- Pacman-dev - lists.archlinux.org

[Git][pacman/pacman][master] 14 commits: Add DownloadUser configuration option
by Allan McRae (＠allan) 01 Apr '24

01 Apr '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 56eb8728 by Remi Gacogne at 2024-04-01T20:52:55+00:00 Add DownloadUser configuration option The DownloadUser option will be used to drop privledges to the specified user when downloading files. The intention is for this to be extended in the future to a more general sandbox configuration to cover operating on package and database files prior to verification. Add this option to pacman configuration and the various accessors into the libalpm backend. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - ce83cf63 by Remi Gacogne at 2024-04-01T20:52:55+00:00 Provide function for switching user in child processes Add alpm_sandbox_child() function that will be used for switching to a less priviledged user to run child processes. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 62c68746 by Remi Gacogne at 2024-04-01T20:52:55+00:00 Add callbacks for sandboxed operations Add log and download callbacks to use within a sandbox. These are designed to be passed from the sandbox to the parent through a file descriptor and then processed into alpm callbacks to be passed to the frontend. Note, only callbacks used in libalpm are added. Other callbacks should be set to NULL in the child process. - - - - - 9667bc6b by Allan McRae at 2024-04-01T20:52:55+00:00 Expose _alpm_reset_signals() to library Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 93a796aa by Remi Gacogne at 2024-04-01T20:52:55+00:00 Add sandboxed download for the internal downloader If the SandboxUser configure option is set, the internal downloader will fork of a child process and drop to the specified user to download the files. Signed-off-by: Remi Gacogne <rgacogne(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - cf359b0d by Remi Gacogne at 2024-04-01T20:52:55+00:00 Add support for DownloadUser with XferCommand Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 49d51226 by Remi Gacogne at 2024-04-01T20:52:55+00:00 Document DownloadUser Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 04d04381 by Allan McRae at 2024-04-01T20:52:55+00:00 libalpm: fill in more payload information before passing to downloader Filling in more of the payload fields before passing to the downloader ensures that the these fields do not get lost during sandboxed operations. It also fixes the use of -U with XferCommand, but testsuite still fails due to "404" page being downloaded for the signature. Given we can not identify this as being a non-signature download with the XferCommand, we can just turn off signature checking in this test. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 26b7b353 by Allan McRae at 2024-04-01T20:52:55+00:00 Remove random_partfile from payload struct It is not used any more due to filling the payload structure earlier. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 5e9bff62 by Remi Gacogne at 2024-04-01T20:52:55+00:00 Stop trusting the Content-Disposition HTTP header - - - - - 0b6df551 by Andrew Gregory at 2024-04-01T20:52:55+00:00 pactest: Add basic sandboxed download tests Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 11c8eca9 by Andrew Gregory at 2024-04-01T20:52:55+00:00 pactest: test database downloads with optional signatures Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - e1a7b83e by Remi Gacogne at 2024-04-01T20:52:55+00:00 Download to a temporary directory owned by the Download user Signed-off-by: Remi Gacogne <rgacogne(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - cfa68f7b by Remi Gacogne at 2024-04-01T20:52:55+00:00 Restore partially downloaded files to the temporary directory This allows downloads to be continued. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 24 changed files: - doc/pacman.conf.5.asciidoc - lib/libalpm/alpm.h - lib/libalpm/be_sync.c - lib/libalpm/dload.c - lib/libalpm/dload.h - lib/libalpm/handle.c - lib/libalpm/handle.h - lib/libalpm/meson.build - + lib/libalpm/sandbox.c - + lib/libalpm/sandbox.h - lib/libalpm/sync.c - lib/libalpm/util.c - lib/libalpm/util.h - src/pacman/callback.c - src/pacman/conf.c - src/pacman/conf.h - src/pacman/pacman-conf.c - test/pacman/meson.build - + test/pacman/tests/database-refresh-optional-siglevel.py - + test/pacman/tests/sandbox-download-basic.py - + test/pacman/tests/sandbox-download-upgrade.py - test/pacman/tests/upgrade-download-pkg-and-sig-with-filename.py - − test/pacman/tests/upgrade-download-pkg-and-sig-without-filename.py - test/pacman/tests/upgrade-download-with-xfercommand.py View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/01e64e8b6a25f94b13dc92… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/01e64e8b6a25f94b13dc92… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] use snprintf instead of sprintf
by Allan McRae (＠allan) 25 Mar '24

25 Mar '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 01e64e8b by Vladislav Nepogodin at 2024-03-25T13:24:41+10:00 use snprintf instead of sprintf sprintf does not check for buffer overflows (CWE-120) modified: src/pacman/callback.c - - - - - 11 changed files: - lib/libalpm/alpm.c - lib/libalpm/be_local.c - lib/libalpm/be_sync.c - lib/libalpm/conflict.c - lib/libalpm/db.c - lib/libalpm/signing.c - lib/libalpm/sync.c - lib/libalpm/trans.c - src/pacman/callback.c - src/pacman/package.c - src/pacman/query.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/01e64e8b6a25f94b13dc925… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/01e64e8b6a25f94b13dc925… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

No signed 6.1.0 release on sources.archlinux.org
by Ben Westover 21 Mar '24

21 Mar '24

Hello, I package pacman for Debian, and I have been using the tarballs from sources.archlinux.org as my source, since they are PGP signed. 6.1.0 was released a couple weeks ago but still has not appeared at that location. Is this no longer the best place to get pacman source tarballs? Is there anywhere else to look for signed tarballs? Thanks, -- Ben Westover

2 1

[Git][pacman/pacman][release/6.1.x] 2 commits: Limit scope of `name` and `a` variable to avoid conflict with PKGBUILD scripts.
by Allan McRae (＠allan) 20 Mar '24

20 Mar '24

Allan McRae pushed to branch release/6.1.x at Pacman / Pacman Commits: 082094a1 by bartus at 2024-03-19T12:43:00+00:00 Limit scope of `name` and `a` variable to avoid conflict with PKGBUILD scripts. - - - - - b2bb2e24 by Allan McRae at 2024-03-20T21:39:41+10:00 makepkg: Fix missing end of line in -D documentaiton Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 2 changed files: - scripts/libmakepkg/util/pkgbuild.sh.in - scripts/makepkg.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/b59d68a2094287df8af5e8… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/b59d68a2094287df8af5e8… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] makepkg: Fix missing end of line in -D documentaiton
by Allan McRae (＠allan) 20 Mar '24

20 Mar '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: b2bb2e24 by Allan McRae at 2024-03-20T21:39:41+10:00 makepkg: Fix missing end of line in -D documentaiton Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - scripts/makepkg.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/b2bb2e24827450465a9e0a8… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/b2bb2e24827450465a9e0a8… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Limit scope of `name` and `a` variable to avoid conflict with PKGBUILD scripts.
by Allan McRae (＠allan) 20 Mar '24

20 Mar '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 082094a1 by bartus at 2024-03-19T12:43:00+00:00 Limit scope of `name` and `a` variable to avoid conflict with PKGBUILD scripts. - - - - - 1 changed file: - scripts/libmakepkg/util/pkgbuild.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/082094a1d8d0f7a528fe0ad… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/082094a1d8d0f7a528fe0ad… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][release/6.1.x] 5 commits: Fix deadlink to the old bug tracker in footer
by Allan McRae (＠allan) 19 Mar '24

19 Mar '24

Allan McRae pushed to branch release/6.1.x at Pacman / Pacman Commits: 942bbe2d by Dale young at 2024-03-18T17:15:07+08:00 Fix deadlink to the old bug tracker in footer The bug tracker had been updated in doc/index.asciidoc, but the one in doc/footer.asciidoc was still the old one, which is a deadlink now. I udpated it just by copying the sentense in doc/index.asciidoc Signed-off-by: Dale young <daleyoung4242(a)gmail.com> - - - - - 478af5d1 by Allan McRae at 2024-03-19T00:40:09+00:00 Fix read-after-free issue parsing config files We were indirectly adjusting a pointer to a parameter that was declared as a const. This resulted in a use-after-free when using --debug: [11:09:18] debug: config: finished parsing ��A�8_ Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - eb5bf691 by Demi Obenour at 2024-03-19T11:44:38+10:00 Fetch signature and database from the same URL Previously, the for loops on lines 1035 and 1037 would advance to the next element in the server list, even if downloading the URL succeeded. If there are no more servers in the list, `s` would be NULL, causing a NULL pointer dereference on line 1046. If there were servers left in the list, the signature would be downloaded from a wrong URL. 1. Fetching of database signatures is enabled. 2. There is only one enabled remote repository URL, or fetching from all but the last one fails and fetching from the last one succeeds. 3. An XferCommand is used. Qubes OS Arch templates satisfy all of these conditions and trigger the bug. - - - - - 92102f47 by Allan McRae at 2024-03-19T01:47:42+00:00 makepkg: document -D in --help text Fixes #110. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - b59d68a2 by Allan McRae at 2024-03-19T12:02:44+10:00 Update bug report URL in tranlsation configuration files Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 10 changed files: - doc/footer.asciidoc - lib/libalpm/dload.c - lib/libalpm/po/Makevars - lib/libalpm/po/meson.build - scripts/makepkg.sh.in - scripts/po/Makevars - scripts/po/meson.build - src/pacman/conf.c - src/pacman/po/Makevars - src/pacman/po/meson.build View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/bae9594ac1806ce30f2af1… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/bae9594ac1806ce30f2af1… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Update bug report URL in tranlsation configuration files
by Allan McRae (＠allan) 19 Mar '24

19 Mar '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: b59d68a2 by Allan McRae at 2024-03-19T12:02:44+10:00 Update bug report URL in tranlsation configuration files Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 6 changed files: - lib/libalpm/po/Makevars - lib/libalpm/po/meson.build - scripts/po/Makevars - scripts/po/meson.build - src/pacman/po/Makevars - src/pacman/po/meson.build View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/b59d68a2094287df8af5e8a… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/b59d68a2094287df8af5e8a… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] makepkg: document -D in --help text
by Allan McRae (＠allan) 19 Mar '24

19 Mar '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 92102f47 by Allan McRae at 2024-03-19T01:47:42+00:00 makepkg: document -D in --help text Fixes #110. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - scripts/makepkg.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/92102f477ee9b8a93614c3b… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/92102f477ee9b8a93614c3b… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Fetch signature and database from the same URL
by Allan McRae (＠allan) 19 Mar '24

19 Mar '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: eb5bf691 by Demi Obenour at 2024-03-19T11:44:38+10:00 Fetch signature and database from the same URL Previously, the for loops on lines 1035 and 1037 would advance to the next element in the server list, even if downloading the URL succeeded. If there are no more servers in the list, `s` would be NULL, causing a NULL pointer dereference on line 1046. If there were servers left in the list, the signature would be downloaded from a wrong URL. 1. Fetching of database signatures is enabled. 2. There is only one enabled remote repository URL, or fetching from all but the last one fails and fetching from the last one succeeds. 3. An XferCommand is used. Qubes OS Arch templates satisfy all of these conditions and trigger the bug. - - - - - 1 changed file: - lib/libalpm/dload.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/eb5bf6913835e7553433ef8… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/eb5bf6913835e7553433ef8… You're receiving this email because of your account on gitlab.archlinux.org.

1 0