- Pacman-dev - lists.archlinux.org

[PATCH] libmakepkg/integrity: handle PGP signature files containing multiple signatures
by Jonas Witschel 26 Jun '22

26 Jun '22

PGP signature files can contain multiple signatures from different keys. In this case, verification is considered to be successful if *all* signatures are valid, compare e.g. the behaviour of the gpgv verification tool. parse_gpg_statusfile() is currently not equipped to handle the gpg output for such signature files: it assumes that the file contains only one signature and therefore overwrites the verification results of previous signatures, effectively only considering the last signature in the file. Therefore the logic needs to be refined so that $success and $trusted are only true if all signatures are valid and trusted, respectively. We also need to store the verification results per key (in order to present more specific error messages) and all the validated fingerprints (in order to check whether they are in validpgpkeys). The signatures for the source tarballs of recent GnuPG releases, e.g. version 2.2.35, are examples of such signature files. Signed-off-by: Jonas Witschel <diabonas(a)archlinux.org> --- .../integrity/verify_signature.sh.in | 115 ++++++++++-------- 1 file changed, 65 insertions(+), 50 deletions(-) diff --git a/scripts/libmakepkg/integrity/verify_signature.sh.in b/scripts/libmakepkg/integrity/verify_signature.sh.in index ad5bb66d..4aa14d94 100644 --- a/scripts/libmakepkg/integrity/verify_signature.sh.in +++ b/scripts/libmakepkg/integrity/verify_signature.sh.in @@ -26,6 +26,18 @@ LIBRARY=${LIBRARY:-'@libmakepkgdir@'} source "$LIBRARY/util/message.sh" source "$LIBRARY/util/pkgbuild.sh" +# Returns the elements of the first array that are not found in the second +# array as the third array. All arrays are passed by name. +set_difference() { + local -n first=$1 + local -n second=$2 + local -n result=$3 + result=() + for element in "${first[@]}"; do + ! in_array "$element" "${second[@]}" && result+=("$element") + done +} + check_pgpsigs() { (( SKIPPGPCHECK )) && return 0 ! source_has_signatures && return 0 @@ -56,48 +68,53 @@ check_pgpsigs() { fi # these variables are assigned values in parse_gpg_statusfile - success=0 - status= - pubkey= - fingerprint= + success= + declare -A status + fingerprints=() trusted= parse_gpg_statusfile "$statusfile" if (( ! $success )); then printf '%s' "$(gettext "FAILED")" >&2 - case "$status" in - "missingkey") - printf ' (%s)' "$(gettext "unknown public key") $pubkey" >&2 - ;; - "revokedkey") - printf " ($(gettext "public key %s has been revoked"))" "$pubkey" >&2 - ;; - "bad") - printf ' (%s)' "$(gettext "bad signature from public key") $pubkey" >&2 - ;; - "error") - printf ' (%s)' "$(gettext "error during signature verification")" >&2 - ;; - esac + for pubkey in "${!status[@]}"; do + case "${status["$pubkey"]}" in + "missingkey") + printf ' (%s)' "$(gettext "unknown public key") $pubkey" >&2 + ;; + "revokedkey") + printf " ($(gettext "public key %s has been revoked"))" "$pubkey" >&2 + ;; + "bad") + printf ' (%s)' "$(gettext "bad signature from public key") $pubkey" >&2 + ;; + "error") + printf ' (%s)' "$(gettext "error during signature verification")" >&2 + ;; + esac + done errors=1 else + local invalid_keys + set_difference fingerprints validpgpkeys invalid_keys if (( ${#validpgpkeys[@]} == 0 && !trusted )); then - printf "%s ($(gettext "the public key %s is not trusted"))" $(gettext "FAILED") "$fingerprint" >&2 + printf "%s ($(gettext "the public key %s is not trusted"))" $(gettext "FAILED") "${fingerprints[*]}" >&2 errors=1 - elif (( ${#validpgpkeys[@]} > 0 )) && ! in_array "$fingerprint" "${validpgpkeys[@]}"; then - printf "%s (%s %s)" "$(gettext "FAILED")" "$(gettext "invalid public key")" "$fingerprint" >&2 + elif (( ${#validpgpkeys[@]} > 0 )) && (( ${#invalid_keys[@]} > 0 )); then + printf "%s (%s %s)" "$(gettext "FAILED")" "$(gettext "invalid public key")" "${invalid_keys[*]}" >&2 errors=1 else printf '%s' "$(gettext "Passed")" >&2 - case "$status" in - "expired") - printf ' (%s)' "$(gettext "WARNING:") $(gettext "the signature has expired.")" >&2 - warnings=1 - ;; - "expiredkey") - printf ' (%s)' "$(gettext "WARNING:") $(gettext "the key has expired.")" >&2 - warnings=1 - ;; - esac + for pubkey in "${!status[@]}"; do + case "${status["$pubkey"]}" in + "expired") + printf " (%s $(gettext "the signature by key %s has expired."))" "$(gettext "WARNING:")" "$pubkey" >&2 + warnings=1 + ;; + "expiredkey") + printf " (%s $(gettext "the key %s has expired."))" "$(gettext "WARNING:")" "$pubkey" >&2 + warnings=1 + ;; + esac + done fi fi printf '\n' >&2 @@ -201,59 +218,57 @@ verify_git_signature() { parse_gpg_statusfile() { local type arg1 arg6 arg10 + success=-1 + trusted=-1 while read -r _ type arg1 _ _ _ _ arg6 _ _ _ arg10 _; do case "$type" in GOODSIG) - pubkey=$arg1 - success=1 - status="good" + success=$((success!=0)) + status["$arg1"]="good" ;; EXPSIG) - pubkey=$arg1 - success=1 - status="expired" + success=$((success!=0)) + status["$arg1"]="expired" ;; EXPKEYSIG) - pubkey=$arg1 - success=1 - status="expiredkey" + success=$((success!=0)) + status["$arg1"]="expiredkey" ;; REVKEYSIG) - pubkey=$arg1 success=0 - status="revokedkey" + status["$arg1"]="revokedkey" ;; BADSIG) - pubkey=$arg1 success=0 - status="bad" + status["$arg1"]="bad" ;; ERRSIG) - pubkey=$arg1 success=0 if [[ $arg6 == 9 ]]; then - status="missingkey" + status["$arg1"]="missingkey" else - status="error" + status["$arg1"]="error" fi ;; VALIDSIG) if [[ $arg10 ]]; then # If the file was signed with a subkey, arg10 contains # the fingerprint of the primary key - fingerprint=$arg10 + fingerprints+=("$arg10") else - fingerprint=$arg1 + fingerprints+=("$arg1") fi ;; TRUST_UNDEFINED|TRUST_NEVER) trusted=0 ;; TRUST_MARGINAL|TRUST_FULLY|TRUST_ULTIMATE) - trusted=1 + trusted=$((trusted!=0)) ;; esac done < "$1" + success=$((success>0)) + trusted=$((trusted>0)) } source_has_signatures() { -- 2.36.1

3 8

[PATCH] makepkg: Implement the verify function
by Morten Linderud 25 Jun '22

25 Jun '22

From: Morten Linderud <morten(a)linderud.pw> This patch implements a new verify function in makepkg. It allows us to do arbitrary authentication on sources before extraction. There are several new signing and validation methods being implemented and it would be hard to have `makepkg` implement support for things such as sequoia, cosign or minisign. This would allow us to distribute generic validation functions. This also implements a new `copy_` routine for our protocols as we need to have a separation between extracting sources and copying sources. Signed-off-by: Morten Linderud <morten(a)linderud.pw> --- doc/PKGBUILD.5.asciidoc | 4 ++++ doc/makepkg.8.asciidoc | 3 +++ scripts/libmakepkg/integrity.sh.in | 3 +++ scripts/libmakepkg/source.sh.in | 15 +++++++++++++++ scripts/libmakepkg/source/file.sh.in | 9 ++++++++- scripts/makepkg.sh.in | 17 ++++++++++++++++- 6 files changed, 49 insertions(+), 2 deletions(-) diff --git a/doc/PKGBUILD.5.asciidoc b/doc/PKGBUILD.5.asciidoc index 4ca8eb3b..e7743c88 100644 --- a/doc/PKGBUILD.5.asciidoc +++ b/doc/PKGBUILD.5.asciidoc @@ -344,6 +344,10 @@ function. fakeroot to ensure correct file permissions in the resulting package. All other functions will be run as the user calling makepkg. +*verify() Function*:: + An optional `verify()` function can be specified to implement arbiterary + source authentication. This function is run before sources are extracted. + *prepare() Function*:: An optional `prepare()` function can be specified in which operations to prepare the sources for building, such as patching, are performed. This diff --git a/doc/makepkg.8.asciidoc b/doc/makepkg.8.asciidoc index 38032e7b..75b2139f 100644 --- a/doc/makepkg.8.asciidoc +++ b/doc/makepkg.8.asciidoc @@ -168,6 +168,9 @@ Options *\--noprepare*:: Do not run the prepare() function in the PKGBUILD. +*\--noverify*:: + Do not run the verify() function in the PKGBUILD. + *\--sign*:: Sign the resulting package with gpg, overriding the setting in linkman:makepkg.conf[5]. diff --git a/scripts/libmakepkg/integrity.sh.in b/scripts/libmakepkg/integrity.sh.in index 070392fa..81f935df 100644 --- a/scripts/libmakepkg/integrity.sh.in +++ b/scripts/libmakepkg/integrity.sh.in @@ -42,4 +42,7 @@ check_source_integrity() { check_checksums "$@" check_pgpsigs "$@" fi + if (( VERIFYFUNC )); then + run_verify + fi } diff --git a/scripts/libmakepkg/source.sh.in b/scripts/libmakepkg/source.sh.in index e39dd16c..92dc71e4 100644 --- a/scripts/libmakepkg/source.sh.in +++ b/scripts/libmakepkg/source.sh.in @@ -69,6 +69,21 @@ download_sources() { done } +copy_sources(){ + msg "$(gettext "Copying sources...")" + local netfile all_sources + + get_all_sources_for_arch 'all_sources' + for netfile in "${all_sources[@]}"; do + local proto=$(get_protocol "$netfile") + if declare -f copy_$proto > /dev/null; then + copy_$proto "$netfile" + else + copy_file "$netfile" + fi + done +} + extract_sources() { msg "$(gettext "Extracting sources...")" local netfile all_sources diff --git a/scripts/libmakepkg/source/file.sh.in b/scripts/libmakepkg/source/file.sh.in index fa09d446..51452550 100644 --- a/scripts/libmakepkg/source/file.sh.in +++ b/scripts/libmakepkg/source/file.sh.in @@ -82,13 +82,20 @@ download_file() { fi } -extract_file() { +copy_file(){ local netfile=$1 local file=$(get_filename "$netfile") local filepath=$(get_filepath "$file") rm -f "$srcdir/${file}" ln -s "$filepath" "$srcdir/" +} + +extract_file() { + local netfile=$1 + + local file=$(get_filename "$netfile") + local filepath=$(get_filepath "$file") if in_array "$file" "${noextract[@]}"; then # skip source files in the noextract=() array diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 5aaabf63..b7b21af1 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -144,6 +144,9 @@ clean_up() { if (( PKGVERFUNC )); then rm -f "${pkgbase}-${fullver}-${CARCH}-pkgver.log"* fi + if (( VERIFYFUNC )); then + rm -f "${pkgbase}-${fullver}-${CARCH}-verify.log"* + fi if (( PREPAREFUNC )); then rm -f "${pkgbase}-${fullver}-${CARCH}-prepare.log"* fi @@ -447,6 +450,10 @@ run_function() { fi } +run_verify() { + run_function_safe "verify" +} + run_prepare() { run_function_safe "prepare" } @@ -973,6 +980,7 @@ while true; do -m|--nocolor) USE_COLOR='n'; PACMAN_OPTS+=("--color" "never") ;; --noarchive) NOARCHIVE=1 ;; --nocheck) RUN_CHECK='n' ;; + --noverify) RUN_VERIFY='n' ;; --noprepare) RUN_PREPARE='n' ;; --nosign) SIGNPKG='n' ;; -o|--nobuild) BUILDPKG=0 NOBUILD=1 ;; @@ -1093,7 +1101,7 @@ fi unset pkgname "${pkgbuild_schema_strings[@]}" "${pkgbuild_schema_arrays[@]}" unset "${known_hash_algos[@]/%/sums}" -unset -f pkgver prepare build check package "${!package_@}" +unset -f pkgver verify prepare build check package "${!package_@}" unset "${!makedepends_@}" "${!depends_@}" "${!source_@}" "${!checkdepends_@}" unset "${!optdepends_@}" "${!conflicts_@}" "${!provides_@}" "${!replaces_@}" unset "${!cksums_@}" "${!md5sums_@}" "${!sha1sums_@}" "${!sha224sums_@}" @@ -1165,6 +1173,12 @@ if (( ${#pkgname[@]} > 1 )) || have_function package_${pkgname}; then fi # test for available PKGBUILD functions +if have_function verify; then + # "Hide" verify() function if not going to be run + if [[ $RUN_VERIFY != "n" ]]; then + VERIFYFUNC=1 + fi +fi if have_function prepare; then # "Hide" prepare() function if not going to be run if [[ $RUN_PREPARE != "n" ]]; then @@ -1312,6 +1326,7 @@ if (( !REPKG )); then warning "$(gettext "Using existing %s tree")" "\$srcdir/" else download_sources + copy_sources check_source_integrity (( VERIFYSOURCE )) && exit $E_OK -- 2.36.1

2 3

[Git][pacman/pacman][master] Fix remaining email list address
by Allan McRae (＠allan) 25 Jun '22

25 Jun '22

Allan McRae pushed to branch master at Pacman / Pacman Commits: 2bf67416 by Allan McRae at 2022-06-25T22:59:20+10:00 Fix remaining email list address One instance was missed in b0a2fd75b2f4ba12075646f0f3f18911d71a42c7. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 1 changed file: - lib/libalpm/po/Makevars View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/2bf67416c17c99851e2d0bb… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/commit/2bf67416c17c99851e2d0bb… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[Git][pacman/pacman][master] 8 commits: makepkg: use bsdtar --no-read-sparse for archive creation if available
by Allan McRae (＠allan) 25 Jun '22

25 Jun '22

Allan McRae pushed to branch master at Pacman / Pacman Commits: f5f9e0f4 by Jonas Witschel at 2022-03-11T09:43:59+10:00 makepkg: use bsdtar --no-read-sparse for archive creation if available bsdtar uses the "pax" TAR archive format by default, which has support for storing sparse file information in the archive. Unfortunately this is a source of unreproducibility because the sparse encoding is taken from the file system and different file systems handle sparse files differently: some file systems have no support for sparsely encoded files at all, and even file systems with sparse file support can report different file information for identical files due to differing implementations. As a real world example where this happens, consider the Arch Linux package "brotli-testdata 1.0.9-7", which contains a sparsely encoded all-zeros file "usr/share/brotli/testdata/zeros". Building this package on a btrfs file system yields a different package than building it on tmpfs or ext4 solely due to different sparse file information that gets recorded in the package tarball. To improve the reproducibility of archives containing sparsely encoded files, libarchive version 3.6.0 introduces a new --no-read-sparse option. This skips reading sparse file information from disk entirely and therefore stores files "expanded" in the archive, which is the only way to make them reliably reproducible across file systems. makepkg will use this option if libarchive is recent enough to support it, which is detected at build time. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 18152a21 by Allan McRae at 2022-05-12T09:45:12+10:00 libmakepkg: Do not "strip" files when the format is not recognised We use a multi step process during stripping to ensure permissions do not get changed. However, if the initial objcopy fails, the subsequent cat results in a blank file. Abandon early if objcopy fails. Fixes FS#74486 Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - fdf04cda by Allan McRae at 2022-05-18T22:06:07+10:00 doc/PKGBUILD: remove Arch Linux specific advise The documentation for the license array was specific to Arch Linux. Remove it and some minor other Arch Linux specific references. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 84dc662d by Allan McRae at 2022-05-31T20:13:14+10:00 makepkg: add source signing PGP keys to source package if available Arch Linux is adding source signing PGP keys to their package source tree alongside PKGBUILDs in the form keys/pgp/$fingerprint.asc. As the PGP keyserver infrastructure is a mess, this helps other people validate sources in a PKGBUILD. Add the keys to source packages if found alongside the PKGBUILD. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - d1e95c4e by Allan McRae at 2022-06-16T09:00:18+10:00 Gitlab CI: Install glibc-debug valgrind test Currently our gitlab CI is failing due to valgrind breakage. With Arch stripping glibc, valgrind now requires debuginfod to be active. However the gitlab CI system combined without our testsuite does not retrieve these symbols, even when the appropriate environmental variable is set. Work around this by installing the glibc-debug package directly using a slight kludge... All blame for this approach is assigned to foutrelis! Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 0031cd1e by Levente Polyak at 2022-06-25T10:25:36+10:00 doc/BUILDINFO.5: document buildtool and buildtoolver properties The feature has been introduced in commit a33cdac10bf1a682 The buildinfo version has been bumped in commit 0428f6213bcb5586 Signed-off-by: Levente Polyak <anthraxx(a)archlinux.org> - - - - - 776b7c1e by Morten Linderud at 2022-06-25T10:45:04+10:00 debugflags: Ensure we have unique source paths In some cases packages are built outside of a directory which contains pkgname-pkgver, this results in source listing in debug packages having a conflicting path like `/usr/src/debug/build/` which is not ideal. This patch ensures we always include the pkgbase to ensure the paths are unique. Signed-off-by: Morten Linderud <morten(a)linderud.pw> Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 6daeb37f by Jean Raby at 2022-06-25T22:45:00+10:00 pacman: silence "info" msg when using --print This allows for parsing the output of: pacman --upgrade --print-format '<format>' pkg.zst without having to remove info messages from it. Signed-off-by: Allan McRae <allan(a)archlinux.org> - - - - - 9 changed files: - .gitlab-ci.yml - build-aux/edit-script.sh.in - doc/BUILDINFO.5.asciidoc - doc/PKGBUILD.5.asciidoc - meson.build - scripts/libmakepkg/buildenv/debugflags.sh.in - scripts/libmakepkg/tidy/strip.sh.in - scripts/makepkg.sh.in - src/pacman/upgrade.c View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/bddfcc3f40ce1a19d4c955… -- View it on GitLab: https://gitlab.archlinux.org/pacman/pacman/-/compare/bddfcc3f40ce1a19d4c955… You're receiving this email because of your account on gitlab.archlinux.org.

1 0

[PATCH] pacman: send 'loading packages...' msg to stderr
by Jean Raby 25 Jun '22

25 Jun '22

This allows for parsing the output of: pacman --upgrade --print-format '<format>' pkg.zst without having to remove info messages from it. Signed-off-by: Jean Raby <jean(a)raby.sh> --- src/pacman/upgrade.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/pacman/upgrade.c b/src/pacman/upgrade.c index 0691856f..6f70b115 100644 --- a/src/pacman/upgrade.c +++ b/src/pacman/upgrade.c @@ -99,7 +99,7 @@ int pacman_upgrade(alpm_list_t *targets) goto fail_free; } - printf(_("loading packages...\n")); + fprintf(stderr,_("loading packages...\n")); retval |= load_packages(local_targets, alpm_option_get_local_file_siglevel(config->handle)); retval |= load_packages(fetched_files, alpm_option_get_remote_file_siglevel(config->handle)); -- 2.35.1

2 3

[PATCH v2] strip: Use dwz to compress dwarf headers
by Morten Linderud 25 Jun '22

25 Jun '22

From: Morten Linderud <morten(a)linderud.pw> `dwz` allows us to compress the DWARF files when building debug packages. Potentially shaving off some of the sizes of the symbols we distribute. https://sourceware.org/dwz/ A sample of packages built with dwz; pacman: Original debug info size: 1520kB Size after compression: 1252kB systemd: Original debug info size: 46692kB Size after compression: 41036kB Signed-off-by: Morten Linderud <morten(a)linderud.pw> --- doc/makepkg.conf.5.asciidoc | 3 ++ scripts/libmakepkg/executable/dwz.sh.in | 38 ++++++++++++++++ .../executable/sepdebugcrcfix.sh.in | 38 ++++++++++++++++ scripts/libmakepkg/tidy/strip.sh.in | 44 +++++++++++++++++-- 4 files changed, 120 insertions(+), 3 deletions(-) create mode 100644 scripts/libmakepkg/executable/dwz.sh.in create mode 100644 scripts/libmakepkg/executable/sepdebugcrcfix.sh.in diff --git a/doc/makepkg.conf.5.asciidoc b/doc/makepkg.conf.5.asciidoc index a0d9a6d4..2e40f27f 100644 --- a/doc/makepkg.conf.5.asciidoc +++ b/doc/makepkg.conf.5.asciidoc @@ -194,6 +194,9 @@ Options DEBUG_CXXFLAGS to their counterpart buildflags. Creates a separate package containing the debug symbols when used with `strip'. + *dwz*;; + Compress dwarf files inside the debug package. + *lto*;; Enable building packages using link time optimization. Adds the flags specified in LTOFLAGS to CFLAGS, CXXFLAGS and LDFLAGS (or diff --git a/scripts/libmakepkg/executable/dwz.sh.in b/scripts/libmakepkg/executable/dwz.sh.in new file mode 100644 index 00000000..a540697c --- /dev/null +++ b/scripts/libmakepkg/executable/dwz.sh.in @@ -0,0 +1,38 @@ +#!/usr/bin/bash +# +# dwz.sh - Confirm presence of dwz binary +# +# Copyright (c) 2011-2022 Pacman Development Team <pacman-dev(a)lists.archlinux.org> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# + +[[ -n "$LIBMAKEPKG_EXECUTABLE_DWZ_SH" ]] && return +LIBMAKEPKG_EXECUTABLE_DWZ_SH=1 + +LIBRARY=${LIBRARY:-'@libmakepkgdir@'} + +source "$LIBRARY/util/message.sh" +source "$LIBRARY/util/option.sh" + +executable_functions+=('executable_dwz') + +executable_dwz() { + if check_option "dwz" "y"; then + if ! type -p dwz>/dev/null; then + error "$(gettext "Cannot find the %s binary required to compress dwarf files.")" "dwz" + return 1 + fi + fi +} diff --git a/scripts/libmakepkg/executable/sepdebugcrcfix.sh.in b/scripts/libmakepkg/executable/sepdebugcrcfix.sh.in new file mode 100644 index 00000000..6259ac32 --- /dev/null +++ b/scripts/libmakepkg/executable/sepdebugcrcfix.sh.in @@ -0,0 +1,38 @@ +#!/usr/bin/bash +# +# sepdebugcrcfix.sh - Confirm presence of sepdebugcrcfix binary +# +# Copyright (c) 2011-2022 Pacman Development Team <pacman-dev(a)lists.archlinux.org> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# + +[[ -n "$LIBMAKEPKG_EXECUTABLE_SEPDEBUGCRCFIX_SH" ]] && return +LIBMAKEPKG_EXECUTABLE_SEPDEBUGCRCFIX_SH=1 + +LIBRARY=${LIBRARY:-'@libmakepkgdir@'} + +source "$LIBRARY/util/message.sh" +source "$LIBRARY/util/option.sh" + +executable_functions+=('executable_sepdebugcrcfix') + +executable_sepdebugcrcfix() { + if check_option "dwz" "y"; then + if ! type -p sepdebugcrcfix>/dev/null; then + error "$(gettext "Cannot find the %s binary required to fix CRC.")" "sepdebugcrcfix" + return 1 + fi + fi +} diff --git a/scripts/libmakepkg/tidy/strip.sh.in b/scripts/libmakepkg/tidy/strip.sh.in index 688bcf1b..1365b77b 100644 --- a/scripts/libmakepkg/tidy/strip.sh.in +++ b/scripts/libmakepkg/tidy/strip.sh.in @@ -27,7 +27,7 @@ source "$LIBRARY/util/message.sh" source "$LIBRARY/util/option.sh" -packaging_options+=('strip' 'debug') +packaging_options+=('strip' 'debug' 'dwz') tidy_modify+=('tidy_strip') @@ -52,6 +52,37 @@ source_files() { | sort -zu | tr '\0' '\n' } +compress_dwarf_files(){ + binary_files="$@" + dwz_opts="" + readarray dwz_files < <(find "$dbgdir" -type f -name \*.debug | LC_ALL=C sort) + + # dwz multifile attempts to remove common symols found in all ELF files and + # throw them into one file. Replacing the references with .gnu_debugaltlink + local fullver=$(get_full_version) + dwz_multifile_name="${pkgbase}-${fullver}-${CARCH}" + if [ ${#dwz_files[@]} -gt 1 ]; then + dwz_opts="-m .dwz/${dwz_multifile_name}" + fi + mkdir -p "$dbgdir/.dwz" + + # The dwz options are taken from rpm/debugedit + (cd "$dbgdir" && + LANG=C dwz --hardlink \ + --quiet \ + --relative \ + --low-mem-die-limit 10000000 \ + --max-die-limit 50000000 \ + $dwz_opts \ + ${dwz_files[@]} 2> /dev/null) + + # Remove dir if empty + rmdir "$dbgdir/.dwz" 2> /dev/null + + # Some debuggers might use the CRC to find relevant debug files instead of the build-id + LANG=C sepdebugcrcfix "$dbgdir" $binary_files &>/dev/null +} + strip_file() { local binary=$1; shift @@ -142,7 +173,8 @@ tidy_strip() { fi local binary strip_flags - find . -type f -perm -u+w -print0 2>/dev/null | while IFS= read -rd '' binary ; do + declare -a binary_files + while IFS= read -rd '' binary ; do local STRIPLTO=0 case "$(LC_ALL=C readelf -h "$binary" 2>/dev/null)" in *Type:*'DYN (Shared object file)'*) # Libraries (.so) or Relocatable binaries @@ -166,6 +198,12 @@ tidy_strip() { esac strip_file "$binary" ${strip_flags} (( STRIPLTO )) && strip_lto "$binary" - done + binary_files+=("$binary") + done < <(find . -type f -perm -u+w -print0 2>/dev/null) + + if check_option "debug" "y" && check_option "dwz" "y"; then + msg2 "$(gettext "Compressing dwarf files...")" + compress_dwarf_files ${binary_files[@]} + fi fi } -- 2.36.1

3 3

[pacman-dev] [PATCH 1/3] alpm: add ALPM_TRANS_FLAG_NOKEEP
by morganamilo 25 Jun '22

25 Jun '22

this flag prevents backup files from being kept on package installation. This is useful for resetting a package's config files back to their original state. Implements FS#59908 although with it's own flag name instead of reusing nosave. This allows nokeep to optionally create a pacnew that you can then choose to disable by also setting nosave. --- I actually very dislike NOKEEP but it was the best I could come up with I would have prefered overwrite or nosave but they are taken. Better names are welcome. --- lib/libalpm/alpm.h | 3 ++- lib/libalpm/remove.c | 4 +++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index 8d8fe243..c6048b63 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -2704,7 +2704,8 @@ int alpm_pkg_mtree_close(const alpm_pkg_t *pkg, struct archive *archive); typedef enum _alpm_transflag_t { /** Ignore dependency checks. */ ALPM_TRANS_FLAG_NODEPS = 1, - /* (1 << 1) flag can go here */ + /** Don't keep backup files when installing packages. */ + ALPM_TRANS_FLAG_NOKEEP = (1 << 1), /** Delete files even if they are tagged as backup. */ ALPM_TRANS_FLAG_NOSAVE = (1 << 2), /** Ignore version numbers when checking dependencies. */ diff --git a/lib/libalpm/remove.c b/lib/libalpm/remove.c index de39724a..233fff0c 100644 --- a/lib/libalpm/remove.c +++ b/lib/libalpm/remove.c @@ -575,7 +575,9 @@ static int should_skip_file(alpm_handle_t *handle, { return _alpm_fnmatch_patterns(handle->noupgrade, path) == 0 || alpm_list_find_str(handle->trans->skip_remove, path) - || (newpkg && _alpm_needbackup(path, newpkg) + || (!(handle->trans->flags & ALPM_TRANS_FLAG_NOKEEP) + && newpkg + && _alpm_needbackup(path, newpkg) && alpm_filelist_contains(alpm_pkg_get_files(newpkg), path)); } -- 2.33.0

2 3

[PATCH] debugflags: Ensure we have unique source paths
by Morten Linderud 25 Jun '22

25 Jun '22

From: Morten Linderud <morten(a)linderud.pw> In some cases packages are built outside of a directory which contains pkgname-pkgver, this results in source listing in debug packages having a conflicting path like `/usr/src/debug/build/` which is not ideal. This patch ensures we always include the pkgbase to ensure the paths are unique. Signed-off-by: Morten Linderud <morten(a)linderud.pw> --- scripts/libmakepkg/buildenv/debugflags.sh.in | 6 +++--- scripts/libmakepkg/tidy/strip.sh.in | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/scripts/libmakepkg/buildenv/debugflags.sh.in b/scripts/libmakepkg/buildenv/debugflags.sh.in index 1cb58613..2bdb8b0b 100644 --- a/scripts/libmakepkg/buildenv/debugflags.sh.in +++ b/scripts/libmakepkg/buildenv/debugflags.sh.in @@ -30,9 +30,9 @@ buildenv_functions+=('buildenv_debugflags') buildenv_debugflags() { if check_option "debug" "y" && ! check_option "buildflags" "n"; then - DEBUG_CFLAGS+=" -ffile-prefix-map=$srcdir=${DBGSRCDIR:-/usr/src/debug}" - DEBUG_CXXFLAGS+=" -ffile-prefix-map=$srcdir=${DBGSRCDIR:-/usr/src/debug}" - DEBUG_RUSTFLAGS+=" --remap-path-prefix=$srcdir=${DBGSRCDIR:-/usr/src/debug}" + DEBUG_CFLAGS+=" -ffile-prefix-map=$srcdir=${DBGSRCDIR:-/usr/src/debug}/${pkgbase}" + DEBUG_CXXFLAGS+=" -ffile-prefix-map=$srcdir=${DBGSRCDIR:-/usr/src/debug}/${pkgbase}" + DEBUG_RUSTFLAGS+=" --remap-path-prefix=$srcdir=${DBGSRCDIR:-/usr/src/debug}/${pkgbase}" CFLAGS+=" $DEBUG_CFLAGS" CXXFLAGS+=" $DEBUG_CXXFLAGS" RUSTFLAGS+=" $DEBUG_RUSTFLAGS" diff --git a/scripts/libmakepkg/tidy/strip.sh.in b/scripts/libmakepkg/tidy/strip.sh.in index 688bcf1b..25bc649e 100644 --- a/scripts/libmakepkg/tidy/strip.sh.in +++ b/scripts/libmakepkg/tidy/strip.sh.in @@ -47,7 +47,7 @@ source_files() { LANG=C debugedit --no-recompute-build-id \ --base-dir "${srcdir}" \ - --dest-dir "${dbgsrcdir}" \ + --dest-dir "${dbgsrcdir}/${pkgbase}" \ --list-file /dev/stdout "$1" \ | sort -zu | tr '\0' '\n' } -- 2.36.1

2 1

[PATCH] proto: Change the default checksum from md5 to sha256
by Ben Westover 18 Jun '22

18 Jun '22

MD5 isn't a very good checksum, and the PKGBUILD page on the Arch Wiki states that it should not be used, instead recommending sha256 or b2. This patch changes the default from md5 to sha256 because that seems to be the most commonly used checksum today. Signed-off-by: Ben Westover <kwestover.kw(a)gmail.com> --- proto/PKGBUILD-split.proto | 2 +- proto/PKGBUILD-vcs.proto | 2 +- proto/PKGBUILD.proto | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/proto/PKGBUILD-split.proto b/proto/PKGBUILD-split.proto index 9898ef81..eea97e56 100644 --- a/proto/PKGBUILD-split.proto +++ b/proto/PKGBUILD-split.proto @@ -28,7 +28,7 @@ changelog= source=("$pkgbase-$pkgver.tar.gz" "$pkgname-$pkgver.patch") noextract=() -md5sums=() +sha256sums=() validpgpkeys=() prepare() { diff --git a/proto/PKGBUILD-vcs.proto b/proto/PKGBUILD-vcs.proto index ae9956a9..49c6759f 100644 --- a/proto/PKGBUILD-vcs.proto +++ b/proto/PKGBUILD-vcs.proto @@ -25,7 +25,7 @@ options=() install= source=('FOLDER::VCS+URL#FRAGMENT') noextract=() -md5sums=('SKIP') +sha256sums=('SKIP') # Please refer to the 'USING VCS SOURCES' section of the PKGBUILD man page for # a description of each element in the source array. diff --git a/proto/PKGBUILD.proto b/proto/PKGBUILD.proto index a2c600d5..9aff797c 100644 --- a/proto/PKGBUILD.proto +++ b/proto/PKGBUILD.proto @@ -27,7 +27,7 @@ changelog= source=("$pkgname-$pkgver.tar.gz" "$pkgname-$pkgver.patch") noextract=() -md5sums=() +sha256sums=() validpgpkeys=() prepare() { -- 2.36.1

1 0

[PATCH] Gitlab CI: remove valgrind test
by Allan McRae 17 Jun '22

17 Jun '22

Currently our gitlab CI is failing due to valgrind breakage. With Arch stripping glibc, valgrind now requires debuginfod to be active. However the gitlab CI system does not retrieve these symbols, even when the appropriate environmental variable is set. If Arch is not appropriate for this test, we may want to switch to another distribution for valgrind. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- This is a temporary patch to get CI running clean again. Still looking at how this can be fixed for Arch, otherwise I will switch the valgrind run to a distro with appropriate dependencies for valgrind to run. .gitlab-ci.yml | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 186ad3dc..d9659746 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -46,13 +46,14 @@ arch-clang: - ninja -C build - fakechroot meson test -C build -arch-valgrind: - extends: .arch-test - script: - - pacman -Syu --needed --noconfirm valgrind - - meson build - - ninja -C build - - PACTEST_VALGRIND=1 fakechroot meson test -C build +# Fails due to lack of debug symbols in libc.so.6 and debuginfod not working +#arch-valgrind: +# extends: .arch-test +# script: +# - pacman -Syu --needed --noconfirm valgrind +# - meson build +# - ninja -C build +# - PACTEST_VALGRIND=1 fakechroot meson test -C build arch-nettle: extends: .arch-test -- 2.36.1

2 2