- Pacman-dev - lists.archlinux.org

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.1.1-207-g48752f1b
by Allan McRae 07 Oct '19

07 Oct '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via 48752f1b4b16cd1dad56649cd36b253494aa9ff1 (commit) via 80e2e1c7c9f2cc2795f497f2101b0aeb7b7e8638 (commit) via 0c4a8ae24b8395b0dd4f8046615336e394a8e3f8 (commit) via 5dd2b3776dedd85c196be737ea9c177216448756 (commit) via fd70c1c7bb0cb0681ab8a46d5f0494e0f9d992c6 (commit) via 6f3810793f4b1fc82094ccb1847ed82b85a203e6 (commit) via bcb44891ef8aa6feee3090cc0fd87b60e73aed5d (commit) from 024fde9748692c71f0d9e6c667439c912a78b6df (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 48752f1b4b16cd1dad56649cd36b253494aa9ff1 Author: Jonas Witschel <diabonas(a)archlinux.org> Date: Wed Oct 2 16:40:55 2019 +0200 signing: add ability to import keys using a WKD Currently pacman relies on the SKS keyserver network to fetch unknown PGP keys. These keyservers are vulnerable to signature spamming attacks, potentionally making it impossible to import the required keys. An alternative to keyservers is a so-called Web Key Directory (WKD), a well-known, trusted location on a server from where the keys can be fetched. This commit adds the ability to retrieve keys from a WKD. Due to the mentioned vulnerabilities, the WKD is tried first, falling back to the keyservers only if no appropriate key is found there. In contrast to keyservers, keys in a WKD are not looked up using their fingerprint, but by email address. Since the email address of the signing key is usually not included in the signature, we will use the packager email address to perform the lookup. Also see FS#63171. Signed-off-by: Jonas Witschel <diabonas(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 80e2e1c7c9f2cc2795f497f2101b0aeb7b7e8638 Author: Jonas Witschel <diabonas(a)archlinux.org> Date: Wed Oct 2 16:40:54 2019 +0200 signing: move key import confirmation before key_search Ask the user whether they want to import a missing key before even doing a search on the keyserver. This will be useful for getting Web Key Directory support in place: for a WKD, looking up and importing a key are a single action, so the current key_search -> QUESTION -> key_import workflow does not apply. Since only the ID of the package signing key is available before key_search, we display the packager variable in addition to the key ID for user convenience. Signed-off-by: Jonas Witschel <diabonas(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 0c4a8ae24b8395b0dd4f8046615336e394a8e3f8 Author: Dave Reisner <dreisner(a)archlinux.org> Date: Sun Oct 6 20:06:43 2019 -0400 dload: never return NULL from get_filename Downloads with a Content-Disposition header will typically not include slashes. When they do, we should most certainly only take the basename, but when they don't, we should treat the header value as the filename. Crash introduced in d197d8ab82cf when we started using get_filename in order to rightfully avoid an arbitrary file overwrite vulnerability. Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 5dd2b3776dedd85c196be737ea9c177216448756 Author: Allan McRae <allan(a)archlinux.org> Date: Fri Oct 4 11:53:04 2019 +1000 makepkg.conf.5: Document PACKAGER format requirements Signed-off-by: Allan McRae <allan(a)archlinux.org> commit fd70c1c7bb0cb0681ab8a46d5f0494e0f9d992c6 Author: Jonas Witschel <diabonas(a)archlinux.org> Date: Wed Oct 2 16:40:56 2019 +0200 libmakepkg: check if PACKAGER has the expected format for WKD lookup pacman should be able to extract an email address from PACKAGER for WKD lookup, so issue a warning if it is not of the form "Example Name <email(a)address.invalid>". Neither the name nor the email address must contain additional angle brackets. Signed-off-by: Jonas Witschel <diabonas(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 6f3810793f4b1fc82094ccb1847ed82b85a203e6 Author: morganamilo <morganamilo(a)gmail.com> Date: Mon Sep 9 19:39:09 2019 +0100 libmakepkg: fix typo Signed-off-by: Allan McRae <allan(a)archlinux.org> commit bcb44891ef8aa6feee3090cc0fd87b60e73aed5d Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Thu Aug 15 19:55:45 2019 -0400 autotools: distribute meson files If we use make dist to create the official, signed release tarballs, those will not have meson build files by default since autotools doesn't know what they are. Also distribute all src/common/ files. We never strictly needed any of them to be distributed with autotools, because the dist tarball dereferences the symlinks (???), but only some of them were being distributed, and meson needs them to be in the right location as we only build libcommon from the primary files. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: Makefile.am | 9 +- doc/Makefile.am | 1 + doc/makepkg.conf.5.asciidoc | 1 + lib/libalpm/Makefile.am | 2 + lib/libalpm/be_package.c | 12 ++- lib/libalpm/dload.c | 6 +- lib/libalpm/signing.c | 121 +++++++++++++++++++++----- lib/libalpm/signing.h | 2 +- lib/libalpm/sync.c | 22 ++++- scripts/Makefile.am | 2 + scripts/libmakepkg/buildenv.sh.in | 2 +- scripts/libmakepkg/lint_config/variable.sh.in | 6 ++ src/common/Makefile.am | 3 +- src/pacman/Makefile.am | 2 + src/pacman/callback.c | 13 +-- src/util/Makefile.am | 2 + test/pacman/Makefile.am | 1 + test/scripts/Makefile.am | 1 + test/util/Makefile.am | 1 + 19 files changed, 165 insertions(+), 44 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [PATCH] dload: never return NULL from get_filename
by Dave Reisner 07 Oct '19

07 Oct '19

Downloads with a Content-Disposition header will typically not include slashes. When they do, we should most certainly only take the basename, but when they don't, we should treat the header value as the filename. Crash introduced in d197d8ab82cf when we started using get_filename in order to rightfully avoid an arbitrary file overwrite vulnerability. --- lib/libalpm/dload.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index e5696bb0..506dcb8e 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -53,9 +53,11 @@ static const char *get_filename(const char *url) { char *filename = strrchr(url, '/'); if(filename != NULL) { - filename++; + return filename + 1; } - return filename; + + /* no slash found, it's a filename */ + return url; } static char *get_fullpath(const char *path, const char *filename, -- 2.23.0

2 1

[pacman-dev] [PATCH] makepkg.conf.5: Document PACKAGER format requirements
by Allan McRae 04 Oct '19

04 Oct '19

Signed-off-by: Allan McRae <allan(a)archlinux.org> --- doc/makepkg.conf.5.asciidoc | 1 + 1 file changed, 1 insertion(+) diff --git a/doc/makepkg.conf.5.asciidoc b/doc/makepkg.conf.5.asciidoc index 9292b2a6..a8995a27 100644 --- a/doc/makepkg.conf.5.asciidoc +++ b/doc/makepkg.conf.5.asciidoc @@ -244,6 +244,7 @@ Options **PACKAGER=**"John Doe <john(a)example.com>":: This value is used when querying a package to see who was the builder. + The given format is enforced to allow PGP key lookup through WKD. It is recommended to change this to your name and email address. **COMPRESSGZ=**"(gzip -c -f -n)":: -- 2.23.0

2 1

[pacman-dev] [PATCH 0/2] Building a unified dist tarball for
by Eli Schwartz 04 Oct '19

04 Oct '19

We currently support both autotools and meson, and each one has a mechanism for generating a distribution tarball which we can upload and sign. But using one won't let you build with the other build system (at least currently). autotools simply doesn't distribute meson bits, and meson will distribute anything checked into git, but not the autogen'ed content that users may well rely on. Here is a patch for each build system, which teaches it how to distribute the other's files. Eli Schwartz (2): autotools: distribute meson files meson: generate the autotools distribution files Makefile.am | 9 ++++++++- autogen.sh | 6 +++++- doc/Makefile.am | 1 + lib/libalpm/Makefile.am | 2 ++ meson.build | 2 ++ scripts/Makefile.am | 2 ++ src/common/Makefile.am | 3 ++- src/pacman/Makefile.am | 2 ++ src/util/Makefile.am | 2 ++ test/pacman/Makefile.am | 1 + test/scripts/Makefile.am | 1 + test/util/Makefile.am | 1 + 12 files changed, 29 insertions(+), 3 deletions(-) -- 2.22.1

2 4

[pacman-dev] [PATCH 1/2] meson: fix libcommon being publicly exposed as a static link dependency
by Eli Schwartz 02 Oct '19

02 Oct '19

libcommon isn't even installed, so that means libalpm.a (if installed) is fatally broken as it misses objects. The problem is that meson doesn't handle this case correctly: https://github.com/mesonbuild/meson/issues/3934 https://github.com/mesonbuild/meson/issues/3937 https://github.com/mesonbuild/meson/pull/3939 Work around this by manually extracting libcommon's .o files into the list of objects used to create libalpm. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- meson.build | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/meson.build b/meson.build index 389a95b7..5199759f 100644 --- a/meson.build +++ b/meson.build @@ -317,9 +317,10 @@ libcommon = static_library( libalpm_a = static_library( 'alpm', libalpm_sources, + # https://github.com/mesonbuild/meson/issues/3937 + objects : libcommon.extract_all_objects(), include_directories : includes, dependencies : [crypto_provider, libarchive, libcurl, gpgme], - link_with : [libcommon], install : true) if get_option('default_library') != 'static' @@ -336,7 +337,6 @@ install_headers( 'lib/libalpm/alpm.h', 'lib/libalpm/alpm_list.h') -# TODO: libs.private seem quite wrong here pkgconfig = import('pkgconfig') pkgconfig.generate( libalpm, -- 2.23.0

1 2

[pacman-dev] Idea for makepkg. Use notify-send when package finishes compiling. (optional feature)
by igo95862 28 Sep '19

28 Sep '19

Often when compiling large packages I find myself missing the "sudo" promt to install compiled package. I have thought of a solution using notify-send command from community/inotify-tools package that will send a notification when the package finishes compiling. (but before install) Could be implemented as an opt-in option in makepkg.conf If you are interested I can send a patch. -- igo95862 <igo95862(a)yandex.ru>

2 2

[pacman-dev] [PATCH] meson: fix incorrect libalpm version
by Eli Schwartz 19 Sep '19

19 Sep '19

LIB_VERSION is supposed to be something like 11.0.1, not simply reiterate the project version. As a result, we ended up with this: $ pacman -V [...] Pacman v5.1.0 - libalpm v5.1.0 [...] Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- meson.build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meson.build b/meson.build index 650e599f..f5601ff8 100644 --- a/meson.build +++ b/meson.build @@ -69,7 +69,7 @@ conf.set_quoted('PACKAGE_VERSION', PACKAGE_VERSION) conf.set_quoted('LOCALEDIR', LOCALEDIR) conf.set_quoted('SCRIPTLET_SHELL', get_option('scriptlet-shell')) conf.set_quoted('LDCONFIG', LDCONFIG) -conf.set_quoted('LIB_VERSION', meson.project_version()) +conf.set_quoted('LIB_VERSION', libalpm_version) conf.set_quoted('SYSHOOKDIR', join_paths(DATAROOTDIR, 'libalpm/hooks/')) conf.set_quoted('CONFFILE', join_paths(SYSCONFDIR, 'pacman.conf')) conf.set_quoted('DBPATH', join_paths(LOCALSTATEDIR, 'lib/pacman/')) -- 2.23.0

1 0

[pacman-dev] [PATCH] pacman: better handle -F when file is not found
by morganamilo 10 Sep '19

10 Sep '19

Error messages are now printed. Pacman now returns 1 if any of the files queried are not found. --- src/pacman/files.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/src/pacman/files.c b/src/pacman/files.c index 8e518486..c4351114 100644 --- a/src/pacman/files.c +++ b/src/pacman/files.c @@ -115,7 +115,6 @@ static int files_search(alpm_list_t *syncs, alpm_list_t *targets, int regex) { if(regex) { if(regcomp(&reg, targ, REG_EXTENDED | REG_NOSUB | REG_ICASE | REG_NEWLINE) != 0) { - /* TODO: error message */ goto notfound; } } @@ -174,13 +173,20 @@ static int files_search(alpm_list_t *syncs, alpm_list_t *targets, int regex) { regfree(&reg); } + if(found) { + continue; + } + notfound: - if(!found) { - ret++; + ret = 1; + if(regex) { + pm_printf(ALPM_LOG_ERROR, _("no files match '%s'\n"), targ); + } else { + pm_printf(ALPM_LOG_ERROR, _("no package owns '%s'\n"), targ); } } - return 0; + return ret; } static void dump_file_list(alpm_pkg_t *pkg) { -- 2.23.0

2 1

[pacman-dev] [PATCH] libmakepkg: fix typo
by morganamilo 09 Sep '19

09 Sep '19

--- scripts/libmakepkg/buildenv.sh.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/libmakepkg/buildenv.sh.in b/scripts/libmakepkg/buildenv.sh.in index a8d416c8..085e1380 100644 --- a/scripts/libmakepkg/buildenv.sh.in +++ b/scripts/libmakepkg/buildenv.sh.in @@ -1,7 +1,7 @@ #!/bin/bash # # buildenv.sh - functions for altering the build environment before -# compiliation +# compilation # # Copyright (c) 2015-2018 Pacman Development Team <pacman-dev(a)archlinux.org> # -- 2.23.0

1 0

[pacman-dev] [PATCH 1/2] pacman: pacman-conf: removed hputs macro for usage display
by Matthew Sexton 09 Sep '19

09 Sep '19

From: Matthew Sexton <WSDMatty(a)gmail.com> Using the macro got in the way of _() macro for translation All the macro did was make it so the writer didn't have to type \n", stream); at the end of every line. --- src/pacman/pacman-conf.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/src/pacman/pacman-conf.c b/src/pacman/pacman-conf.c index df874029..d9e596b8 100644 --- a/src/pacman/pacman-conf.c +++ b/src/pacman/pacman-conf.c @@ -37,19 +37,17 @@ static void cleanup(void) static void usage(int ret) { FILE *stream = (ret ? stderr : stdout); -#define hputs(x) fputs(x"\n", stream) - hputs("pacman-conf - query pacman's configuration file"); - hputs("usage: pacman-conf [options] [<directive>...]"); - hputs(" pacman-conf (--repo-list|--help|--version)"); - hputs("options:"); - hputs(" -c, --config=<path> set an alternate configuration file"); - hputs(" -R, --rootdir=<path> set an alternate installation root"); - hputs(" -r, --repo=<remote> query options for a specific repo"); - hputs(" -v, --verbose always show directive names"); - hputs(" -l, --repo-list list configured repositories"); - hputs(" -h, --help display this help information"); - hputs(" -V, --version display version information"); -#undef hputs + fputs("pacman-conf - query pacman's configuration file\n", stream); + fputs("usage: pacman-conf [options] [<directive>...]\n", stream); + fputs(" pacman-conf (--repo-list|--help|--version)\n", stream); + fputs("options:\n", stream); + fputs(" -c, --config=<path> set an alternate configuration file\n", stream); + fputs(" -R, --rootdir=<path> set an alternate installation root\n", stream); + fputs(" -r, --repo=<remote> query options for a specific repo\n", stream); + fputs(" -v, --verbose always show directive names\n", stream); + fputs(" -l, --repo-list list configured repositories\n", stream); + fputs(" -h, --help display this help information\n", stream); + fputs(" -V, --version display version information\n", stream); cleanup(); exit(ret); } -- 2.23.0

1 1