- Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH] makepkg: refactor checking for write permissions into a utility function
by Eli Schwartz 07 Dec '17

07 Dec '17

Additionally provide a separate error for the confusing if unlikely event that the user tries to use an existing file as a package output directory. This also means we now consistently try to create any nonexistent *DEST directories as needed before aborting with E_FS_PERMISSIONS. Previously only $BUILDDIR received that kindness. In the process, move the handling of $extra_environment[@] to where it always belonged, above $BUILDDIR. Fixes FS#43537 Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- Am I trying to do way, way too much here? mkdir will hopefully already provide a somewhat useful error message in the case of an existing file, as we don't quiet it. And this will need to be rebased on top of escondida's error codes patch scripts/libmakepkg/util/util.sh.in | 19 +++++++++++++++++++ scripts/makepkg.sh.in | 29 +++++++++++------------------ 2 files changed, 30 insertions(+), 18 deletions(-) diff --git a/scripts/libmakepkg/util/util.sh.in b/scripts/libmakepkg/util/util.sh.in index d676249d..a8813338 100644 --- a/scripts/libmakepkg/util/util.sh.in +++ b/scripts/libmakepkg/util/util.sh.in @@ -83,3 +83,22 @@ cd_safe() { exit 1 fi } + +# Try to create directory if one does not yet exist. Fails if the directory +# exists but has no write permissions, or if there is an existing file with +# the same name. +ensure_dir() { + local parent=$1 dirname=$1 + + until [[ -e $parent ]]; do + parent="${parent%/*}" + done + if [[ -f $parent ]]; then + error "$(gettext "Cannot create needed directory %s because it is already a file.")" "$parent" + return 1 + fi + if ( [[ ! -d $dirname ]] && ! mkdir -p "$dirname" ) || [[ ! -w $dirname ]]; then + return 1 + fi + return 0 +} diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 6449accd..b25e4106 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -1359,32 +1359,25 @@ else unset ALL_OFF BOLD BLUE GREEN RED YELLOW fi +# override settings from extra variables on commandline, if any +if (( ${#extra_environment[*]} )); then + export "${extra_environment[@]}" +fi + # override settings with an environment variable for batch processing BUILDDIR=${_BUILDDIR:-$BUILDDIR} BUILDDIR=${BUILDDIR:-$startdir} #default to $startdir if undefined -if [[ ! -d $BUILDDIR ]]; then - if ! mkdir -p "$BUILDDIR"; then - error "$(gettext "You do not have write permission to create packages in %s.")" "$BUILDDIR" - plain "$(gettext "Aborting...")" - exit 1 - fi - chmod a-s "$BUILDDIR" -fi -if [[ ! -w $BUILDDIR ]]; then +if ! ensure_dir "$BUILDDIR"; then error "$(gettext "You do not have write permission to create packages in %s.")" "$BUILDDIR" plain "$(gettext "Aborting...")" exit 1 fi - -# override settings from extra variables on commandline, if any -if (( ${#extra_environment[*]} )); then - export "${extra_environment[@]}" -fi +chmod a-s "$BUILDDIR" PKGDEST=${_PKGDEST:-$PKGDEST} PKGDEST=${PKGDEST:-$startdir} #default to $startdir if undefined -if (( ! (NOBUILD || GENINTEG) )) && [[ ! -w $PKGDEST ]]; then +if (( ! (NOBUILD || GENINTEG) )) && ! ensure_dir "$PKGDEST"; then error "$(gettext "You do not have write permission to store packages in %s.")" "$PKGDEST" plain "$(gettext "Aborting...")" exit 1 @@ -1392,7 +1385,7 @@ fi SRCDEST=${_SRCDEST:-$SRCDEST} SRCDEST=${SRCDEST:-$startdir} #default to $startdir if undefined -if [[ ! -w $SRCDEST ]] ; then +if ! ensure_dir "$SRCDEST" ; then error "$(gettext "You do not have write permission to store downloads in %s.")" "$SRCDEST" plain "$(gettext "Aborting...")" exit 1 @@ -1401,7 +1394,7 @@ fi SRCPKGDEST=${_SRCPKGDEST:-$SRCPKGDEST} SRCPKGDEST=${SRCPKGDEST:-$startdir} #default to $startdir if undefined if (( SOURCEONLY )); then - if [[ ! -w $SRCPKGDEST ]]; then + if ! ensure_dir "$SRCPKGDEST"; then error "$(gettext "You do not have write permission to store source tarballs in %s.")" "$SRCPKGDEST" plain "$(gettext "Aborting...")" exit 1 @@ -1414,7 +1407,7 @@ fi LOGDEST=${_LOGDEST:-$LOGDEST} LOGDEST=${LOGDEST:-$startdir} #default to $startdir if undefined -if (( LOGGING )) && [[ ! -w $LOGDEST ]]; then +if (( LOGGING )) && ! ensure_dir "$LOGDEST"; then error "$(gettext "You do not have write permission to store logs in %s.")" "$LOGDEST" plain "$(gettext "Aborting...")" exit 1 -- 2.14.2

2 6

[pacman-dev] Behaviour on -Scc flag
by Filip Matzner 26 Nov '17

26 Nov '17

Greetings everyone, I would like to discuss the behaviour of pacman -Scc --noconfirm Currently, it does not clean any package in the cache dir, because the default answer is 'N'. In my opinion it should clean the packages, since there are already two 'c's in the flag, so the user probably knows what is he doing. I believe there should be "yesno" instead of "noyes" on /pacman/sync.c:191 <https://git.archlinux.org/pacman.git/tree/src/pacman/sync.c#n191>. What do you think? (btw, I found out because a docker image contained all the downloaded packages even though the cache was cleaned with -Scc) Yours Sincerely, Filip

2 2

[pacman-dev] pulp integration / file format documentation
by Simon Peeters 23 Nov '17

23 Nov '17

hey all. As somebody who personally likes archlinux and professionally likes pulp¹, I am considdering building a pacman plugin for pulp. To do this ofc I will need to be able to parse and build syncdb's. I could probably use a python wrapper around libalpm, but: a) this might not be easily portable to other distros (the idea is pulp shouldn't be bound to running on the distro it serves) b) I'm not sure how much using libalpm will influence the host system's behaviour. So the alternative is to read and write syncdb's from python. It looks like the file format is easy enough to understand, and I can probably just reverse engineer it, but I was wondering if there is any official documentation on it. An in-between solution might be to read the syncdb natively, and write the new one using repo-add, but I'm unsure if this would be better. Greetings Simon ¹ https://pulpproject.org/

1 0

[pacman-dev] [PATCH] src/pacman/query.c: do not exit -Qo with error if file does not exist
by iff＠escondida.tk 14 Nov '17

14 Nov '17

From: Ivy Foster <iff(a)escondida.tk> Query operations act on the local db, not the filesystem. Also, a valid use case for -Qo is to discover what package owns a deleted file so it can be reinstalled. Closes FS#55856. Signed-off-by: Ivy Foster <iff(a)escondida.tk> --- I've opted to simply remove the relevant error messages here, since there's a good chance that the user is aware that the file is missing if they're querying a missing file. As a side note, this removes the sole usage of the translated error "failed to find '%s' in PATH: %s\n". I have not deleted this string from every .po file, but that option now exists. src/pacman/query.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) diff --git a/src/pacman/query.c b/src/pacman/query.c index 024d3e21..64c42f19 100644 --- a/src/pacman/query.c +++ b/src/pacman/query.c @@ -171,19 +171,9 @@ static int query_fileowner(alpm_list_t *targets) filename[len--] = '\0'; } - if(lstat(filename, &buf) == -1) { - /* if it is not a path but a program name, then check in PATH */ - if(strchr(filename, '/') == NULL) { - if(search_path(&filename, &buf) == -1) { - pm_printf(ALPM_LOG_ERROR, _("failed to find '%s' in PATH: %s\n"), - filename, strerror(errno)); - goto targcleanup; - } - } else { - pm_printf(ALPM_LOG_ERROR, _("failed to read file '%s': %s\n"), - filename, strerror(errno)); - goto targcleanup; - } + /* if it is not a path but a program name, then check in PATH */ + if((lstat(filename, &buf) == -1) && (strchr(filename, '/') == NULL)) { + search_path(&filename, &buf); } if(!lrealpath(filename, rpath)) { -- 2.15.0

4 4

[pacman-dev] [PATCH] makepkg: avoid false "Signing package(s)" msg when signing is disabled
by Eli Schwartz 12 Nov '17

12 Nov '17

Followup on c6b04c04653ba9933fe978829148312e412a9ea7 which refactored the signing function to run outside of fakeroot, and in the process moved the status message to outside the $SIGNPKG check. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- scripts/libmakepkg/integrity/generate_signature.sh.in | 6 +++--- scripts/makepkg.sh.in | 6 ++++-- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/scripts/libmakepkg/integrity/generate_signature.sh.in b/scripts/libmakepkg/integrity/generate_signature.sh.in index 6d65d82d..8bb69984 100644 --- a/scripts/libmakepkg/integrity/generate_signature.sh.in +++ b/scripts/libmakepkg/integrity/generate_signature.sh.in @@ -26,9 +26,6 @@ LIBRARY=${LIBRARY:-'@libmakepkgdir@'} source "$LIBRARY/util/message.sh" create_signature() { - if [[ $SIGNPKG != 'y' ]]; then - return 0 - fi local ret=0 local filename="$1" @@ -50,6 +47,9 @@ create_signature() { } create_package_signatures() { + if [[ $SIGNPKG != 'y' ]]; then + return 0 + fi local pkgarch pkg_file local pkgname_backup=("${pkgname[@]}") local fullver=$(get_full_version) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index cdcda4e8..9a434e27 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -1589,8 +1589,10 @@ if (( SOURCEONLY )); then enter_fakeroot - msg "$(gettext "Signing package...")" - create_signature "$SRCPKGDEST/${pkgbase}-${fullver}${SRCEXT}" + if [[ $SIGNPKG = 'y' ]]; then + msg "$(gettext "Signing package...")" + create_signature "$SRCPKGDEST/${pkgbase}-${fullver}${SRCEXT}" + fi msg "$(gettext "Source package created: %s")" "$pkgbase ($(date))" exit 0 -- 2.15.0

1 0

[pacman-dev] [PATCH] makepkg: tell the compiler to record debugging info for debug packages
by Eli Schwartz 30 Oct '17

30 Oct '17

In commit 8b0d59b83a60eb504567590346119fe4cd891cad support was added for storing the source files of binaries in debug packages. This made use of the debugedit program which is part of the RPM package manager, which is not very standalone. The same effect can be achieved using -fdebug-prefix-map, an option accepted by both the gcc and clang compilers which modifies how the compiler itself stores the references to the source files rather than requiring us to later edit the produced binaries. This also removes the dependency on external programs like debugedit. As a result of this change, source files will only be effectively added for programs which actually use the exported CFLAGS. This is a reasonable tradeoff as we expect our CFLAGS to be used rather than ignored. Upstream software which do not produce useful debug packages are expected to fix their build systems to respect the environment CFLAGS. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- doc/makepkg.conf.5.txt | 6 ++++++ etc/makepkg.conf.in | 2 ++ scripts/libmakepkg/tidy/strip.sh.in | 11 ++++------- scripts/makepkg.sh.in | 4 ++++ 4 files changed, 16 insertions(+), 7 deletions(-) diff --git a/doc/makepkg.conf.5.txt b/doc/makepkg.conf.5.txt index d61858ca..ca74c2dd 100644 --- a/doc/makepkg.conf.5.txt +++ b/doc/makepkg.conf.5.txt @@ -215,6 +215,12 @@ Options instruct makepkg which files to remove from the package. This is useful for index files that are added by multiple packages. +**DBGSRCDIR=**"/usr/src/debug":: + If `strip` and `debug` are specified in the `OPTIONS` array, this variable + will instruct makepkg where to place source files for installed binaries. + The compiler will be instructed to link this directory for the debugger + search path. + **PKGDEST=**"/path/to/directory":: If this value is not set, packages will, by default, be placed in the current directory (location of the linkman:PKGBUILD[5]). Many people diff --git a/etc/makepkg.conf.in b/etc/makepkg.conf.in index d2beef50..33c4e92d 100644 --- a/etc/makepkg.conf.in +++ b/etc/makepkg.conf.in @@ -99,6 +99,8 @@ MAN_DIRS=({usr{,/local}{,/share},opt/*}/{man,info}) DOC_DIRS=(usr/{,local/}{,share/}{doc,gtk-doc} opt/*/{doc,gtk-doc}) #-- Files to be removed from all packages (if purge is specified) PURGE_TARGETS=(usr/{,share}/info/dir .packlist *.pod) +#-- Directory, if any, to store source code in for debug packages +DBGSRCDIR="/usr/src/debug" ######################################################################### # PACKAGE OUTPUT diff --git a/scripts/libmakepkg/tidy/strip.sh.in b/scripts/libmakepkg/tidy/strip.sh.in index 76562808..49e8aacd 100644 --- a/scripts/libmakepkg/tidy/strip.sh.in +++ b/scripts/libmakepkg/tidy/strip.sh.in @@ -58,14 +58,11 @@ strip_file() { # copy source files to debug directory local f t while read -r f; do - t=${f/"$srcdir"/$dbgsrc} - mkdir -p "${t%/*}" - cp -- "$f" "$t" + t=${f/$dbgsrc/"$srcdir"} + mkdir -p "${f%/*}" + cp -- "$t" "$f" done < <(source_files "$binary") - # adjust debug symbols to point at sources - debugedit -b "${srcdir}" -d /usr/src/debug/ -i "$binary" &> /dev/null - # copy debug symbols to debug directory mkdir -p "$dbgdir/${binary%/*}" objcopy --only-keep-debug "$binary" "$dbgdir/$binary.debug" @@ -107,7 +104,7 @@ tidy_strip() { if check_option "debug" "y"; then dbgdir="$pkgdirbase/$pkgbase-@DEBUGSUFFIX@/usr/lib/debug" - dbgsrc="$pkgdirbase/$pkgbase-@DEBUGSUFFIX@/usr/src/debug" + dbgsrc="$pkgdirbase/$pkgbase-@DEBUGSUFFIX@$DBGSRCDIR" mkdir -p "$dbgdir" "$dbgsrc" fi diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index b25e4106..b74da0a5 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -379,6 +379,10 @@ prepare_buildenv() { fi if check_option "debug" "y"; then + if [[ -v DBGSRCDIR ]]; then + DEBUG_CFLAGS+=" -fdebug-prefix-map=$srcdir=$DBGSRCDIR" + DEBUG_CXXFLAGS+=" -fdebug-prefix-map=$srcdir=$DBGSRCDIR" + fi CFLAGS+=" $DEBUG_CFLAGS" CXXFLAGS+=" $DEBUG_CXXFLAGS" fi -- 2.14.2

2 5

[pacman-dev] Error: Maximum file size exceeded
by Drew DeVault 25 Oct '17

25 Oct '17

I maintain a pacman repository and I frequently end up with broken packages because of this error. I'm surprised this doesn't come up on Arch Linux's production repositories. I add the package to the repository with a script that rsyncs up the tarball and does this: repo-add -n -R \ $repo_path/sr.ht.db.tar.gz \ $repo_path/python-srht-$pkgver-$pkgrel-any.pkg.tar.xz This error happens maybe 1 in 10 times. Thoughts? -- Drew DeVault

2 1

[pacman-dev] [Patch 1/1] Fix CVE-2016-5434 (DoS/loop and out of boundary read)
by Nils Freydank 20 Oct '17

20 Oct '17

This is a rewrite of Tobias Stoeckmann’s patch from June 2016[1] using functions instead of macros. (Thanks to Tobias for explanations of his patch.) A short question on Freenode IRC showed that macros are generally discouraged and functions should be used. The patch introduces size_t length_check() and applies it to libalpm/signing.c and signing.h. Feedback is very appreciated. [1] Original patch: https://lists.archlinux.org/pipermail/pacman-dev/2016-June/021148.html CVE request (and assignment): http://seclists.org/oss-sec/2016/q2/526 diff --git a/lib/libalpm/signing.c b/lib/libalpm/signing.c index 95cb3280..f7a9c9a8 100644 --- a/lib/libalpm/signing.c +++ b/lib/libalpm/signing.c @@ -986,6 +986,19 @@ int SYMEXPORT alpm_siglist_cleanup(alpm_siglist_t *siglist) return 0; } +/* Check to avoid out of boundary reads */ +size_t length_check(size_t length, size_t position, size_t a, + alpm_handle_t *handle, const char *identifier) +{ + if( a == 0 || length - position <= a) + { + _alpm_log(handle, ALPM_LOG_ERROR, \ + _("%s: signature format error"), identifier); + return -1; + } + else return 0; +} + /** * Extract the Issuer Key ID from a signature * @param sig PGP signature @@ -1021,19 +1034,22 @@ int SYMEXPORT alpm_extract_keyid(alpm_handle_t *handle, const char *identifier, } switch(sig[pos] & 0x03) { - case 0: - blen = sig[pos + 1]; - pos = pos + 2; + case 0: if( length_check(len, pos, 1, handle, identifier) ){ return -1; } + else blen = sig[pos + 1]; + if( length_check(len, pos, 2, handle, identifier) ){ return -1; } + else pos = pos + 2; break; - case 1: - blen = (sig[pos + 1] << 8) | sig[pos + 2]; - pos = pos + 3; + if( length_check(len, pos, 2, handle, identifier) ){ return -1; } + else blen = (sig[pos + 1] << 8) | sig[pos + 2]; + if( length_check(len, pos, 3, handle, identifier) ){ return -1; } + else pos = pos + 3; break; - case 2: - blen = (sig[pos + 1] << 24) | (sig[pos + 2] << 16) | (sig[pos + 3] << 8) | sig[pos + 4]; - pos = pos + 5; + case 2: if( length_check(len, pos, 4, handle, identifier) ){ return -1; } + else blen = (sig[pos + 1] << 24) | (sig[pos + 2] << 16) | (sig[pos + 3] << 8) | sig[pos + 4]; + if( length_check(len, pos, 5, handle, identifier) ){ return -1; } + else pos = pos + 5; break; case 3: @@ -1057,25 +1073,38 @@ int SYMEXPORT alpm_extract_keyid(alpm_handle_t *handle, const char *identifier, return -1; } - pos = pos + 4; + if( length_check(len, pos, 4, handle, identifier) ){ return -1; } + else pos = pos + 4; - hlen = (sig[pos] << 8) | sig[pos + 1]; - pos = pos + hlen + 2; + if( length_check(len, pos, 1, handle, identifier) ){ return -1; } + else hlen = (sig[pos] << 8) | sig[pos + 1]; - ulen = (sig[pos] << 8) | sig[pos + 1]; - pos = pos + 2; + if( length_check(len, pos, 2, handle, identifier) ){ return -1; } + else pos = pos + hlen + 2; + + if( length_check(len, pos, 1, handle, identifier) ){ return -1; } + else ulen = (sig[pos] << 8) | sig[pos + 1]; + + if( length_check(len, pos, 2, handle, identifier) ){ return -1; } + else pos = pos + 2; spos = pos; + if( length_check(len, pos, ulen, handle, identifier) ){ return -1; } + else while(spos < pos + ulen) { if(sig[spos] < 192) { slen = sig[spos]; - spos = spos + 1; + if( length_check(len + ulen, spos, 1, handle, identifier) ){ return -1; } + else spos = spos + 1; } else if(sig[spos] < 255) { - slen = (sig[spos] << 8) | sig[spos + 1]; - spos = spos + 2; + if( length_check(pos + ulen, spos, 1, handle, identifier) ){ return -1; } + else slen = (sig[spos] << 8) | sig[spos + 1]; + if( length_check(pos + ulen, spos, 2, handle, identifier) ){ return -1; } + else spos = spos + 2; } else { - slen = (sig[spos + 1] << 24) | (sig[spos + 2] << 16) | (sig[spos + 3] << 8) | sig[spos + 4]; + if( length_check(len, pos, 4, handle, identifier) ){ return -1; } + else slen = (sig[spos + 1] << 24) | (sig[spos + 2] << 16) | (sig[spos + 3] << 8) | sig[spos + 4]; spos = spos + 5; } @@ -1083,17 +1112,20 @@ int SYMEXPORT alpm_extract_keyid(alpm_handle_t *handle, const char *identifier, /* issuer key ID */ char key[17]; size_t i; + if( length_check(pos + ulen, spos, 8, handle, identifier) ){return -1; } + else{ for (i = 0; i < 8; i++) { sprintf(&key[i * 2], "%02X", sig[spos + i + 1]); } + } *keys = alpm_list_add(*keys, strdup(key)); break; } - - spos = spos + slen; + if( length_check(pos + ulen + 1, spos, slen, handle, identifier) ) {return -1; } + else spos = spos + slen; } - - pos = pos + (blen - hlen - 8); + if( length_check( blen, hlen, 8, handle, identifier ) ){return -1;} + else pos = pos + (blen - hlen - 8); } return 0; diff --git a/lib/libalpm/signing.h b/lib/libalpm/signing.h index 3507f584..a67bd900 100644 --- a/lib/libalpm/signing.h +++ b/lib/libalpm/signing.h @@ -36,4 +36,6 @@ int _alpm_key_import(alpm_handle_t *handle, const char *fpr); #endif /* ALPM_SIGNING_H */ +size_t length_check(size_t length, size_t position, size_t a, + alpm_handle_t *handle, const char *identifier); -- GPG fingerprint: '766B 8122 1342 6912 3401 492A 8B54 D7A3 FF3C DB17' Nils Freydank / Holgersson

3 8

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.0.1-192-ge4f13e62
by allan＠archlinux.org 17 Oct '17

17 Oct '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via e4f13e62cf74393e811dd247a28b887935ce6a56 (commit) via 62bfba53dbb33d12f3a4beaf9044a04b40c6b537 (commit) via 2ddbc6964b31f65678ed8e7c2cf1e80f0a7d4a0f (commit) via 4dae3fde17d663bf39a17978c2ee365696a54fb0 (commit) via 39319c1860d200a9b4a3cc2c6975e3cece502f2d (commit) via 64b7edd2fed122e63abd42dbe392a6f2896a0c16 (commit) via 064e7280cb2608747b2ce628f7e8faf7745f0707 (commit) via b4a197a6155d6cb4d02e712bf324beb0502b4d51 (commit) via 2b1b7b70753eb56bee08cd270efc7cfa342bc0ec (commit) via fa8419a0b569378674fb87e69f249d9cfe724596 (commit) from bcc9c417ae989ffda193083807142171c7a0190f (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit e4f13e62cf74393e811dd247a28b887935ce6a56 Author: Allan McRae <allan(a)archlinux.org> Date: Sun Oct 8 23:34:48 2017 +1000 libmakepkg: only output package file names when checking for build references The leading directory is distraction from identifying the files containing build references. Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 62bfba53dbb33d12f3a4beaf9044a04b40c6b537 Author: Alastair Hughes <hobbitalastair(a)gmail.com> Date: Sat Aug 12 09:15:33 2017 +1200 Make the flags used for sed -i configurable Not all sed implementations on linux accept the --follow-symlinks argument, so let the user configure the arguments passed to sed if required. Signed-off-by: Alastair Hughes <hobbitalastair(a)gmail.com> [Allan: fixed configure summary output] Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 2ddbc6964b31f65678ed8e7c2cf1e80f0a7d4a0f Author: Allan McRae <allan(a)archlinux.org> Date: Thu Sep 14 09:45:53 2017 +1000 libmakepkg: grammar fix Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 4dae3fde17d663bf39a17978c2ee365696a54fb0 Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Tue Sep 12 23:59:24 2017 -0400 makepkg: respect $SOURCE_DATE_EPOCH to activate reproducible builds If SOURCE_DATE_EPOCH is set, `touch` all source files between the (optional) prepare() and build() functions to unify the modification times. This works around build systems and compilers that embed the file modification times into the file contents of release artifacts. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 39319c1860d200a9b4a3cc2c6975e3cece502f2d Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Tue Sep 12 23:57:32 2017 -0400 libmakepkg: check for invalid tags in git As per https://lists.archlinux.org/pipermail/arch-general/2017-July/043876.html git doesn't check that the tag name matches what an annotated tag object *thinks* it should be called. This is a bit of a theoretical attack and some would argue that we should always use commits since upstream can legitimately change a tag, but nevertheless this can result in a downgrade attack if the git download transport was manipulated or the upstream repository hacked. So, check the tag blob to make sure the tag actually matches the name we used for `git checkout`. This really should be fixed in git itself, rather than forcing all downstream users of git verify-tag to implement their own checks, but the git developers disagree, see the discussion surrounding https://public-inbox.org/git/xmqqk2hzldx8.fsf@gitster.mtv.corp.google.com/ Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 64b7edd2fed122e63abd42dbe392a6f2896a0c16 Author: Michael Straube <straubem(a)gmx.de> Date: Sat Jul 15 14:56:30 2017 +0200 Fix brace coding style issues - Add missing braces to one-line if blocks - Move opening brace to line end Signed-off-by: Michael Straube <straubem(a)gmx.de> commit 064e7280cb2608747b2ce628f7e8faf7745f0707 Author: Michael Straube <straubem(a)gmx.de> Date: Thu Jul 13 21:30:59 2017 +0200 Fix coding style issue in pacman/util.c Add missing braces to some one-line if blocks. Signed-off-by: Michael Straube <straubem(a)gmx.de> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit b4a197a6155d6cb4d02e712bf324beb0502b4d51 Author: Michael Straube <straubem(a)gmx.de> Date: Sun Jul 9 16:45:38 2017 +0200 test/pacman: fix spelling of distribution name and another typo Signed-off-by: Michael Straube <straubem(a)gmx.de> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 2b1b7b70753eb56bee08cd270efc7cfa342bc0ec Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Sat Jul 8 20:33:18 2017 -0400 clarify broken dependency error messages Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit fa8419a0b569378674fb87e69f249d9cfe724596 Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Sat Jul 8 20:33:17 2017 -0400 provide command for downloading missing databases This is primarily to help users who are not aware that -F operations use a separate set of databases that need to be separately downloaded. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: configure.ac | 16 +++++++++++----- doc/makepkg.8.txt | 16 ++++++++++++++++ lib/libalpm/delta.c | 3 +-- lib/libalpm/sync.c | 6 ++++-- scripts/Makefile.am | 3 ++- scripts/libmakepkg/lint_package.sh.in | 2 +- scripts/libmakepkg/lint_package/build_references.sh.in | 2 +- scripts/libmakepkg/source/git.sh.in | 11 ++++++++++- scripts/makepkg.sh.in | 17 ++++++++++++++--- src/pacman/callback.c | 5 +++-- src/pacman/sync.c | 11 ++++++----- src/pacman/util.c | 12 ++++++++---- test/pacman/ChangeLog | 2 +- test/pacman/README | 6 +++--- 14 files changed, 81 insertions(+), 31 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [PATCH] libmakepkg: only output package file names when checking for build references
by Allan McRae 08 Oct '17

08 Oct '17

The leading directory is distraction from identifying the files containing build references. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- scripts/libmakepkg/lint_package/build_references.sh.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/libmakepkg/lint_package/build_references.sh.in b/scripts/libmakepkg/lint_package/build_references.sh.in index 9183fce9..6b777bf1 100644 --- a/scripts/libmakepkg/lint_package/build_references.sh.in +++ b/scripts/libmakepkg/lint_package/build_references.sh.in @@ -34,7 +34,7 @@ warn_build_references() { mapfile -t refs < <(find "$pkgdir" -type f -exec grep -l "${!var}" {} +) if (( ${#refs} > 0 )); then warning "$(gettext 'Package contains reference to %s')" "\$$var" - printf '%s\n' "${refs[@]}" >&2 + printf '%s\n' "${refs[@]#"$pkgdir/"}" >&2 fi done return 0 -- 2.14.2

1 0