- Pacman-dev - lists.archlinux.org

[Git][pacman/pacman][master] libalpm/signing.c: prevent underflow in length_check
by Allan McRae (＠allan) 03 Feb '24

03 Feb '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 16a2a797 by Allan McRae at 2024-02-04T07:54:12+10:00 libalpm/signing.c: prevent underflow in length_check The length_check function could underflow if the provided buffer index is greater than the signature buffer length, leading to an out of bounds read. Signed-off-by: Allan McRae <allan@archlinux.org> - - - - - 1 changed file: - lib/libalpm/signing.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/16a2a79728d6b3184fd3615… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/16a2a79728d6b3184fd3615… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] pacman/conf.c: fix leak on error in setdefaults()
by Allan McRae (＠allan) 03 Feb '24

03 Feb '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 6711d10f by Allan McRae at 2024-02-04T07:49:08+10:00 pacman/conf.c: fix leak on error in setdefaults() Signed-off-by: Allan McRae <allan@archlinux.org> - - - - - 1 changed file: - src/pacman/conf.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/6711d10f96e0862f7b0b086… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/6711d10f96e0862f7b0b086… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] pacman/util.c: fix user after free in print_packages
by Allan McRae (＠allan) 03 Feb '24

03 Feb '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 36fcff6e by Allan McRae at 2024-01-26T18:13:11+10:00 pacman/util.c: fix user after free in print_packages Signed-off-by: Allan McRae <allan@archlinux.org> - - - - - 1 changed file: - src/pacman/util.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/36fcff6e13ac65797936faf… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/36fcff6e13ac65797936faf… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] Fix typo in exporting RUSTFLAGS
by Allan McRae (＠allan) 13 Jan '24

13 Jan '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 3c28c301 by Allan McRae at 2024-01-14T08:50:29+10:00 Fix typo in exporting RUSTFLAGS Fixes #77 Signed-off-by: Allan McRae <allan@archlinux.org> - - - - - 1 changed file: - scripts/libmakepkg/buildenv/rust.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/3c28c301335f8f83b55ae53… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/3c28c301335f8f83b55ae53… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] add.c: drop newline in permission and ownership log messages
by Allan McRae (＠allan) 09 Jan '24

09 Jan '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 4c93e63d by Ronan Pigott at 2024-01-10T08:52:35+10:00 add.c: drop newline in permission and ownership log messages These are the only log messages produced by pacman that include an embedded newline, and it looks very incongruous in a typical pacman.log. Signed-off-by: Allan McRae <allan@archlinux.org> - - - - - 1 changed file: - lib/libalpm/add.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/4c93e63ddfddee5cfe65a65… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/4c93e63ddfddee5cfe65a65… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] makepkg: only check software once
by Allan McRae (＠allan) 09 Jan '24

09 Jan '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: f69d9b44 by Allan McRae at 2024-01-09T22:42:45+00:00 makepkg: only check software once Move the checks for software and gpg signing ability to after the fakeroot section so that it is only executed once. This also fixes gpg (lack of) interaction under fakeroot. Fixes #69 Signed-off-by: Allan McRae <allan@archlinux.org> - - - - - 1 changed file: - scripts/makepkg.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/f69d9b4475a0ca70b3e5a38… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/f69d9b4475a0ca70b3e5a38… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] 2 commits: _alpm_handle_free: free all in-memory resources
by Allan McRae (＠allan) 09 Jan '24

09 Jan '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 929bad61 by Andrew Gregory at 2024-01-09T22:39:14+00:00 _alpm_handle_free: free all in-memory resources Freeing handle resources was previously split awkwardly between _alpm_handle_free and alpm_release. This consolidates the freeing of all in-memory resources to _alpm_handle_free, leaving alpm_release as a thin wrapper that provides safety checks and frees any external resources, e.g. removing lock files. Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> - - - - - 42fa74e9 by Andrew Gregory at 2024-01-09T22:39:14+00:00 free handle resources before running scripts The primary purpose of this is to allow cleanup of file descriptors allocated by curl that were left open in the child. I am not aware of any issues caused by the open file descriptors, but think it better to not leave random open fd's lying around. Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com> - - - - - 3 changed files: - lib/libalpm/alpm.c - lib/libalpm/handle.c - lib/libalpm/util.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/00d2b1f90261bf77eaaf26… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/00d2b1f90261bf77eaaf26… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] 2 commits: strip: split off file stripping and debug package creation
by Allan McRae (＠allan) 09 Jan '24

09 Jan '24

Allan McRae pushed to branch master at Pacman / Pacman Commits: 7a4fff33 by Morten Linderud at 2023-12-17T16:04:45+01:00 strip: split off file stripping and debug package creation Some projects might duplicate the file in multiple locations for one reason or another. When debug packages are enabled, `makepkg` will only strip the first occurrence of the binary and abort early on all the other binaries. Signed-off-by: Morten Linderud <morten@linderud.pw> - - - - - 00d2b1f9 by Morten Linderud at 2023-12-17T16:04:45+01:00 strip: don't create debug packages from .a files .a files are not valid ELF files so we can't run objcopy nor debugedit on them. Rename STRIPLTO to STATICLIB to be more descriptive. Signed-off-by: Morten Linderud <morten@linderud.pw> - - - - - 1 changed file: - scripts/libmakepkg/tidy/strip.sh.in View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/8d38746586794ab2cb21dc… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/8d38746586794ab2cb21dc… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

Supporting openssh-signing of packages and databases
by Max Gautier 08 Dec '23

08 Dec '23

Would pacman be interested in supporting signature verification of packages (and databases) using the (relatively new) signing protocol introduced and implemented by Openssh [1], alongside GPG signatures ? The intended benefits are be easier packagers setup and workflows (compared to GPG), as well as more out of the box support for signing with FIDO2 tokens (as openssh has sk-* keys to natively support those). The ALLOWED_SIGNERS (documented in man ssh-keygen) file and thus the signing namespace or namespaces would be up to the distribution using pacman (presumably, different distributions should not use the same namespace(s)). If there is interest in this, I'm interested in trying my hands at an implementation; in that case, I'd welcome any advice or things to avoid in doing so. Thanks, [1]: https://raw.githubusercontent.com/openssh/openssh-portable/master/PROTOCOL.… -- Max Gautier

2 6

[Git][pacman/pacman][master] libalpm: fix check_pgp_signature docs
by Allan McRae (＠allan) 05 Dec '23

05 Dec '23

Allan McRae pushed to branch master at Pacman / Pacman Commits: 8d387465 by morganamilo at 2023-12-04T15:34:49+00:00 libalpm: fix check_pgp_signature docs The function did have these return values a long time ago but now only return 0 or -1. - - - - - 1 changed file: - lib/libalpm/alpm.h View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/8d38746586794ab2cb21dc4… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/8d38746586794ab2cb21dc4… You're receiving this email because of your account on gitlab.archlinux.org.

1 0