June 2022 - Pacman-dev - lists.archlinux.org

[PATCH 1/2] Diff color version strings
by David Gustavsson 18 Aug '22

18 Aug '22

In package table, with VerbosePkgLists and Color, color the part of package version strings that changes. Signed-off-by: David Gustavsson <david.e.gustavsson(a)gmail.com> --- src/pacman/conf.c | 4 ++++ src/pacman/conf.h | 2 ++ src/pacman/util.c | 35 +++++++++++++++++++++++++++++++---- src/pacman/util.h | 1 + 4 files changed, 38 insertions(+), 4 deletions(-) diff --git a/src/pacman/conf.c b/src/pacman/conf.c index f9edf75b..d5c598b9 100644 --- a/src/pacman/conf.c +++ b/src/pacman/conf.c @@ -80,6 +80,8 @@ void enable_colors(int colors) colstr->err = BOLDRED; colstr->faint = GREY46; colstr->nocolor = NOCOLOR; + colstr->diffrem = RED; + colstr->diffadd = GREEN; } else { colstr->colon = ":: "; colstr->title = ""; @@ -91,6 +93,8 @@ void enable_colors(int colors) colstr->err = ""; colstr->faint = ""; colstr->nocolor = ""; + colstr->diffrem = ""; + colstr->diffadd = ""; } } diff --git a/src/pacman/conf.h b/src/pacman/conf.h index f7916ca9..782b5758 100644 --- a/src/pacman/conf.h +++ b/src/pacman/conf.h @@ -33,6 +33,8 @@ typedef struct __colstr_t { const char *err; const char *faint; const char *nocolor; + const char *diffrem; + const char *diffadd; } colstr_t; typedef struct __config_repo_t { diff --git a/src/pacman/util.c b/src/pacman/util.c index 53833d6f..10d7c573 100644 --- a/src/pacman/util.c +++ b/src/pacman/util.c @@ -840,8 +840,10 @@ static alpm_list_t *create_verbose_row(pm_target_t *target) { char *str; off_t size = 0; + size_t i = 0; double human_size; const char *label; + const char *version; alpm_list_t *ret = NULL; /* a row consists of the package name, */ @@ -858,12 +860,28 @@ static alpm_list_t *create_verbose_row(pm_target_t *target) add_table_cell(&ret, str, CELL_NORMAL | CELL_FREE); /* old and new versions */ - pm_asprintf(&str, "%s", - target->remove != NULL ? alpm_pkg_get_version(target->remove) : ""); + version = alpm_pkg_get_version(target->remove); + char old_version[strlen(version) + strlen(config->colstr.diffrem) + strlen(config->colstr.nocolor) + 1]; + memcpy(old_version, (char *)version, strlen(version) + 1); + version = alpm_pkg_get_version(target->install); + char new_version[strlen(version) + strlen(config->colstr.diffadd) + strlen(config->colstr.nocolor) + 1]; + memcpy(new_version, (char *)version, strlen(version) + 1); + + i = 0; + while (old_version[i] != '\0' && new_version[i] != '\0' && old_version[i] == new_version[i]) { + i++; + } + insertstring(old_version, config->colstr.diffrem, i); + insertstring(new_version, config->colstr.diffadd, i); + snprintf(old_version + i + strlen(old_version + i), + strlen(config->colstr.nocolor) + 1, "%s", config->colstr.nocolor); + snprintf(new_version + i + strlen(new_version + i), + strlen(config->colstr.nocolor) + 1, "%s", config->colstr.nocolor); + + pm_asprintf(&str, "%s", old_version); add_table_cell(&ret, str, CELL_NORMAL | CELL_FREE); - pm_asprintf(&str, "%s", - target->install != NULL ? alpm_pkg_get_version(target->install) : ""); + pm_asprintf(&str, "%s", new_version); add_table_cell(&ret, str, CELL_NORMAL | CELL_FREE); /* and size */ @@ -1859,3 +1877,12 @@ void console_erase_line(void) { printf("\x1B[K"); } + +/* inserts string insert into string at index i, modifying string */ +void insertstring(char *string, const char *insert, size_t i) +{ + char temp[strlen(string) - i + 1]; + memcpy(temp, string + i, strlen(string + i) + 1); + memcpy(string + i, insert, strlen(insert) + 1); + memcpy(string + i + strlen(insert), temp, strlen(temp) + 1); +} diff --git a/src/pacman/util.h b/src/pacman/util.h index 52e79915..003961eb 100644 --- a/src/pacman/util.h +++ b/src/pacman/util.h @@ -88,6 +88,7 @@ void console_cursor_move_down(unsigned int lines); void console_cursor_move_end(void); /* Erases line from the current cursor position till the end of the line */ void console_erase_line(void); +void insertstring(char *string, const char *insert, size_t i); int pm_printf(alpm_loglevel_t level, const char *format, ...) __attribute__((format(printf,2,3))); int pm_asprintf(char **string, const char *format, ...) __attribute__((format(printf,2,3))); -- 2.35.1

2 3

[PATCH v2] util: Flush cursor state to stdout before removing signal handler
by Chris Down 22 Jul '22

22 Jul '22

It's possible that the cursor does not reappear after pressing ^C during shutdown. In my case, I noticed this when pressing ^C after getting results from `pacman -F` -- this can reasonably reliably be triggered by issuing a file query and pressing ^C shortly after results are shown. There are two reasons for this issue: 1. The graceful SIGINT handler is removed at the start of cleanup(), but the window from entering cleanup() to reaching exit() is non trivial. The main offender is FREELIST(pm_targets), which on my T14s takes >0.1s to execute. This means that if you are unlucky enough to press ^C while there, the cursor isn't coming back, because we haven't issued any command to show the cursor again yet, and the userspace signal handler is already blown away. 2. Moving console_cursor_show() to earlier in cleanup() only half solves the issue. While it's fine not to flush after _hiding_ the cursor, since it will at least make itself apparent before any other text reaches the screen, _showing_ the cursor must be followed by flushing stdout, because once the graceful SIGINT handler is gone, if you press ^C, no flush will be triggered (and thus there will be no cursor). This fixes the issue by always starting out by showing the cursor again at cleanup() time. This means that no matter where we get caught at ^C, we will not end up leaving the terminal without its beloved ensign. Signed-off-by: Chris Down <chris(a)chrisdown.name> --- src/pacman/pacman.c | 2 +- src/pacman/util.c | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/src/pacman/pacman.c b/src/pacman/pacman.c index ea536a47..e5c6e420 100644 --- a/src/pacman/pacman.c +++ b/src/pacman/pacman.c @@ -289,6 +289,7 @@ static void setuseragent(void) */ static void cleanup(int ret) { + console_cursor_show(); remove_soft_interrupt_handler(); if(config) { /* free alpm library resources */ @@ -302,7 +303,6 @@ static void cleanup(int ret) /* free memory */ FREELIST(pm_targets); - console_cursor_show(); exit(ret); } diff --git a/src/pacman/util.c b/src/pacman/util.c index 53833d6f..e92b2012 100644 --- a/src/pacman/util.c +++ b/src/pacman/util.c @@ -1426,6 +1426,16 @@ void console_cursor_hide(void) { void console_cursor_show(void) { if(isatty(fileno(stdout))) { printf(CURSOR_SHOW_ANSICODE); + + /* We typically explicitly show the cursor either when we are + * getting input from stdin, or when we are in the process of + * exiting. In the former case, it's not guaranteed that the + * terminal will see the command before reading from stdin. In + * the latter case, we need to make sure that if we get a + * further TERM/INT after we return signal disposition to + * SIG_DFL, it doesn't leave the cursor invisible. + */ + fflush(stdout); } } -- 2.35.1

2 4

[PATCH] Fix buffer overflow for 'Include' parameter in pacman.conf
by tim174 21 Jul '22

21 Jul '22

If the 'Include' parameter in the config file is set to a long string (for example 3000x '/') the pacman config parser will crash when calling glob in conf.c with this value. If the string is shorter than approx. 3000 symbols the normal error message is printed and the segfault does not occur. I was able to reproduce this on my own system and on the official Arch Linux iso image. The PATH_MAX variable is too large to prevent this bug, hence the new variable GLOB_LIMIT with a security buffer of 1000 since I don't know how persistent this limit is across systems. Its origin is unclear to me and I am not sure if it is a fixed value. This is why I would appreciate any help to make this a sustainable patch. Thanks Tim Signed-off-by: Tim <tim174 at protonmail.com> --- src/pacman/conf.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/pacman/conf.c b/src/pacman/conf.c index f9edf75b..d8222752 100644 --- a/src/pacman/conf.c +++ b/src/pacman/conf.c @@ -65,6 +65,9 @@ config_t *config = NULL; #define BOLDWHITE "\033[1;37m" #define GREY46 "\033[38;5;243m" +/* limit for glob input variable */ +#define GLOB_LIMIT 2000 + void enable_colors(int colors) { colstr_t *colstr = &config->colstr; @@ -1042,6 +1045,13 @@ static int process_include(const char *value, void *data, return 1; } + if(strlen(value) > GLOB_LIMIT) { + pm_printf(ALPM_LOG_ERROR, + ("config file %s, line %d, directive '%s': value too long\n"), + file, linenum, "Include"); + return 1; + } + if(section->depth >= config_max_recursion) { pm_printf(ALPM_LOG_ERROR, _("config parsing exceeded max recursion depth of %d.\n"), -- 2.34.1

2 1

[PATCH] dload: Remove unused ABORT_SIGINT
by Chris Down 21 Jul '22

21 Jul '22

The last user of ABORT_SIGINT was removed in commit 84723cab5dfc ("Cleanup the old sequential download code"), and this isn't exported as part of the public API. Signed-off-by: Chris Down <chris(a)chrisdown.name> --- lib/libalpm/dload.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index 7c27c3ea..4fa17b35 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -153,8 +153,7 @@ static char *get_fullpath(const char *path, const char *filename, } enum { - ABORT_SIGINT = 1, - ABORT_OVER_MAXFILESIZE + ABORT_OVER_MAXFILESIZE = 1, }; static int dload_interrupted; -- 2.35.1

2 1

Extend print-format with expac options
by Jelle van der Waa 21 Jul '22

21 Jul '22

This patch series extends --print-format with a subset of the expac options. More options to be added in further patch series.

3 8

[RFC][WIP][PATCH 0/5] adding extended package data
by Andrew Gregory 21 Jul '22

21 Jul '22

ALPM is currently parsing several fields that are not particularly relevant to managing package installation (e.g. pkgbase, pkgtype, makedepends, checkdepends). pkgtype in particular is not even exposed in any way through the API, it has to be included in the parser with a "not actually used" comment. This patchset adds an extended data field to packages that can be used by packagers or package-building infrastructure to store arbitrary package data in a way that doesn't require altering alpm for every field and allows the data to actually be retrieved via alpm (though not as easily as first-class fields). Andrew Gregory (5): query: only strip leading local/ for db packages query: allow querying extra info for package files add data field for arbitrary package data query: print extended data when extra info is requested makepkg: store package type in extended data lib/libalpm/alpm.h | 7 +++++++ lib/libalpm/be_local.c | 25 +++++++++++++++++++++++++ lib/libalpm/be_package.c | 6 ++++++ lib/libalpm/be_sync.c | 16 ++++++++++++++++ lib/libalpm/package.c | 17 +++++++++++++++++ lib/libalpm/package.h | 6 ++++++ scripts/makepkg.sh.in | 2 +- src/pacman/package.c | 13 +++++++++++++ src/pacman/query.c | 16 ++++++---------- 9 files changed, 97 insertions(+), 11 deletions(-) -- 2.35.0

2 13

[PATCH] libmakepkg/integrity: handle PGP signature files containing multiple signatures
by Jonas Witschel 26 Jun '22

26 Jun '22

PGP signature files can contain multiple signatures from different keys. In this case, verification is considered to be successful if *all* signatures are valid, compare e.g. the behaviour of the gpgv verification tool. parse_gpg_statusfile() is currently not equipped to handle the gpg output for such signature files: it assumes that the file contains only one signature and therefore overwrites the verification results of previous signatures, effectively only considering the last signature in the file. Therefore the logic needs to be refined so that $success and $trusted are only true if all signatures are valid and trusted, respectively. We also need to store the verification results per key (in order to present more specific error messages) and all the validated fingerprints (in order to check whether they are in validpgpkeys). The signatures for the source tarballs of recent GnuPG releases, e.g. version 2.2.35, are examples of such signature files. Signed-off-by: Jonas Witschel <diabonas(a)archlinux.org> --- .../integrity/verify_signature.sh.in | 115 ++++++++++-------- 1 file changed, 65 insertions(+), 50 deletions(-) diff --git a/scripts/libmakepkg/integrity/verify_signature.sh.in b/scripts/libmakepkg/integrity/verify_signature.sh.in index ad5bb66d..4aa14d94 100644 --- a/scripts/libmakepkg/integrity/verify_signature.sh.in +++ b/scripts/libmakepkg/integrity/verify_signature.sh.in @@ -26,6 +26,18 @@ LIBRARY=${LIBRARY:-'@libmakepkgdir@'} source "$LIBRARY/util/message.sh" source "$LIBRARY/util/pkgbuild.sh" +# Returns the elements of the first array that are not found in the second +# array as the third array. All arrays are passed by name. +set_difference() { + local -n first=$1 + local -n second=$2 + local -n result=$3 + result=() + for element in "${first[@]}"; do + ! in_array "$element" "${second[@]}" && result+=("$element") + done +} + check_pgpsigs() { (( SKIPPGPCHECK )) && return 0 ! source_has_signatures && return 0 @@ -56,48 +68,53 @@ check_pgpsigs() { fi # these variables are assigned values in parse_gpg_statusfile - success=0 - status= - pubkey= - fingerprint= + success= + declare -A status + fingerprints=() trusted= parse_gpg_statusfile "$statusfile" if (( ! $success )); then printf '%s' "$(gettext "FAILED")" >&2 - case "$status" in - "missingkey") - printf ' (%s)' "$(gettext "unknown public key") $pubkey" >&2 - ;; - "revokedkey") - printf " ($(gettext "public key %s has been revoked"))" "$pubkey" >&2 - ;; - "bad") - printf ' (%s)' "$(gettext "bad signature from public key") $pubkey" >&2 - ;; - "error") - printf ' (%s)' "$(gettext "error during signature verification")" >&2 - ;; - esac + for pubkey in "${!status[@]}"; do + case "${status["$pubkey"]}" in + "missingkey") + printf ' (%s)' "$(gettext "unknown public key") $pubkey" >&2 + ;; + "revokedkey") + printf " ($(gettext "public key %s has been revoked"))" "$pubkey" >&2 + ;; + "bad") + printf ' (%s)' "$(gettext "bad signature from public key") $pubkey" >&2 + ;; + "error") + printf ' (%s)' "$(gettext "error during signature verification")" >&2 + ;; + esac + done errors=1 else + local invalid_keys + set_difference fingerprints validpgpkeys invalid_keys if (( ${#validpgpkeys[@]} == 0 && !trusted )); then - printf "%s ($(gettext "the public key %s is not trusted"))" $(gettext "FAILED") "$fingerprint" >&2 + printf "%s ($(gettext "the public key %s is not trusted"))" $(gettext "FAILED") "${fingerprints[*]}" >&2 errors=1 - elif (( ${#validpgpkeys[@]} > 0 )) && ! in_array "$fingerprint" "${validpgpkeys[@]}"; then - printf "%s (%s %s)" "$(gettext "FAILED")" "$(gettext "invalid public key")" "$fingerprint" >&2 + elif (( ${#validpgpkeys[@]} > 0 )) && (( ${#invalid_keys[@]} > 0 )); then + printf "%s (%s %s)" "$(gettext "FAILED")" "$(gettext "invalid public key")" "${invalid_keys[*]}" >&2 errors=1 else printf '%s' "$(gettext "Passed")" >&2 - case "$status" in - "expired") - printf ' (%s)' "$(gettext "WARNING:") $(gettext "the signature has expired.")" >&2 - warnings=1 - ;; - "expiredkey") - printf ' (%s)' "$(gettext "WARNING:") $(gettext "the key has expired.")" >&2 - warnings=1 - ;; - esac + for pubkey in "${!status[@]}"; do + case "${status["$pubkey"]}" in + "expired") + printf " (%s $(gettext "the signature by key %s has expired."))" "$(gettext "WARNING:")" "$pubkey" >&2 + warnings=1 + ;; + "expiredkey") + printf " (%s $(gettext "the key %s has expired."))" "$(gettext "WARNING:")" "$pubkey" >&2 + warnings=1 + ;; + esac + done fi fi printf '\n' >&2 @@ -201,59 +218,57 @@ verify_git_signature() { parse_gpg_statusfile() { local type arg1 arg6 arg10 + success=-1 + trusted=-1 while read -r _ type arg1 _ _ _ _ arg6 _ _ _ arg10 _; do case "$type" in GOODSIG) - pubkey=$arg1 - success=1 - status="good" + success=$((success!=0)) + status["$arg1"]="good" ;; EXPSIG) - pubkey=$arg1 - success=1 - status="expired" + success=$((success!=0)) + status["$arg1"]="expired" ;; EXPKEYSIG) - pubkey=$arg1 - success=1 - status="expiredkey" + success=$((success!=0)) + status["$arg1"]="expiredkey" ;; REVKEYSIG) - pubkey=$arg1 success=0 - status="revokedkey" + status["$arg1"]="revokedkey" ;; BADSIG) - pubkey=$arg1 success=0 - status="bad" + status["$arg1"]="bad" ;; ERRSIG) - pubkey=$arg1 success=0 if [[ $arg6 == 9 ]]; then - status="missingkey" + status["$arg1"]="missingkey" else - status="error" + status["$arg1"]="error" fi ;; VALIDSIG) if [[ $arg10 ]]; then # If the file was signed with a subkey, arg10 contains # the fingerprint of the primary key - fingerprint=$arg10 + fingerprints+=("$arg10") else - fingerprint=$arg1 + fingerprints+=("$arg1") fi ;; TRUST_UNDEFINED|TRUST_NEVER) trusted=0 ;; TRUST_MARGINAL|TRUST_FULLY|TRUST_ULTIMATE) - trusted=1 + trusted=$((trusted!=0)) ;; esac done < "$1" + success=$((success>0)) + trusted=$((trusted>0)) } source_has_signatures() { -- 2.36.1

3 8

[PATCH] makepkg: Implement the verify function
by Morten Linderud 25 Jun '22

25 Jun '22

From: Morten Linderud <morten(a)linderud.pw> This patch implements a new verify function in makepkg. It allows us to do arbitrary authentication on sources before extraction. There are several new signing and validation methods being implemented and it would be hard to have `makepkg` implement support for things such as sequoia, cosign or minisign. This would allow us to distribute generic validation functions. This also implements a new `copy_` routine for our protocols as we need to have a separation between extracting sources and copying sources. Signed-off-by: Morten Linderud <morten(a)linderud.pw> --- doc/PKGBUILD.5.asciidoc | 4 ++++ doc/makepkg.8.asciidoc | 3 +++ scripts/libmakepkg/integrity.sh.in | 3 +++ scripts/libmakepkg/source.sh.in | 15 +++++++++++++++ scripts/libmakepkg/source/file.sh.in | 9 ++++++++- scripts/makepkg.sh.in | 17 ++++++++++++++++- 6 files changed, 49 insertions(+), 2 deletions(-) diff --git a/doc/PKGBUILD.5.asciidoc b/doc/PKGBUILD.5.asciidoc index 4ca8eb3b..e7743c88 100644 --- a/doc/PKGBUILD.5.asciidoc +++ b/doc/PKGBUILD.5.asciidoc @@ -344,6 +344,10 @@ function. fakeroot to ensure correct file permissions in the resulting package. All other functions will be run as the user calling makepkg. +*verify() Function*:: + An optional `verify()` function can be specified to implement arbiterary + source authentication. This function is run before sources are extracted. + *prepare() Function*:: An optional `prepare()` function can be specified in which operations to prepare the sources for building, such as patching, are performed. This diff --git a/doc/makepkg.8.asciidoc b/doc/makepkg.8.asciidoc index 38032e7b..75b2139f 100644 --- a/doc/makepkg.8.asciidoc +++ b/doc/makepkg.8.asciidoc @@ -168,6 +168,9 @@ Options *\--noprepare*:: Do not run the prepare() function in the PKGBUILD. +*\--noverify*:: + Do not run the verify() function in the PKGBUILD. + *\--sign*:: Sign the resulting package with gpg, overriding the setting in linkman:makepkg.conf[5]. diff --git a/scripts/libmakepkg/integrity.sh.in b/scripts/libmakepkg/integrity.sh.in index 070392fa..81f935df 100644 --- a/scripts/libmakepkg/integrity.sh.in +++ b/scripts/libmakepkg/integrity.sh.in @@ -42,4 +42,7 @@ check_source_integrity() { check_checksums "$@" check_pgpsigs "$@" fi + if (( VERIFYFUNC )); then + run_verify + fi } diff --git a/scripts/libmakepkg/source.sh.in b/scripts/libmakepkg/source.sh.in index e39dd16c..92dc71e4 100644 --- a/scripts/libmakepkg/source.sh.in +++ b/scripts/libmakepkg/source.sh.in @@ -69,6 +69,21 @@ download_sources() { done } +copy_sources(){ + msg "$(gettext "Copying sources...")" + local netfile all_sources + + get_all_sources_for_arch 'all_sources' + for netfile in "${all_sources[@]}"; do + local proto=$(get_protocol "$netfile") + if declare -f copy_$proto > /dev/null; then + copy_$proto "$netfile" + else + copy_file "$netfile" + fi + done +} + extract_sources() { msg "$(gettext "Extracting sources...")" local netfile all_sources diff --git a/scripts/libmakepkg/source/file.sh.in b/scripts/libmakepkg/source/file.sh.in index fa09d446..51452550 100644 --- a/scripts/libmakepkg/source/file.sh.in +++ b/scripts/libmakepkg/source/file.sh.in @@ -82,13 +82,20 @@ download_file() { fi } -extract_file() { +copy_file(){ local netfile=$1 local file=$(get_filename "$netfile") local filepath=$(get_filepath "$file") rm -f "$srcdir/${file}" ln -s "$filepath" "$srcdir/" +} + +extract_file() { + local netfile=$1 + + local file=$(get_filename "$netfile") + local filepath=$(get_filepath "$file") if in_array "$file" "${noextract[@]}"; then # skip source files in the noextract=() array diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 5aaabf63..b7b21af1 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -144,6 +144,9 @@ clean_up() { if (( PKGVERFUNC )); then rm -f "${pkgbase}-${fullver}-${CARCH}-pkgver.log"* fi + if (( VERIFYFUNC )); then + rm -f "${pkgbase}-${fullver}-${CARCH}-verify.log"* + fi if (( PREPAREFUNC )); then rm -f "${pkgbase}-${fullver}-${CARCH}-prepare.log"* fi @@ -447,6 +450,10 @@ run_function() { fi } +run_verify() { + run_function_safe "verify" +} + run_prepare() { run_function_safe "prepare" } @@ -973,6 +980,7 @@ while true; do -m|--nocolor) USE_COLOR='n'; PACMAN_OPTS+=("--color" "never") ;; --noarchive) NOARCHIVE=1 ;; --nocheck) RUN_CHECK='n' ;; + --noverify) RUN_VERIFY='n' ;; --noprepare) RUN_PREPARE='n' ;; --nosign) SIGNPKG='n' ;; -o|--nobuild) BUILDPKG=0 NOBUILD=1 ;; @@ -1093,7 +1101,7 @@ fi unset pkgname "${pkgbuild_schema_strings[@]}" "${pkgbuild_schema_arrays[@]}" unset "${known_hash_algos[@]/%/sums}" -unset -f pkgver prepare build check package "${!package_@}" +unset -f pkgver verify prepare build check package "${!package_@}" unset "${!makedepends_@}" "${!depends_@}" "${!source_@}" "${!checkdepends_@}" unset "${!optdepends_@}" "${!conflicts_@}" "${!provides_@}" "${!replaces_@}" unset "${!cksums_@}" "${!md5sums_@}" "${!sha1sums_@}" "${!sha224sums_@}" @@ -1165,6 +1173,12 @@ if (( ${#pkgname[@]} > 1 )) || have_function package_${pkgname}; then fi # test for available PKGBUILD functions +if have_function verify; then + # "Hide" verify() function if not going to be run + if [[ $RUN_VERIFY != "n" ]]; then + VERIFYFUNC=1 + fi +fi if have_function prepare; then # "Hide" prepare() function if not going to be run if [[ $RUN_PREPARE != "n" ]]; then @@ -1312,6 +1326,7 @@ if (( !REPKG )); then warning "$(gettext "Using existing %s tree")" "\$srcdir/" else download_sources + copy_sources check_source_integrity (( VERIFYSOURCE )) && exit $E_OK -- 2.36.1

2 3

[Git][pacman/pacman][master] Fix remaining email list address
by Allan McRae (＠allan) 25 Jun '22

25 Jun '22

Allan McRae pushed to branch master at Pacman / Pacman Commits: 2bf67416 by Allan McRae at 2022-06-25T22:59:20+10:00 Fix remaining email list address One instance was missed in b0a2fd75b2f4ba12075646f0f3f18911d71a42c7. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - lib/libalpm/po/Makevars View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/2bf67416c17c99851e2d0bb… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/2bf67416c17c99851e2d0bb… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] 8 commits: makepkg: use bsdtar --no-read-sparse for archive creation if available
by Allan McRae (＠allan) 25 Jun '22

25 Jun '22

Allan McRae pushed to branch master at Pacman / Pacman Commits: f5f9e0f4 by Jonas Witschel at 2022-03-11T09:43:59+10:00 makepkg: use bsdtar --no-read-sparse for archive creation if available bsdtar uses the "pax" TAR archive format by default, which has support for storing sparse file information in the archive. Unfortunately this is a source of unreproducibility because the sparse encoding is taken from the file system and different file systems handle sparse files differently: some file systems have no support for sparsely encoded files at all, and even file systems with sparse file support can report different file information for identical files due to differing implementations. As a real world example where this happens, consider the Arch Linux package "brotli-testdata 1.0.9-7", which contains a sparsely encoded all-zeros file "usr/share/brotli/testdata/zeros". Building this package on a btrfs file system yields a different package than building it on tmpfs or ext4 solely due to different sparse file information that gets recorded in the package tarball. To improve the reproducibility of archives containing sparsely encoded files, libarchive version 3.6.0 introduces a new --no-read-sparse option. This skips reading sparse file information from disk entirely and therefore stores files "expanded" in the archive, which is the only way to make them reliably reproducible across file systems. makepkg will use this option if libarchive is recent enough to support it, which is detected at build time. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 18152a21 by Allan McRae at 2022-05-12T09:45:12+10:00 libmakepkg: Do not "strip" files when the format is not recognised We use a multi step process during stripping to ensure permissions do not get changed. However, if the initial objcopy fails, the subsequent cat results in a blank file. Abandon early if objcopy fails. Fixes FS#74486 Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - fdf04cda by Allan McRae at 2022-05-18T22:06:07+10:00 doc/PKGBUILD: remove Arch Linux specific advise The documentation for the license array was specific to Arch Linux. Remove it and some minor other Arch Linux specific references. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 84dc662d by Allan McRae at 2022-05-31T20:13:14+10:00 makepkg: add source signing PGP keys to source package if available Arch Linux is adding source signing PGP keys to their package source tree alongside PKGBUILDs in the form keys/pgp/$fingerprint.asc. As the PGP keyserver infrastructure is a mess, this helps other people validate sources in a PKGBUILD. Add the keys to source packages if found alongside the PKGBUILD. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - d1e95c4e by Allan McRae at 2022-06-16T09:00:18+10:00 Gitlab CI: Install glibc-debug valgrind test Currently our gitlab CI is failing due to valgrind breakage. With Arch stripping glibc, valgrind now requires debuginfod to be active. However the gitlab CI system combined without our testsuite does not retrieve these symbols, even when the appropriate environmental variable is set. Work around this by installing the glibc-debug package directly using a slight kludge... All blame for this approach is assigned to foutrelis! Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 0031cd1e by Levente Polyak at 2022-06-25T10:25:36+10:00 doc/BUILDINFO.5: document buildtool and buildtoolver properties The feature has been introduced in commit a33cdac10bf1a682 The buildinfo version has been bumped in commit 0428f6213bcb5586 Signed-off-by: Levente Polyak <anthraxx(a)archlinux.org> - - - - - 776b7c1e by Morten Linderud at 2022-06-25T10:45:04+10:00 debugflags: Ensure we have unique source paths In some cases packages are built outside of a directory which contains pkgname-pkgver, this results in source listing in debug packages having a conflicting path like `/usr/src/debug/build/` which is not ideal. This patch ensures we always include the pkgbase to ensure the paths are unique. Signed-off-by: Morten Linderud <morten(a)linderud.pw> Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 6daeb37f by Jean Raby at 2022-06-25T22:45:00+10:00 pacman: silence "info" msg when using --print This allows for parsing the output of: pacman --upgrade --print-format '<format>' pkg.zst without having to remove info messages from it. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 9 changed files: - .gitlab-ci.yml - build-aux/edit-script.sh.in - doc/BUILDINFO.5.asciidoc - doc/PKGBUILD.5.asciidoc - meson.build - scripts/libmakepkg/buildenv/debugflags.sh.in - scripts/libmakepkg/tidy/strip.sh.in - scripts/makepkg.sh.in - src/pacman/upgrade.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/bddfcc3f40ce1a19d4c955… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/bddfcc3f40ce1a19d4c955… You're receiving this email because of your account on gitlab.archlinux.org.

1 0