October 2019 - Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH 1/2] libalpm: fix segfault when -Qip'ing a package
by morganamilo 15 Oct '19

15 Oct '19

The dummy checksigs function never sets count to 0, leaving it unitialized. This caused the siglist cleanup to try and free the empty list. diff --git a/lib/libalpm/signing.c b/lib/libalpm/signing.c index 30d057a3..4cb31e7c 100644 --- a/lib/libalpm/signing.c +++ b/lib/libalpm/signing.c @@ -802,6 +802,7 @@ int _alpm_key_import(alpm_handle_t UNUSED *handle, const char UNUSED *uid, int _alpm_gpgme_checksig(alpm_handle_t UNUSED *handle, const char UNUSED *path, const char UNUSED *base64_sig, alpm_siglist_t UNUSED *siglist) { + siglist->count = 0; return -1; } #endif /* HAVE_LIBGPGME */ -- 2.23.0

2 4

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.1.1-236-g27ccd689
by Allan McRae 14 Oct '19

14 Oct '19

1 0

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.1.1-235-g5e11d86c
by Allan McRae 13 Oct '19

13 Oct '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via 5e11d86cc5c9d17f1fc99da745596e048aa805ad (commit) from d4e667ee5eeb3139045d7333fcddf6ba449da7b2 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5e11d86cc5c9d17f1fc99da745596e048aa805ad Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Sun Oct 13 01:50:48 2019 -0700 remove: improve broken dependency error message This message was clarified for sync operations in 2b1b7b70753eb56bee08cd270efc7cfa342bc0ec. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: src/pacman/remove.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [PATCH] remove: improve broken dependency error message
by Andrew Gregory 13 Oct '19

13 Oct '19

This message was clarified for sync operations in 2b1b7b70753eb56bee08cd270efc7cfa342bc0ec. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> --- src/pacman/remove.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/pacman/remove.c b/src/pacman/remove.c index 9d44cf53..0eeb19d3 100644 --- a/src/pacman/remove.c +++ b/src/pacman/remove.c @@ -116,8 +116,8 @@ int pacman_remove(alpm_list_t *targets) for(i = data; i; i = alpm_list_next(i)) { alpm_depmissing_t *miss = i->data; char *depstring = alpm_dep_compute_string(miss->depend); - colon_printf(_("%s: removing %s breaks dependency '%s'\n"), - miss->target, miss->causingpkg, depstring); + colon_printf(_("removing %s breaks dependency '%s' required by %s\n"), + miss->causingpkg, depstring, miss->target); free(depstring); alpm_depmissing_free(miss); } -- 2.23.0

1 0

[pacman-dev] [PATCH] pacman: return 1 when -F <target> has no results
by morganamilo 13 Oct '19

13 Oct '19

--- This is basically my V2 for "pacman: better handle -F when file is not found". With the freeze coming up and me not having that much time to do pacman stuff, this is the best I've got right now. I have been thinking about the original patch and I don't really like it much any more. One issue is that -Qi and -Si give error messages when there's no match, but -Qs and -Ss do not. So for consistency sake should -Fx not give an error message? Also -Qs and -Ss both fail to report when an error occurs during search. So just like how -F currently does not report regex errors, neither does -Q and -S. Lastly there is the issue of how to handle regex errors in -F? Because the search is done in the front end, the error does not come from alpm. We could just do `alpm_strerror(ALPM_ERR_REGEX)` to reuse alpm's error message. Or maybe move it into the backend along side alpm_db_search? I'll leave all this open to discussion and hope this small patch is mostly agreeable so it can make it in this release. --- src/pacman/files.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/pacman/files.c b/src/pacman/files.c index 8e518486..af11666d 100644 --- a/src/pacman/files.c +++ b/src/pacman/files.c @@ -176,11 +176,11 @@ static int files_search(alpm_list_t *syncs, alpm_list_t *targets, int regex) { notfound: if(!found) { - ret++; + ret = 1; } } - return 0; + return ret; } static void dump_file_list(alpm_pkg_t *pkg) { -- 2.23.0

2 1

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.1.1-234-gd4e667ee
by Allan McRae 13 Oct '19

13 Oct '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via d4e667ee5eeb3139045d7333fcddf6ba449da7b2 (commit) from 808a4f15ce82d2ed7eeb06de73d0f313620558ee (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit d4e667ee5eeb3139045d7333fcddf6ba449da7b2 Author: morganamilo <morganamilo(a)gmail.com> Date: Sat Oct 12 20:12:03 2019 +0100 pacman: return 1 when -F <target> has no results Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: src/pacman/files.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.1.1-233-g808a4f15
by Allan McRae 12 Oct '19

12 Oct '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via 808a4f15ce82d2ed7eeb06de73d0f313620558ee (commit) via a82b0028e431dbd8bb3512c3193b52985da82ec2 (commit) via a2c4ad46751e4dcb85a739437d9331bf9282d9be (commit) from a897599fa54813ea2a225271eacd9fb6e1a6762e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 808a4f15ce82d2ed7eeb06de73d0f313620558ee Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Sun Jun 9 09:56:36 2019 -0700 run XferCommand via exec system() runs the provided command via a shell, which is subject to command injection. Even though pacman already provides a mechanism to sign and verify the databases containing the urls, certain distributions have yet to get their act together and start signing databases, leaving them vulnerable to MITM attacks. Replacing the system call with an almost equivalent exec call removes the possibility of a shell-injection attack for those users. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> commit a82b0028e431dbd8bb3512c3193b52985da82ec2 Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Fri Oct 11 20:11:51 2019 -0700 add arg_to_string helper Converts an argc/argv pair to a string for presentation to the user. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> commit a2c4ad46751e4dcb85a739437d9331bf9282d9be Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Sun Jun 9 09:54:02 2019 -0700 move wordsplit into common for sharing Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> ----------------------------------------------------------------------- Summary of changes: lib/libalpm/hook.c | 119 +-------------------------------- src/common/util-common.c | 112 +++++++++++++++++++++++++++++++ src/common/util-common.h | 3 + src/pacman/conf.c | 130 +++++++++++++++++++++++++++++++----- src/pacman/conf.h | 2 + src/pacman/pacman.c | 26 ++------ src/pacman/util.c | 23 +++++++ src/pacman/util.h | 1 + test/pacman/tests/sync200.py | 2 +- test/pacman/tests/xfercommand001.py | 2 +- 10 files changed, 264 insertions(+), 156 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] pacman-5.2 progress
by Allan McRae 09 Oct '19

09 Oct '19

Hi all, I attacked the patch queue today - I think everything that was ready to be committed was, and everything that was not has been commented on. Now the WKD patches have landed, the only thing on my radar is the exec XferCommand patch, but I am not worried if that does not make this release. So with that said, I intend to call a freeze on Sunday the 13th. I will then submit final translation changes, with the aim of a final release being made on the 20th. Let me know of any patches I have yet to consider. If you will be submitting a revised, I recommend you do so ASAP, so there is time further changes are needed. Thanks, Allan

3 3

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.1.1-230-ga897599f
by Allan McRae 09 Oct '19

09 Oct '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via a897599fa54813ea2a225271eacd9fb6e1a6762e (commit) via e8d4228614e4f45f74a5233eb7a322494429fd22 (commit) via 379f7151056e804ba61caa6c72407ffa79c6649a (commit) from d5c3ed129c80c7a0676994d06c140f5e67b8b07d (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a897599fa54813ea2a225271eacd9fb6e1a6762e Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Mon Oct 7 17:18:11 2019 -0400 makepkg: do not save fflags when creating packages Saving fflages breaks reproducible builds due to encoding information specific to the filesystem that was used to build the package. This information is not needed for packaging purposes anyway. Including fflags also means that attempting to extract a package file as root (or fakeroot) might result in angry warnings being printed to the console by bsdtar, followed by a non-zero exit code, unless the user remembers to use --no-fflags during extraction. This is unpleasant UI, even if pacman itself won't care about these. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit e8d4228614e4f45f74a5233eb7a322494429fd22 Author: Christian Hesse <mail(a)eworm.de> Date: Mon Oct 7 15:35:28 2019 +0200 signing: handle unknown uid in key import With unknown uid pacman crashed. Return with error from email_from_uid() if uid is NULL. Signed-off-by: Christian Hesse <mail(a)eworm.de> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 379f7151056e804ba61caa6c72407ffa79c6649a Author: Christian Hesse <mail(a)eworm.de> Date: Mon Oct 7 16:00:56 2019 +0200 signing: modify question text with unknwon uid If the key's uid is unknown (for example with db signatures) the question was: :: Import PGP key 02FD1C7A934E614545849F19A6234074498E9CEE, "(null)"? [Y/n] Let's display a modified question for unknown uid. Signed-off-by: Christian Hesse <mail(a)eworm.de> Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: lib/libalpm/signing.c | 5 +++++ scripts/makepkg.sh.in | 4 ++-- src/pacman/callback.c | 10 ++++++++-- 3 files changed, 15 insertions(+), 4 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [PATCH] makepkg: do not save fflags when creating packages
by Eli Schwartz 08 Oct '19

08 Oct '19

This breaks reproducible builds due to encoding information specific to the filesystem which was used to build the package, information which we are never interested in for packaging purposes anyway. It also means that attempting to extract a package file as root (or fakeroot) might result in angry warnings being printed to the console by bsdtar, followed by a non-zero exit code, unless the user remembers to use --no-fflags during extraction. This is unpleasant UI, even if pacman itself won't care about these. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- scripts/makepkg.sh.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index abe669de..908ce751 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -721,7 +721,7 @@ create_package() { msg2 "$(gettext "Compressing package...")" # TODO: Maybe this can be set globally for robustness shopt -s -o pipefail - list_package_files | LANG=C bsdtar -cnf - --null --files-from - | + list_package_files | LANG=C bsdtar --no-fflags -cnf - --null --files-from - | compress_as "$PKGEXT" > "${pkg_file}" || ret=$? shopt -u -o pipefail @@ -812,7 +812,7 @@ create_srcpackage() { # TODO: Maybe this can be set globally for robustness shopt -s -o pipefail - LANG=C bsdtar -cLf - ${pkgbase} | compress_as "$SRCEXT" > "${pkg_file}" || ret=$? + LANG=C bsdtar --no-fflags -cLf - ${pkgbase} | compress_as "$SRCEXT" > "${pkg_file}" || ret=$? shopt -u -o pipefail -- 2.23.0

2 4