commit bbab90836b2f7d8b03c862f35bc6e3ff2bd628d2 Author: Allan McRae <allan@archlinux.org> Date: Mon Jul 20 11:43:27 2015 +1000 libmakepkg: lint_package requires cd_safe Signed-off-by: Allan McRae <allan@archlinux.org> commit 3c410309644ecc4800a9aa6d96693a5630515701 Author: Allan McRae <allan@archlinux.org> Date: Sat Jun 20 17:26:22 2015 +1000 Handle repo/pkg style arguments to sync repo file listing Passing "-Fl pkg" will print the filelist for the first occurance of "pkg" in the sync repos. Other version of the package can be printed using "-Fl repo/pkg". Signed-off-by: Allan McRae <allan@archlinux.org> commit fd9ff672b0010650297e645c4fd1bd1cc320e3ef Author: Allan McRae <allan@archlinux.org> Date: Thu Jun 18 19:27:51 2015 +1000 Add regex search option to sync database file searching e.g. pacman -Fsx kcm.*print.*\.so Signed-off-by: Allan McRae <allan@archlinux.org> commit acf95f6b3b6e2bef174da51e799bd07ce9f4cfd0 Author: Allan McRae <allan@archlinux.org> Date: Thu Jun 18 18:28:13 2015 +1000 Implement searching for a file in the sync databases Locates all packages that contain the listed file e.g. pacman -Fs libpng.so Signed-off-by: Allan McRae <allan@archlinux.org> commit 137a4086de310e2d31cb719806e01cd9eb414ec0 Author: Allan McRae <allan@archlinux.org> Date: Thu Jun 18 13:19:09 2015 +1000 Implement listing files from sync packages Does the equivalent of the -Ql option for local packages e.g. pacman -Fl glibc Signed-off-by: Allan McRae <allan@archlinux.org> commit 488ca2426568163721153822af8269447e481c7d Author: Allan McRae <allan@archlinux.org> Date: Thu Jun 18 01:57:38 2015 +1000 Implement locating file owner in sync files database Equivalent to -Qo but for packages in the sync database e.g. pacman -Fo /usr/bin/pacman Signed-off-by: Allan McRae <allan@archlinux.org> commit 5782b8356c9b9d2c5e21694de22b1441277574b7 Author: Allan McRae <allan@archlinux.org> Date: Wed Jun 17 23:56:21 2015 +1000 Prototype pacman files database operations Add the -F/--files operations, -s/--sync support and nd provide dummy functions for -s/--search, -l/-list and -o/--owns. Signed-off-by: Allan McRae <allan@archlinux.org> commit e49abc9860cfe9470a5828d3bb0ad38fd57a0fad Author: Allan McRae <allan@archlinux.org> Date: Thu Jun 18 00:12:14 2015 +1000 pacman: move database syncing to util.c Signed-off-by: Allan McRae <allan@archlinux.org> commit b0dac754d27b45e4346b010e674f7faa466e0025 Author: Allan McRae <allan@archlinux.org> Date: Wed Jun 17 22:27:50 2015 +1000 Add pacman support for .files databases Signed-off-by: Allan McRae <allan@archlinux.org> commit 289fdf0d1d9c88f0c8a6502cc311599c63a04723 Author: Allan McRae <allan@archlinux.org> Date: Tue Jul 14 22:00:38 2015 +1000 Read file lists from databases If a sync database contains a "files" file, the file list will be read. Currently, there is no known demand for the file list to be lazy loaded by any libalpm frontend, so these files are read whenever present. Lazy loading can be implemented when a demand exists. Signed-off-by: Allan McRae <allan@archlinux.org> commit f6c55b3c3f395839c0973c36b7a7e05984636a61 Author: Allan McRae <allan@archlinux.org> Date: Tue Jul 14 21:45:59 2015 +1000 Allow frontends to specify the sync database extension This allows frontends to select between the .db and .files databases currently supplied by repo-add or any other compatible database. Signed-off-by: Allan McRae <allan@archlinux.org> commit 1ada16f0177f9bfcaed95cf3b71b7029290a5f1d Author: Allan McRae <allan@archlinux.org> Date: Thu Jun 18 00:15:44 2015 +1000 Fix formatting in parsearg_upgrade Signed-off-by: Allan McRae <allan@archlinux.org> commit 2d7a41539b73b373b63d7e2d61ed519e19878799 Author: Allan McRae <allan@archlinux.org> Date: Wed Jun 17 22:17:55 2015 +1000 Simplify sync_cleandb 1) Remove checks for removing pre-tardb files 2) Remove the long redundant keep_used parameter 3) Fix pacman error due to removing .sig file along with database Signed-off-by: Allan McRae <allan@archlinux.org> ----------------------------------------------------------------------- Summary of changes: lib/libalpm/alpm.c | 3 + lib/libalpm/alpm.h | 3 + lib/libalpm/be_sync.c | 55 ++++++- lib/libalpm/db.c | 6 +- lib/libalpm/handle.c | 22 +++ lib/libalpm/handle.h | 1 + lib/libalpm/sync.c | 18 +++ scripts/libmakepkg/lint_package.sh.in | 1 + scripts/makepkg.sh.in | 2 +- src/pacman/Makefile.am | 1 + src/pacman/callback.c | 2 +- src/pacman/conf.c | 4 + src/pacman/conf.h | 6 +- src/pacman/files.c | 271 ++++++++++++++++++++++++++++++++++ src/pacman/pacman.c | 88 ++++++++++- src/pacman/pacman.h | 2 + src/pacman/sync.c | 86 +++-------- src/pacman/util.c | 33 +++++ src/pacman/util.h | 1 + 19 files changed, 520 insertions(+), 85 deletions(-) create mode 100644 src/pacman/files.c hooks/post-receive -- The official pacman repository