July 2020 - Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH] makepkg: Don't double-layer distcc on ccache
by Matti Niemenmaa 08 Feb '21

08 Feb '21

From: Matti Niemenmaa <matti.niemenmaa+git(a)iki.fi> buildenv is set once for build() and a second time for package(). When using both distcc and ccache, this lead to CCACHE_PREFIX="distcc distcc" in package(), which breaks PKGBUILDs that execute the compiler in package() because distcc complains: distcc[383041] (main) CRITICAL! distcc seems to have invoked itself recursively! Avoid causing this error by only adding "distcc" to CCACHE_PREFIX if it's not yet there. Signed-off-by: Matti Niemenmaa <matti.niemenmaa+git(a)iki.fi> --- scripts/libmakepkg/buildenv/compiler.sh.in | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) ncurses is an example of a package that runs into this problem. Setting buildenv twice was done on purpose in commit 02a0bf550a22e199f48537b7eee87361b112e8a0, but at a glance I'm not sure whether it provides any benefit. All the meaningful changes are to environment variables that are exported from the parent process anyway, so all the changes are either repeated or even duplicated (like in PATH, or this CCACHE_PREFIX issue). Maybe it would be better to simply remove the prepare_buildenv call from the INFAKEROOT case in makepkg.sh.in? diff --git a/scripts/libmakepkg/buildenv/compiler.sh.in b/scripts/libmakepkg/buildenv/compiler.sh.in index 69f58a29..c93c77b4 100644 --- a/scripts/libmakepkg/buildenv/compiler.sh.in +++ b/scripts/libmakepkg/buildenv/compiler.sh.in @@ -44,7 +44,9 @@ buildenv_ccache() { buildenv_distcc() { if check_buildoption "distcc" "y"; then if (( using_ccache )); then - export CCACHE_PREFIX="${CCACHE_PREFIX:+$CCACHE_PREFIX }distcc" + if ! [[ "$CCACHE_PREFIX" =~ (^| )distcc($| ) ]]; then + export CCACHE_PREFIX="${CCACHE_PREFIX:+$CCACHE_PREFIX }distcc" + fi export CCACHE_BASEDIR="$srcdir" elif [[ -d /usr/lib/distcc/bin ]]; then export PATH="/usr/lib/distcc/bin:$PATH" -- 2.24.1

3 6

[pacman-dev] Alternatives system
by Allan McRae 06 Dec '20

06 Dec '20

Hi all, I plan to finish implementing an alternatives system for pacman post 5.2 release: https://wiki.archlinux.org/index.php/User:Allan/Alternatives Any comments or suggestions? Thanks, Allan

6 7

[pacman-dev] [PATCH] makepkg: libprovides: don't provide both versioned and unversioned sonames
by Eli Schwartz 23 Sep '20

23 Sep '20

If multiple files match the pattern libfoo.so*, we want to check each of them and see if they are shared libraries, and if so, if they have versions attached. But some packages can have both shared libraries and random files which match the filename pattern. This is true at least for files in /usr/share/gdb/auto-load/, which must match the filename they are paired with, followed by "-gdb.py" (or some other gdb scripting ext), but definitely don't contain a shared library. In this case, we don't want to double-report the library in the generated provides. It's also possible (probably) for a package to provide a versioned as well as an unversioned shared library, but in such cases a single provides entry is sufficient to cover both cases (and the libdepends for the depending package would contain an unversioned dependency). Solve this by keeping track of whether we have added a versioned soname provides already, and then only adding a maximum of one unversioned provides *iff* there isn't a versioned one yet. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- Notes: Currently we only have gdb/auto-load/ scripts for shared libraries in: - gcc - glib2 - gstreamer - efl In the first 3 cases, libprovides is entirely useless anyway. libstdc++ is perpetually stable (backwards-compatible ABI) just like glibc. glib2 actually does use libprovides, despite that it makes no sense for glib2 to libprovide anything, as the glib2 developers have this thing where they always use a soname of "0" and bump ABI versions by changing libglib-2.0.so to libglib-3.0.so -- as a result if you want to track dependencies you need to change to a different soname manually, and might as well just depend on the package itself (which already has a version in the pkgname). (gstreamer is in the same boat as glib2 because it is part of the same ecosystem.) efl doesn't currently libprovide "libeo.so", but if it did, then the issue would exist and be fixed by this patch. And more generally, any project wishing to implement gdb/auto-load/ scripts could have this issue, so it makes sense to make it work nicely. scripts/makepkg.sh.in | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index d1416d15..3f746b77 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -516,9 +516,10 @@ find_libdepends() { find_libprovides() { - local p libprovides missing + local p newp libprovides missing for p in "${provides[@]}"; do missing=0 + newp=() case "$p" in *.so) mapfile -t filename < <(find "$pkgdir" -type f -name $p\*) @@ -531,7 +532,6 @@ find_libprovides() { local sofile=$(LC_ALL=C readelf -d "$fn" 2>/dev/null | sed -n 's/.*Library soname: \[$.*$\].*/\1/p') if [[ -z "$sofile" ]]; then warning "$(gettext "Library listed in %s is not versioned: %s")" "'provides'" "$p" - libprovides+=("$p") continue fi @@ -541,25 +541,25 @@ find_libprovides() { # extract the library major version local soversion="${sofile##*\.so\.}" - libprovides+=("${p}=${soversion}-${soarch}") + newp+=("${p}=${soversion}-${soarch}") else warning "$(gettext "Library listed in %s is not a shared object: %s")" "'provides'" "$p" - libprovides+=("$p") fi done else - libprovides+=("$p") missing=1 fi ;; - *) - libprovides+=("$p") - ;; esac if (( missing )); then warning "$(gettext "Cannot find library listed in %s: %s")" "'provides'" "$p" fi + if (( ${#newp[@]} > 0 )); then + libprovides+=("${newp[@]}") + else + libprovides+=("$p") + fi done (( ${#libprovides[@]} )) && printf '%s\n' "${libprovides[@]}" -- 2.26.2

2 2

[pacman-dev] [PATCH] Highlight changed part of new version numbers to let users easily distiguish between major, minor, bugfix and internal updates
by Lars Øyvind Hagland 10 Aug '20

10 Aug '20

Signed-off-by: Lars Øyvind Hagland <larsoc(a)gmail.com> --- src/pacman/util.c | 55 ++++++++++++++++++++++++++++++++++++++++++----- src/pacman/util.h | 2 ++ 2 files changed, 52 insertions(+), 5 deletions(-) diff --git a/src/pacman/util.c b/src/pacman/util.c index e9187529..d3c89ecb 100644 --- a/src/pacman/util.c +++ b/src/pacman/util.c @@ -531,7 +531,12 @@ static void table_print_line(const alpm_list_t *line, short col_padding, if(cell->mode & CELL_TITLE) { printf("%s%*s%s", config->colstr.title, cell_width, str, config->colstr.nocolor); } else { - printf("%*s", cell_width, str); + // printf includes ANSI control chars in width, pad manually with actual width + if (cell_width > 0) { + printf("%*s%s", cell_width - (int)cell->len, "", str); + } else { + printf("%s%*s", str, -cell_width - (int)cell->len, ""); + } } need_padding = 1; } @@ -860,8 +865,10 @@ static alpm_list_t *create_verbose_row(pm_target_t *target) target->remove != NULL ? alpm_pkg_get_version(target->remove) : ""); add_table_cell(&ret, str, CELL_NORMAL | CELL_FREE); - pm_asprintf(&str, "%s", - target->install != NULL ? alpm_pkg_get_version(target->install) : ""); + str = version_colorize_diff( + target->install ? alpm_pkg_get_version(target->install) : "", + target->remove ? alpm_pkg_get_version(target->remove) : "", + config->colstr.title); add_table_cell(&ret, str, CELL_NORMAL | CELL_FREE); /* and size */ @@ -886,7 +893,7 @@ static alpm_list_t *create_verbose_row(pm_target_t *target) /* prepare a list of pkgs to display */ static void _display_targets(alpm_list_t *targets, int verbose) { - char *str; + char *str, *version; off_t isize = 0, rsize = 0, dlsize = 0; unsigned short cols; alpm_list_t *i, *names = NULL, *header = NULL, *rows = NULL; @@ -918,8 +925,12 @@ static void _display_targets(alpm_list_t *targets, int verbose) } if(target->install) { + version = version_colorize_diff(alpm_pkg_get_version(target->install), + target->remove ? alpm_pkg_get_version(target->remove) : "", + config->colstr.nocolor); pm_asprintf(&str, "%s%s-%s%s", alpm_pkg_get_name(target->install), config->colstr.faint, - alpm_pkg_get_version(target->install), config->colstr.nocolor); + version, config->colstr.nocolor); + free(version); } else if(isize == 0) { pm_asprintf(&str, "%s%s-%s%s", alpm_pkg_get_name(target->remove), config->colstr.faint, alpm_pkg_get_version(target->remove), config->colstr.nocolor); @@ -1676,6 +1687,40 @@ int colon_printf(const char *fmt, ...) return ret; } +/** Highlight the changed part of the version string + * + * Inserts an ANSI color tag before the first changed version part and a + * no-color tag at the end. + * + * @param version The new version string + * @param old_version The old version string + * @param color The color of the highlighted part + * @return Pointer to the new string + */ +char *version_colorize_diff(const char *version, const char *old_version, const char *color) +{ + char *ret; + char start[strlen(version)], end[strlen(version)]; + unsigned long pos = 0; + + while ((pos < strlen(version)) + && (pos < strlen(old_version)) + && (version[pos] == old_version[pos])) + pos++; + while (pos > 0 + && version[pos] != '.' + && version[pos] != '-') + pos--; + if (pos != 0) + pos++; + + strncpy(start, version, pos); + start[pos] = '\0'; // strncpy does not add delimiter + strcpy(end, &version[pos]); + pm_asprintf(&ret, "%s%s%s%s", start, color, end, config->colstr.nocolor); + return ret; +} + int pm_printf(alpm_loglevel_t level, const char *format, ...) { int ret; diff --git a/src/pacman/util.h b/src/pacman/util.h index c97048fb..7597da40 100644 --- a/src/pacman/util.h +++ b/src/pacman/util.h @@ -81,6 +81,8 @@ int yesno(const char *format, ...) __attribute__((format(printf, 1, 2))); int noyes(const char *format, ...) __attribute__((format(printf, 1, 2))); char *arg_to_string(int argc, char *argv[]); char *safe_fgets_stdin(char *s, int size); +char *version_colorize_diff(const char *version, const char *old_version, const char *color); + void console_cursor_hide(void); void console_cursor_show(void); void console_cursor_move_up(unsigned int lines); -- 2.27.0

2 1

[pacman-dev] [PATCH] Fix error during keyring checking
by Anatol Pomozov 10 Aug '20

10 Aug '20

With current master version the 'keyring checking' step produces an error: debug: returning error 6 from alpm_pkg_get_sig (../lib/libalpm/package.c: 274) : wrong or NULL argument passed The package signature is still checked later at the integrity verification step though. This commit fixes keyring checking and now the debug log looks like this: debug: found cached pkg: /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: found detached signature /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst.sig with size 566 debug: found signature key: 786C63F330D7CB92 debug: looking up key 786C63F330D7CB92 locally debug: key lookup success, key exists Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- lib/libalpm/package.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/lib/libalpm/package.c b/lib/libalpm/package.c index 0885b27b..a4356518 100644 --- a/lib/libalpm/package.c +++ b/lib/libalpm/package.c @@ -270,9 +270,7 @@ const char SYMEXPORT *alpm_pkg_get_base64_sig(alpm_pkg_t *pkg) int SYMEXPORT alpm_pkg_get_sig(alpm_pkg_t *pkg, unsigned char **sig, size_t *sig_len) { - if(pkg != NULL) { - RET_ERR(pkg->handle, ALPM_ERR_WRONG_ARGS, -1); - } + ASSERT(pkg != NULL, return -1); if(pkg->base64_sig) { int ret = alpm_decode_signature(pkg->base64_sig, sig, sig_len); -- 2.28.0

2 3

[pacman-dev] [PATCH v2] Enable sha256/md5 hash verification if detached signatures are used
by Anatol Pomozov 31 Jul '20

31 Jul '20

Pacman has multiple ways to verify package content integrity: - gpg signature - sha256 - md5 These verification mechanisms overlap each other. gpg signatures already contain hash value of the package content. So if a package signature is present then pacman ignored the other 2 hash values. This worked well with signtures embedded into pacman database. Recently pacman got an ability to handle detached signatures (*.sig files located next to the package files). If pacman verifies detached signature only then one can replace pkg+sig files with some other content and pacman still processes it as a valid package. To prevent it we need to verify database<->package integrity using hash values stored in the database. This commit fixes FS#67232 The new debug output is: checking package integrity... debug: found cached pkg: /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: sha256sum: 77baf61c62c5570b3a37cf0c3b16c5d9a97dde6fedd1a3528bf0cc5f96dd5e52 debug: checking sha256sum for /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: sig data: <from .sig> debug: checking signature for /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: 1 signatures returned debug: fingerprint: B5971F2C5C10A9A08C60030F786C63F330D7CB92 Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- lib/libalpm/be_package.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/libalpm/be_package.c b/lib/libalpm/be_package.c index f98832f4..4dde7167 100644 --- a/lib/libalpm/be_package.c +++ b/lib/libalpm/be_package.c @@ -311,7 +311,7 @@ int _alpm_pkg_validate_internal(alpm_handle_t *handle, } } - if(syncpkg && !has_sig) { + if(syncpkg && (!has_sig || !syncpkg->base64_sig)) { if(syncpkg->md5sum && !syncpkg->sha256sum) { _alpm_log(handle, ALPM_LOG_DEBUG, "md5sum: %s\n", syncpkg->md5sum); _alpm_log(handle, ALPM_LOG_DEBUG, "checking md5sum for %s\n", pkgfile); -- 2.28.0

1 0

[pacman-dev] [PATCH] Enable sha256/md5 hash verification if detached signatures are used
by Anatol Pomozov 30 Jul '20

30 Jul '20

Pacman has multiple ways to verify package content integrity: - gpg signature - sha256 - md5 These verification mechanisms overlap each other. gpg signatures already contain hash value of the package content. So if a package signature is present then pacman ignored the other 2 hash values. This worked well with signtures embedded into pacman database. Recently pacman got an ability to handle detached signatures (*.sig files located next to the package files). If pacman verifies detached signature only then one can replace pkg+sig files with some other content and pacman still processes it as a valid package. It open doors for security attacks e.g. 'rollback attack'. To prevent it we need to verify database<->package integrity using hash values stored in the database. This commit fixes FS#67232 The new debug output is: checking package integrity... debug: found cached pkg: /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: sha256sum: 77baf61c62c5570b3a37cf0c3b16c5d9a97dde6fedd1a3528bf0cc5f96dd5e52 debug: checking sha256sum for /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: sig data: <from .sig> debug: checking signature for /var/cache/pacman/pkg/ruby-2.7.1-2-x86_64.pkg.tar.zst debug: 1 signatures returned debug: fingerprint: B5971F2C5C10A9A08C60030F786C63F330D7CB92 Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- lib/libalpm/be_package.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/libalpm/be_package.c b/lib/libalpm/be_package.c index f98832f4..4dde7167 100644 --- a/lib/libalpm/be_package.c +++ b/lib/libalpm/be_package.c @@ -311,7 +311,7 @@ int _alpm_pkg_validate_internal(alpm_handle_t *handle, } } - if(syncpkg && !has_sig) { + if(syncpkg && (!has_sig || !syncpkg->base64_sig)) { if(syncpkg->md5sum && !syncpkg->sha256sum) { _alpm_log(handle, ALPM_LOG_DEBUG, "md5sum: %s\n", syncpkg->md5sum); _alpm_log(handle, ALPM_LOG_DEBUG, "checking md5sum for %s\n", pkgfile); -- 2.28.0

1 0

[pacman-dev] [PATCH] PKGBUILD-vcs.proto: replace bzr with breezy
by Michael Straube 19 Jul '20

19 Jul '20

The bzr package was replaced with breezy a while ago. Update the PKGBUILD-vcs.proto file. Signed-off-by: Michael Straube <michael.straube(a)posteo.de> --- proto/PKGBUILD-vcs.proto | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/proto/PKGBUILD-vcs.proto b/proto/PKGBUILD-vcs.proto index ae9956a9..6a76db67 100644 --- a/proto/PKGBUILD-vcs.proto +++ b/proto/PKGBUILD-vcs.proto @@ -16,7 +16,7 @@ url="" license=('GPL') groups=() depends=() -makedepends=('VCS_PACKAGE') # 'bzr', 'git', 'mercurial' or 'subversion' +makedepends=('VCS_PACKAGE') # 'breezy', 'git', 'mercurial' or 'subversion' provides=("${pkgname%-VCS}") conflicts=("${pkgname%-VCS}") replaces=() -- 2.27.0

2 2

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.2.1-109-g2a352dc0
by Allan McRae 17 Jul '20

17 Jul '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via 2a352dc059f696eeda1e18116e468994c1a38430 (commit) via 14c0e53eed4bd0c090e7ed2ebad41335d323c86c (commit) via 1fd95939dbee071f4d7fb30e19c5b3cb22969113 (commit) via a8bdc2e10ad6c942f3f1dbbbb77c126578a41bd3 (commit) from b01bcc7d3d680856bd60c4ae03e4ba3f6d889cb2 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 2a352dc059f696eeda1e18116e468994c1a38430 Author: Morten Linderud <morten(a)linderud.pw> Date: Mon Jul 13 22:25:41 2020 +0200 doc/makepkg.8: Added punctuations. Signed-off-by: Morten Linderud <morten(a)linderud.pw> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 14c0e53eed4bd0c090e7ed2ebad41335d323c86c Author: Anatol Pomozov <anatol.pomozov(a)gmail.com> Date: Mon Jul 13 09:35:34 2020 -0700 Check that destfile_name exists before using it In some cases (when trust_remote_name is used for a URL without a filename and no Content-Disposition is provided by the server) destfile_name will be NULL. In this case payload data will be stored in tempfile_name and no destfile_name is set. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 1fd95939dbee071f4d7fb30e19c5b3cb22969113 Author: Anatol Pomozov <anatol.pomozov(a)gmail.com> Date: Mon Jul 13 09:35:21 2020 -0700 Do not free payload fields in the middle of this structure use At the end of payload use it calls _alpm_dload_payload_reset() that will free() these and other fields anyway. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit a8bdc2e10ad6c942f3f1dbbbb77c126578a41bd3 Author: Anatol Pomozov <anatol.pomozov(a)gmail.com> Date: Mon Jul 13 09:35:05 2020 -0700 Build signature remote name based on the main payload name The main payload final name might be affected by url redirects or Content-Disposition HTTP header value. We want to make sure that accompanion *.sig filename always matches the package filename. So ignore finalname/Content-Disposition for the *.sig file. It also helps to fix a corner case when the download URL does not contain a filename and server provides Content-Disposition for the main payload but not for the signature payload. Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: doc/makepkg.8.asciidoc | 4 +-- lib/libalpm/dload.c | 74 +++++++++++++++++++++++++++++--------------------- 2 files changed, 45 insertions(+), 33 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [PATCH] doc/makepkg.8: Added punctuations.
by foxboron＠archlinux.org 14 Jul '20

14 Jul '20

From: Morten Linderud <morten(a)linderud.pw> Signed-off-by: Morten Linderud <morten(a)linderud.pw> --- doc/makepkg.8.asciidoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/makepkg.8.asciidoc b/doc/makepkg.8.asciidoc index 544659fc..3b5e61b3 100644 --- a/doc/makepkg.8.asciidoc +++ b/doc/makepkg.8.asciidoc @@ -274,7 +274,7 @@ Environment Variables **GPGKEY=**"keyid":: Specify a key to use when signing packages, overriding the GPGKEY setting - in linkman:makepkg.conf[5] + in linkman:makepkg.conf[5]. **SOURCE_DATE_EPOCH=**"<date>":: Used for link:https://reproducible-builds.org/docs/[Reproducible Builds]. @@ -299,7 +299,7 @@ On exit, makepkg will return one of the following error codes. Error in configuration file. 3:: - User specified an invalid option + User specified an invalid option. 4:: Error in user-supplied function in PKGBUILD. -- 2.27.0

2 1