- Pacman-dev - lists.archlinux.org

[pacman-dev] Fw: [arch-general] Sébastien Luttringer and Tobias Powalowski
by Santiago Torres 06 Jul '17

06 Jul '17

I think this didn't get here... I saw a couple of patches passed around regarding this issue. Thanks, -Santiago. > Thats is exactly what I mean. If I understood right you can modify the > git metadata in a way that you can pull tag 1.2 but get 1.0. And tag 1.0 > is gpg signed and all valid. This seems to work for me. > > I've added sangy to this email, he is the author of this presentation > and should know best. sangy, can you please give us some more detailed > information if an attack could still compromise the systemd package with > a modified git source but still gpg signed commits? > > ~Nico > Hello, sorry for the radio silence on my part. I've been moving apartments so I was offline for a little bit while setting up the new internet contract... This is true, someone can simply change the "soft" ref and trick git into using the wrong tag/branch, be it for installation, merging etc. Although there are some approaches that can mitigate this case (e.g., the signed-push solution), there is still very few people using it. I hope that changes, mainly through visibility. Thanks Nico for pointing this out. I don't think I need to explain how to carry the attack anymore --- I see eschwartz already showed how easy it is to achieve. I'd like to add that anyone with a write access to the repository could also do this. Consider that a lot of git repositories have been hacked in the past (GitHub, kernel.org, RubyGems, Sourceforge, and the FSF come to mind, but there are plenty of examples in the paper) and, while breaking sha1 is still theoretical for the purpose of attacking git, sneaking something like this takes mere seconds and would hardly raise any eyebrows. The git developers are aware of is, and they were hoping package managers integrated these fixes (as erring verification could make it backwards uncompatible). I see that the patchset that I submitted (and should be available from git 2.9) was already passed around. The patch pretty much allowed --format to be used with git tag -v and git verify-tag accordingly. Ideally, a simple check against git tag -v --format=%(tag) should be "robust" enough. I hope that, as time passes, this check will become part of the "natural" tag verification invocation and this doesn't have to be hardcoded in package managers. Please let me know if there is anything unclear on what I said :) Cheers! -Santiago.

1 0

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.0.1-182-gbcc9c417
by allan＠archlinux.org 06 Jul '17

06 Jul '17

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via bcc9c417ae989ffda193083807142171c7a0190f (commit) via c44c649a5280189ea28a54b82e60fc38279fed23 (commit) via 9ab44178f4054ffe26af784c32ca9bddb9793e7e (commit) via 1c8b3f2562bb31e52ad0c5fd9eb139d9dda1873e (commit) via d170c4580cba6af1ec50411f3b1e0621165c6300 (commit) via b14ff6603809019f8f92f1650872cb93a110e67e (commit) via d4193d43cf5346b3a8cfc97a4fc354111df34081 (commit) via 9c604af0a04cefaccba527e00d31d9ccd724f866 (commit) via 3c433abb54e8bc01bed0b2263ded0c339a58585a (commit) via d30878763ce1b5be453b563f2729d7333242e79b (commit) via 5f3812868600488de585771273e12a3e68a4d366 (commit) via 5a1bf3d80367a64ab90368bbf5282c37714b5086 (commit) via 63087c31b5bdd7a16d312d9bf938f6cfd4a635b0 (commit) via a2b776f6c901c706946b49d2b5cadb0c6efd2655 (commit) via 1bc79cb9a5067d685ba507fad9b189ed28ad70a0 (commit) via f4e2009e9b01a3ebff8b54e059d4f0422a139016 (commit) via bf468c09562ecfa552f514c9f897742b309e64ee (commit) via 12f74fd8950b89da15a397ed26bfeb226e20a443 (commit) via bf23f85d4a844b8e8c70125bce54bbda90cb0019 (commit) via c6b04c04653ba9933fe978829148312e412a9ea7 (commit) via c0a5884b186c9e0e5c54e8515d0982fcba134073 (commit) from 4f2fea240d3039294f6614003206a3dd1f67cfc5 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit bcc9c417ae989ffda193083807142171c7a0190f Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Wed May 10 18:54:55 2017 -0400 alpm_list: abort on memory allocation failure This makes it possible to detect a failure in several alpm_list functions. Previously these functions would continue after a failure, returning partial results and potentially leaking memory. Unfortunately, NULL is a valid return value for the affected functions if the input list is empty, so they still do not have a dedicated error value. Callers can at least detect an error by checking if the input list was empty. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit c44c649a5280189ea28a54b82e60fc38279fed23 Author: Levente Polyak <anthraxx(a)archlinux.org> Date: Thu Jul 6 13:57:27 2017 +1000 makepkg: add more information to .BUILDINFO The .BUILDINFO file should retain all the information needed to reproducibly build a package. Add some extra information to the file and also provide a version number to keep track of future changes. Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 9ab44178f4054ffe26af784c32ca9bddb9793e7e Author: Allan McRae <allan(a)archlinux.org> Date: Thu Jul 6 13:34:31 2017 +1000 makepkg: set default value for PACKAGER In write_pkginfo, we checked if $PACKAGER was undefined, and gave a default value if not. Just do this upfront to simplify this function. Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 1c8b3f2562bb31e52ad0c5fd9eb139d9dda1873e Author: Allan McRae <allan(a)archlinux.org> Date: Thu Jul 6 13:27:22 2017 +1000 makepkg: always write pkgbase There is little savings in only writing pkgbase when different to pkgname, and it makes determining the pkgbase by parsing .PKGINFO slightly easier. Lets just write it... Signed-off-by: Allan McRae <allan(a)archlinux.org> commit d170c4580cba6af1ec50411f3b1e0621165c6300 Author: Allan McRae <allan(a)archlinux.org> Date: Thu Jul 6 13:26:04 2017 +1000 makepkg: do not write basever Since 8a02abcf19, this attribute will never exist. Remove check to write it. Signed-off-by: Allan McRae <allan(a)archlinux.org> commit b14ff6603809019f8f92f1650872cb93a110e67e Author: Eli Schwartz <eschwartz93(a)gmail.com> Date: Wed Jul 5 23:14:14 2017 -0400 libmakepkg: Fix improperly spelled local variable declaration Signed-off-by: Eli Schwartz <eschwartz93(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit d4193d43cf5346b3a8cfc97a4fc354111df34081 Author: Eli Schwartz <eschwartz93(a)gmail.com> Date: Mon Jul 3 23:13:23 2017 -0400 libmakepkg/integrity: Fix error message not sent to stderr Signed-off-by: Eli Schwartz <eschwartz93(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 9c604af0a04cefaccba527e00d31d9ccd724f866 Author: Eli Schwartz <eschwartz93(a)gmail.com> Date: Mon Jul 3 23:13:22 2017 -0400 libmakepkg: fix unsanitized source filenames There were a couple places where filenames beginning with "-" were not properly guarded against by passing them after "--". Some PKGBUILD authors are crazy, but we still take those into account. Signed-off-by: Eli Schwartz <eschwartz93(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 3c433abb54e8bc01bed0b2263ded0c339a58585a Author: Christian Hesse <mail(a)eworm.de> Date: Tue Jun 6 21:29:09 2017 +0200 fix typo in libalpm comment contatenate -> concatenate Signed-off-by: Christian Hesse <mail(a)eworm.de> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit d30878763ce1b5be453b563f2729d7333242e79b Author: Allan McRae <allan(a)archlinux.org> Date: Fri May 12 12:41:20 2017 +0200 makepkg: introduce SOURCE_DATE_EPOCH This patch introduces the SOURCE_DATE_EPOCH environmental variable. All files in a package are adjusted to have their modification dates set to the value of SOURCE_DATE_EPOCH, which defaults to "date +%s". Setting this variable allows a package that is built twice in the same environment to be (potentially) reproducible in that the checksum of the generated package file will be the same. Also adjust the compression of the mtree file to avoid gzip embedding a timestamp. Signed-off-by: Levente Polyak <anthraxx(a)archlinux.org> commit 5f3812868600488de585771273e12a3e68a4d366 Author: Allan McRae <allan(a)archlinux.org> Date: Fri May 12 12:41:19 2017 +0200 makepkg: remove build date from .PKGINFO header This information is duplicated (in less friendly format) in the "builddate" entry and removing it improves reproducible packaging. Signed-off-by: Allan McRae <allan(a)archlinux.org> Signed-off-by: Levente Polyak <anthraxx(a)archlinux.org> commit 5a1bf3d80367a64ab90368bbf5282c37714b5086 Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Wed May 10 18:54:57 2017 -0400 remove unused byte from user agent buffer snprintf prints at most n bytes including the terminating '\0'. The extra reserved byte was never being used. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 63087c31b5bdd7a16d312d9bf938f6cfd4a635b0 Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Wed May 10 18:54:56 2017 -0400 check for overflow when setting HTTP_USER_AGENT gcc7 issues a warning about a potential overflow if left unchecked. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit a2b776f6c901c706946b49d2b5cadb0c6efd2655 Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Wed May 10 18:54:54 2017 -0400 query_fileowner: avoid buffer overflow Copying a string into a buffer that has just been determined to not be able to hold it is obviously incorrect. The actual error handling appears to have been unintentionally removed in 47762ab687959e48acc2de8592fcf3ba3cfa502b. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 1bc79cb9a5067d685ba507fad9b189ed28ad70a0 Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Wed May 10 18:54:53 2017 -0400 alpm_unlock: check handle before dereferencing Prevents SIGSEGV if we catch SIGINT or SIGHUP before initializing alpm. Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit f4e2009e9b01a3ebff8b54e059d4f0422a139016 Author: Michael Straube <straubem(a)gmx.de> Date: Fri Apr 21 15:42:26 2017 +0200 pacman.8: fix typo in query options Signed-off-by: Michael Straube <straubem(a)gmx.de> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit bf468c09562ecfa552f514c9f897742b309e64ee Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Sat Apr 22 17:34:11 2017 -0400 free memory for --overwrite lists Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 12f74fd8950b89da15a397ed26bfeb226e20a443 Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Sat Apr 22 17:34:10 2017 -0400 add send_fakem to valgrind.supp Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit bf23f85d4a844b8e8c70125bce54bbda90cb0019 Author: Andrew Gregory <andrew.gregory.8(a)gmail.com> Date: Sun Apr 16 23:28:32 2017 -0400 be_sync: error out if a db cannot be parsed Signed-off-by: Andrew Gregory <andrew.gregory.8(a)gmail.com> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit c6b04c04653ba9933fe978829148312e412a9ea7 Author: Allan McRae <allan(a)archlinux.org> Date: Mon Apr 17 18:30:05 2017 +1000 makepkg: create signature files outside of fakeroot With recent version of gpg, signing within fakeroot works on the first invocation, but fails on later runs. Sign all packages outside of fakeroot to avoid this issue. Fixes FS#49946. Signed-off-by: Allan McRae <allan(a)archlinux.org> commit c0a5884b186c9e0e5c54e8515d0982fcba134073 Author: Allan McRae <allan(a)archlinux.org> Date: Mon Apr 17 18:33:52 2017 +1000 makepkg: do not create symlinks in build directory Setting PKGDEST and friends enables us to keep all built packages in a single location. Symlinking these files into the build directory creates unnecessary clutter and requires clean-up in multiple places when removing old version. Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: doc/pacman.8.txt | 2 +- lib/libalpm/alpm.c | 2 +- lib/libalpm/alpm_list.c | 29 ++++++-- lib/libalpm/be_sync.c | 17 +++-- lib/libalpm/handle.c | 2 + .../libmakepkg/integrity/generate_signature.sh.in | 34 +++++++++- .../libmakepkg/integrity/verify_signature.sh.in | 4 +- scripts/libmakepkg/source/file.sh.in | 4 +- scripts/makepkg.sh.in | 79 ++++++++-------------- src/pacman/conf.c | 1 + src/pacman/pacman.c | 9 ++- src/pacman/query.c | 1 + valgrind.supp | 8 +++ 13 files changed, 119 insertions(+), 73 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [PATCH] makepkg: add more information to .BUILDINFO
by Allan McRae 06 Jul '17

06 Jul '17

From: Levente Polyak <anthraxx(a)archlinux.org> The .BUILDINFO file should retain all the information needed to reproducibly build a package. Add some extra information to the file and also provide a version number to keep track of future changes. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- @Levente: with other changes suggested by Dave on earlier versions of your patches, the refactoring became somewhat useless. Are you happy with this version of your patch? scripts/makepkg.sh.in | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 3c29c2d8..20e9dd7e 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -667,13 +667,21 @@ write_pkginfo() { write_buildinfo() { msg2 "$(gettext "Generating %s file...")" ".BUILDINFO" - write_kv_pair "builddir" "${BUILDDIR}" + write_kv_pair "format" "1" + + write_kv_pair "pkgname" "$pkgname" + write_kv_pair "pkgbase" "$pkgbase" + + local fullver=$(get_full_version) + write_kv_pair "pkgver" "$fullver" local sum="$(sha256sum "${BUILDFILE}")" sum=${sum%% *} - write_kv_pair "pkgbuild_sha256sum" $sum + write_kv_pair "packager" "${PACKAGER}" + write_kv_pair "builddate" "${SOURCE_DATE_EPOCH}" + write_kv_pair "builddir" "${BUILDDIR}" write_kv_pair "buildenv" "${BUILDENV[@]}" write_kv_pair "options" "${OPTIONS[@]}" -- 2.13.2

1 0

[pacman-dev] [PATCH] makepkg: set default value for PACKAGER
by Allan McRae 06 Jul '17

06 Jul '17

In write_pkginfo, we checked if $PACKAGER was undefined, and gave a default value if not. Just do this upfront to simplify this function. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- scripts/makepkg.sh.in | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 90f52abe..3c29c2d8 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -622,12 +622,6 @@ write_kv_pair() { } write_pkginfo() { - if [[ -n $PACKAGER ]]; then - local packager="$PACKAGER" - else - local packager="Unknown Packager" - fi - local size="$(@DUPATH@ @DUFLAGS@)" size="$(( ${size%%[^0-9]*} * 1024 ))" @@ -651,7 +645,7 @@ write_pkginfo() { write_kv_pair "pkgdesc" "$spd" write_kv_pair "url" "$url" write_kv_pair "builddate" "$SOURCE_DATE_EPOCH" - write_kv_pair "packager" "$packager" + write_kv_pair "packager" "$PACKAGER" write_kv_pair "size" "$size" write_kv_pair "arch" "$pkgarch" @@ -1430,6 +1424,7 @@ PKGEXT=${_PKGEXT:-$PKGEXT} SRCEXT=${_SRCEXT:-$SRCEXT} GPGKEY=${_GPGKEY:-$GPGKEY} PACKAGER=${_PACKAGER:-$PACKAGER} +PACKAGER=${PACKAGER:-"Unknown Packager"} #default if undefined CARCH=${_CARCH:-$CARCH} if (( ! INFAKEROOT )); then -- 2.13.2

1 0

[pacman-dev] [PATCH] makepkg: always write pkgbase
by Allan McRae 06 Jul '17

06 Jul '17

There is little savings in only writing pkgbase when different to pkgname, and it makes determining the pkgbase by parsing .PKGINFO slightly easier. Lets just write it... Signed-off-by: Allan McRae <allan(a)archlinux.org> --- scripts/makepkg.sh.in | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index f9872355..90f52abe 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -638,9 +638,7 @@ write_pkginfo() { printf "# using %s\n" "$(fakeroot -v)" write_kv_pair "pkgname" "$pkgname" - if (( SPLITPKG )) || [[ "$pkgbase" != "$pkgname" ]]; then - write_kv_pair "pkgbase" "$pkgbase" - fi + write_kv_pair "pkgbase" "$pkgbase" local fullver=$(get_full_version) write_kv_pair "pkgver" "$fullver" -- 2.13.2

1 0

[pacman-dev] [PATCH] makepkg: do not write basever
by Allan McRae 06 Jul '17

06 Jul '17

Since 8a02abcf19, this attribute will never exist. Remove check to write it. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- scripts/makepkg.sh.in | 3 --- 1 file changed, 3 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 1f1217f4..f9872355 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -644,9 +644,6 @@ write_pkginfo() { local fullver=$(get_full_version) write_kv_pair "pkgver" "$fullver" - if [[ "$fullver" != "$basever" ]]; then - write_kv_pair "basever" "$basever" - fi # TODO: all fields should have this treatment local spd="${pkgdesc//+([[:space:]])/ }" -- 2.13.2

1 0

[pacman-dev] [PATCH] libmakepkg: Fix improperly spelled local variable declaration
by Eli Schwartz 06 Jul '17

06 Jul '17

Signed-off-by: Eli Schwartz <eschwartz93(a)gmail.com> --- scripts/libmakepkg/integrity/verify_signature.sh.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/libmakepkg/integrity/verify_signature.sh.in b/scripts/libmakepkg/integrity/verify_signature.sh.in index 5468f977..24519dbe 100644 --- a/scripts/libmakepkg/integrity/verify_signature.sh.in +++ b/scripts/libmakepkg/integrity/verify_signature.sh.in @@ -33,7 +33,7 @@ check_pgpsigs() { msg "$(gettext "Verifying source file signatures with %s...")" "gpg" local netfile proto pubkey success status fingerprint trusted - local warning=0 + local warnings=0 local errors=0 local statusfile=$(mktemp) local all_sources -- 2.13.2

1 0

[pacman-dev] [PATCH 1/2] libmakepkg: fix unsanitized source filenames
by Eli Schwartz 04 Jul '17

04 Jul '17

There were a couple places where filenames beginning with "-" were not properly guarded against by passing them after "--". Some PKGBUILD authors are crazy, but we still take those into account. Signed-off-by: Eli Schwartz <eschwartz93(a)gmail.com> --- scripts/libmakepkg/source/file.sh.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/libmakepkg/source/file.sh.in b/scripts/libmakepkg/source/file.sh.in index 1d85ea9b..41a5fb5c 100644 --- a/scripts/libmakepkg/source/file.sh.in +++ b/scripts/libmakepkg/source/file.sh.in @@ -96,7 +96,7 @@ extract_file() { fi # do not rely on extension for file type - local file_type=$(file -bizL "$file") + local file_type=$(file -bizL -- "$file") local ext=${file##*.} local cmd='' case "$file_type" in @@ -132,7 +132,7 @@ extract_file() { $cmd -xf "$file" || ret=$? else rm -f -- "${file%.*}" - $cmd -dcf "$file" > "${file%.*}" || ret=$? + $cmd -dcf -- "$file" > "${file%.*}" || ret=$? fi if (( ret )); then error "$(gettext "Failed to extract %s")" "$file" -- 2.13.2

1 1

Re: [pacman-dev] Breaking change in pacman from 5.0.1 -> 5.0.2 with regards to user account resolution
by Thomas Karlsson 21 Jun '17

21 Jun '17

Hello! I have several packages that install files that need to be owned by specific users on the target system. To achieve that I'm using the install command with the -o <username> and -g <group name> flags in the package() function. I'm not using a install script with a post_install() function. Example of the relevant part of the package function package() { install -m 600 -o username -g groupname the_file "$pkgdir"/some/path/to/the_file } The package is built on a build server and then installed on a number of targets. This has worked fine up until I upgraded to 5.0.2 After upgrading pacman to 5.0.2 the file does not get the correct owner on the target system any more. It gets own by the user that has the UID that the user has on the build server which is not the same UID as the user has on the target. To clarify. In my setup the UID of the user is different on the build server compared to the UID of the target system. Before this did not matter. The file got the correct ownership anyway. After 5.0.2 the file gets owned by whatever user account that has the UID and GID that the user has on the build server no matter what UID and GID the user has on the target system. As far as I can tell this is probably the commit that changed the behavior https://git.archlinux.org/pacman.git/commit/?h=release/5.0.x&id=908769b5400… Temporarily I have changed my PKGBUILD file to specify UID and GID that the target system has instead of the username and groupname on the install command but this seems fragile as it now requires that the UID/GID is the same on all target systems. Both existing and future. Is this an unintended side effect of the commit referenced above, or is this the expected behavior? Best regards, Thomas Karlsson

3 3

[pacman-dev] Correct alpm version to bind to?
by Colin Woodbury 13 Jun '17

13 Jun '17

Hi all, I'm the Aura dev. I'm writing alpm bindings for it, and I got a fair distance through before I realized that my up-to-date paper copies and the version of `alpm.h` actually bundled with pacman on my machine are quite different. The local one (/usr/include/alpm.h) is dated 2016 and has types / function signatures that vary a fair amount from what's currently on master, although they both report their versions to be 10.0.1. Is the most recent alpm supposed to be bundled with pacman? What incarnation of alpm does our installed pacman (5.0.1-5 as of this writing) bind to itself? Which version should be considered the "ground truth" for people writing bindings? Thanks, Colin

2 1