- Pacman-dev - lists.archlinux.org

[pacman-dev] [GIT] The official pacman repository branch, master, updated. v5.2.1-95-g02ae97b0
by Allan McRae 11 Jun '20

11 Jun '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official pacman repository". The branch, master has been updated via 02ae97b0da220d9079c6c2c1ac3e3ab0d12c1ac7 (commit) via 899d39b635d46f9e2daff1aada75ea07f08fef64 (commit) via bf458cced7c0845f7b6fabb887d3878ae4cd51b2 (commit) via 381e11375569fa7588b1297e0e744749bdafe8f5 (commit) via 817f9fb715b4e90d28bc141dfccfc530b9e951dc (commit) via 3bd88821bbfc8066a63ddfc9959e78984bc17750 (commit) via e348ba38814c9cc7c1c9892d0451096234dc39ab (commit) via 40bbaead44db8fcdef7087f4b05820bf90dee090 (commit) from 5f6ef895b1dac04c7fb1b63acab2d42c19f91922 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 02ae97b0da220d9079c6c2c1ac3e3ab0d12c1ac7 Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Mon Jun 8 22:03:18 2020 -0400 makepkg/repo-add: do not accept public-only keys for signing If it's not listed by --list-secret-key we don't care if it has been imported into your keyring, it's unusable. And you might not have a private key at all in the no-keyid-specified case. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 899d39b635d46f9e2daff1aada75ea07f08fef64 Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Mon Jun 8 21:59:18 2020 -0400 makepkg/repo-add: handle GPGKEY with spaces We pass this to gpg -u and this gpg option can accept a number of different formats, not just the historical hexadecimal fingerprint we assumed. We should not barf hard if a format is used which happens to contain spaces. This also fixes a validation bug. When we initially check if the desired key is available, we don't quote spaces, so gpg goes ahead and treats each space-separated string as a *different key* to search for, returning partial matches, and returning success if at least one key is found. But gpg --detach-sign -u will certainly not accept multiple keys! Fixes FS#66949 Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit bf458cced7c0845f7b6fabb887d3878ae4cd51b2 Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Tue Jun 2 17:50:24 2020 -0400 libmakepkg: fix regression in sending plain() output to stderr In commit 882e707e40bbade0111cf3bdedbdac4d4b70453b we changed message output to go to stdout by default, unless it was an error. The plain() function doesn't *look* like an error function, but in practice it was -- it's used to continue multiline messages, and all in-tree uses were for warning/error. This is a problem both because we're sending output to the wrong place, and because in some cases, we were performing error logging from a function which would otherwise return a value to be captured in a variable using command substution. Fix this and straighten out the API by providing two functions: one for continuing msg output, and one which wraps this by sending output to stderr, for continuing error output. Change all callers to use the second function. commit 381e11375569fa7588b1297e0e744749bdafe8f5 Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Tue Jun 2 18:16:48 2020 -0400 makepkg: correctly handle missing download clients This was broken in commit 882e707e40bbade0111cf3bdedbdac4d4b70453b, which changed 'plain()' messages to go to stdout, which was then captured as the download client in question: cmdline=("Aborting..."). The result was a very confusing error message e.g. /usr/share/makepkg/source/file.sh: line 72: $'\E[1m': command not found or with makepkg --nocolor: /usr/share/makepkg/source/file.sh: line 72: Aborting...: command not found The problem here is that we checked to see if an asynchronous subshell, in our case <(...), failed, by checking if its captured stdout is non-empty. Which is terrible, and also a limitation of old bash. But bash 4.4 can use wait $! to retrieve the return value of an asynchronous subshell. Now we target that as our minimum, we can sanely handle errors in such functions. Losing error messages on stdout by capturing them in a variable instead of printing them, continues to be a problem, but this will be fixed systematically in a later commit. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 817f9fb715b4e90d28bc141dfccfc530b9e951dc Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Mon May 25 23:52:16 2020 -0400 makepkg: guard against undefined git pinned sources If something like source=(..."#commit=") is used, e.g. due to failed variable expansion, we try to check out an empty refspec as nothing at all, and end up just running "git checkout". This happens because we fail at variable expansion too -- so let's quote our variables properly and make sure git sees this as an empty refspec, so it can error out. Also make sure it is interpreted as a ref instead of a path. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit 3bd88821bbfc8066a63ddfc9959e78984bc17750 Author: Eli Schwartz <eschwartz(a)archlinux.org> Date: Mon May 18 15:18:12 2020 -0400 build: add libintl dependency to meson and the .pc file In order to use gettext on systems where it is not part of libc, the correct linker flags are needed in libalpm.pc (for static compilation). This has never been the case. The new meson build system currently only checks for ngettext in libc, but does not fall back to searching for the existence of -lintl; add it to the libalpm dependencies. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> Signed-off-by: Allan McRae <allan(a)archlinux.org> commit e348ba38814c9cc7c1c9892d0451096234dc39ab Author: Filipe Laíns <lains(a)archlinux.org> Date: Thu May 21 00:38:41 2020 +0100 ci: cache packages Results in ~40s saved in each job. Signed-off-by: Filipe Laíns <lains(a)archlinux.org> commit 40bbaead44db8fcdef7087f4b05820bf90dee090 Author: Allan McRae <allan(a)archlinux.org> Date: Tue Mar 17 14:03:58 2020 +1000 Revert "makepkg: drop duplicate reporting of missing dependencies" This removed all information on dependency failures if the --syncdeps flag was not used. A better approach is needed. This reverts commit 4246a4cc4f0f87642cbbb6b375524b2e4c713412. Signed-off-by: Allan McRae <allan(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: .gitlab-ci.yml | 15 +++++++++++--- lib/libalpm/libalpm.pc.in | 2 +- meson.build | 8 ++++++-- scripts/libmakepkg/executable/vcs.sh.in | 2 +- .../libmakepkg/integrity/generate_signature.sh.in | 6 +++--- .../libmakepkg/integrity/verify_signature.sh.in | 2 +- scripts/libmakepkg/source/bzr.sh.in | 8 ++++---- scripts/libmakepkg/source/file.sh.in | 6 +++--- scripts/libmakepkg/source/git.sh.in | 16 +++++++-------- scripts/libmakepkg/source/hg.sh.in | 8 ++++---- scripts/libmakepkg/source/svn.sh.in | 4 ++-- scripts/libmakepkg/util/config.sh.in | 2 +- scripts/libmakepkg/util/message.sh.in | 8 ++++++++ scripts/libmakepkg/util/source.sh.in | 4 ++-- scripts/libmakepkg/util/util.sh.in | 2 +- scripts/makepkg.sh.in | 24 ++++++++++++++-------- scripts/repo-add.sh.in | 8 ++++---- 17 files changed, 76 insertions(+), 49 deletions(-) hooks/post-receive -- The official pacman repository

1 0

[pacman-dev] [PATCH] srcinfo.sh: remove trailing newline
by Denton Liu 11 Jun '20

11 Jun '20

When the .SRCINFO file is generated via `makepkg --printsrcinfo`, each section is concluded with an empty line. This means that at the end of the file, an empty line remains. When running `git diff --check`, Git will complain about this as a whitespace error, saying "new blank line at EOF." Remove the empty line after sections. Replace the empty echo with a placeholder `true` call in case in the future, we do want to close the section with something. --- scripts/libmakepkg/srcinfo.sh.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/libmakepkg/srcinfo.sh.in b/scripts/libmakepkg/srcinfo.sh.in index 6e783279..e7b5c4be 100644 --- a/scripts/libmakepkg/srcinfo.sh.in +++ b/scripts/libmakepkg/srcinfo.sh.in @@ -31,7 +31,7 @@ srcinfo_open_section() { } srcinfo_close_section() { - echo + true # nothing to be done } srcinfo_write_attr() { -- 2.27.0.rc1.69.g3229fa6e15

4 8

[pacman-dev] [PATCH] makepkg: guard against undefined git pinned sources
by Eli Schwartz 11 Jun '20

11 Jun '20

If something like source=(..."#commit=") is used, e.g. due to failed variable expansion, we try to check out an empty refspec as nothing at all, and end up just running "git checkout". This happens because we fail at variable expansion too -- so let's quote our variables properly and make sure git sees this as an empty refspec, so it can error out. Also make sure it is interpreted as a ref instead of a path. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- This ensures that something like https://bugs.archlinux.org/task/66729 cannot happen again. scripts/libmakepkg/source/git.sh.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/libmakepkg/source/git.sh.in b/scripts/libmakepkg/source/git.sh.in index aee944f7..a29be3c5 100644 --- a/scripts/libmakepkg/source/git.sh.in +++ b/scripts/libmakepkg/source/git.sh.in @@ -125,7 +125,7 @@ extract_git() { fi if [[ $ref != "origin/HEAD" ]] || (( updating )) ; then - if ! git checkout --force --no-track -B makepkg $ref; then + if ! git checkout --force --no-track -B makepkg "$ref" --; then error "$(gettext "Failure while creating working copy of %s %s repo")" "${repo}" "git" plain "$(gettext "Aborting...")" exit 1 -- 2.26.2

2 2

[pacman-dev] [PATCH] makepkg/repo-add: handle GPGKEY with spaces
by Eli Schwartz 11 Jun '20

11 Jun '20

We pass this to gpg -u and this gpg option can accept a number of different formats, not just the historical hexadecimal fingerprint we assumed. We should not barf hard if a format is used which happens to contain spaces. This also fixes a validation bug. When we initially check if the desired key is available, we don't quote spaces, so gpg goes ahead and treats each space-separated string as a *different key* to search for, returning partial matches, and returning success if at least one key is found. But gpg --detach-sign -u will certainly not accept multiple keys! Fixes FS#66949 Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- scripts/libmakepkg/integrity/generate_signature.sh.in | 6 +++--- scripts/makepkg.sh.in | 2 +- scripts/repo-add.sh.in | 8 ++++---- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/scripts/libmakepkg/integrity/generate_signature.sh.in b/scripts/libmakepkg/integrity/generate_signature.sh.in index aec96c03..748087c2 100644 --- a/scripts/libmakepkg/integrity/generate_signature.sh.in +++ b/scripts/libmakepkg/integrity/generate_signature.sh.in @@ -29,12 +29,12 @@ create_signature() { local ret=0 local filename="$1" - local SIGNWITHKEY="" + local SIGNWITHKEY=() if [[ -n $GPGKEY ]]; then - SIGNWITHKEY="-u ${GPGKEY}" + SIGNWITHKEY=(-u "${GPGKEY}") fi - gpg --detach-sign --use-agent ${SIGNWITHKEY} --no-armor "$filename" &>/dev/null || ret=$? + gpg --detach-sign --use-agent "${SIGNWITHKEY[@]}" --no-armor "$filename" &>/dev/null || ret=$? if (( ! ret )); then diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 7261fb2c..84150cff 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -1293,7 +1293,7 @@ fi # check if gpg signature is to be created and if signing key is valid if { [[ -z $SIGNPKG ]] && check_buildenv "sign" "y"; } || [[ $SIGNPKG == 'y' ]]; then SIGNPKG='y' - if ! gpg --list-key ${GPGKEY} &>/dev/null; then + if ! gpg --list-key "${GPGKEY}" &>/dev/null; then if [[ ! -z $GPGKEY ]]; then error "$(gettext "The key %s does not exist in your keyring.")" "${GPGKEY}" else diff --git a/scripts/repo-add.sh.in b/scripts/repo-add.sh.in index 545c2929..b1b1b2b7 100644 --- a/scripts/repo-add.sh.in +++ b/scripts/repo-add.sh.in @@ -137,7 +137,7 @@ check_gpg() { fi if (( ! VERIFY )); then - if ! gpg --list-key ${GPGKEY} &>/dev/null; then + if ! gpg --list-key "${GPGKEY}" &>/dev/null; then if [[ ! -z $GPGKEY ]]; then error "$(gettext "The key ${GPGKEY} does not exist in your keyring.")" elif (( ! KEY )); then @@ -155,11 +155,11 @@ create_signature() { local ret=0 msg "$(gettext "Signing database '%s'...")" "${dbfile##*/.tmp.}" - local SIGNWITHKEY="" + local SIGNWITHKEY=() if [[ -n $GPGKEY ]]; then - SIGNWITHKEY="-u ${GPGKEY}" + SIGNWITHKEY=(-u "${GPGKEY}") fi - gpg --detach-sign --use-agent --no-armor ${SIGNWITHKEY} "$dbfile" &>/dev/null || ret=$? + gpg --detach-sign --use-agent --no-armor "${SIGNWITHKEY[@]}" "$dbfile" &>/dev/null || ret=$? if (( ! ret )); then msg2 "$(gettext "Created signature file '%s'")" "${dbfile##*/.tmp.}.sig" -- 2.27.0

2 2

[pacman-dev] [PATCH] makepkg: correctly handle missing download clients
by Eli Schwartz 11 Jun '20

11 Jun '20

This was broken in commit 882e707e40bbade0111cf3bdedbdac4d4b70453b, which changed 'plain()' messages to go to stdout, which was then captured as the download client in question: cmdline=("Aborting..."). The result was a very confusing error message e.g. /usr/share/makepkg/source/file.sh: line 72: $'\E[1m': command not found or with makepkg --nocolor: /usr/share/makepkg/source/file.sh: line 72: Aborting...: command not found Solve this on two levels: - redirect this error() continuation to stderr so the user sees it. - catch erroring returns in get_downloadclient and propagate them bash 4.4 can use wait $! to retrieve the return value of an asynchronous subshell such as <(...), which means, now we target that as our minimum, we can sanely handle errors in such functions. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- Actually, maybe every use of plain() needs to do this. Or else make plain() do this by default. But it's technically used to "continue the previous message", and there's no guarantee it merits going to stderr, even though every time we use plain(), it does. What to do... scripts/libmakepkg/source/file.sh.in | 1 + scripts/libmakepkg/util/source.sh.in | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/libmakepkg/source/file.sh.in b/scripts/libmakepkg/source/file.sh.in index 819320c2..28f373fb 100644 --- a/scripts/libmakepkg/source/file.sh.in +++ b/scripts/libmakepkg/source/file.sh.in @@ -42,6 +42,7 @@ download_file() { # find the client we should use for this URL local -a cmdline IFS=' ' read -a cmdline < <(get_downloadclient "$proto") + wait $! || exit (( ${#cmdline[@]} )) || exit local filename=$(get_filename "$netfile") diff --git a/scripts/libmakepkg/util/source.sh.in b/scripts/libmakepkg/util/source.sh.in index e0490661..1bf5b814 100644 --- a/scripts/libmakepkg/util/source.sh.in +++ b/scripts/libmakepkg/util/source.sh.in @@ -165,7 +165,7 @@ get_downloadclient() { if [[ ! -x $program ]]; then local baseprog="${program##*/}" error "$(gettext "The download program %s is not installed.")" "$baseprog" - plain "$(gettext "Aborting...")" + plain "$(gettext "Aborting...")" >&2 exit 1 # $E_MISSING_PROGRAM fi -- 2.26.2

2 4

[pacman-dev] [PATCH] build: add libintl dependency to meson and the .pc file
by Eli Schwartz 11 Jun '20

11 Jun '20

In order to use gettext on systems where it is not part of libc, the correct linker flags are needed in libalpm.pc (for static compilation). This has never been the case. The new meson build system currently only checks for ngettext in libc, but does not fall back to searching for the existence of -lintl; add it to the libalpm dependencies. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- Fixes build on MSYS2, and possibly others. Part of https://github.com/msys2/MSYS2-packages/pull/1951 lib/libalpm/libalpm.pc.in | 2 +- meson.build | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/lib/libalpm/libalpm.pc.in b/lib/libalpm/libalpm.pc.in index 126a6e6a..da7f96aa 100644 --- a/lib/libalpm/libalpm.pc.in +++ b/lib/libalpm/libalpm.pc.in @@ -10,4 +10,4 @@ Version: @LIB_VERSION@ Requires.private: libarchive @pc_crypto@ @pc_libcurl@ @pc_gpgme@ Cflags: -I${includedir} @LFS_CFLAGS@ Libs: -L${libdir} -lalpm -Libs.private: @LIBS@ @pc_gpgme_libs@ +Libs.private: @LIBS@ @pc_gpgme_libs@ @LIBINTL@ diff --git a/meson.build b/meson.build index 331f02b8..aa3bd4d9 100644 --- a/meson.build +++ b/meson.build @@ -77,9 +77,13 @@ conf.set_quoted('CACHEDIR', join_paths(LOCALSTATEDIR, 'cache/pacman/pkg/')) conf.set_quoted('HOOKDIR', join_paths(SYSCONFDIR, 'pacman.d/hooks/')) conf.set_quoted('ROOTDIR', ROOTDIR) +libintl = dependency('', required: false) if get_option('i18n') if not cc.has_function('ngettext') - error('ngettext not found but NLS support requested') + libintl = cc.find_library('intl', required : false, static: get_option('buildstatic')) + if not libintl.found() + error('ngettext not found but NLS support requested') + endif endif conf.set('ENABLE_NLS', 1) endif @@ -301,7 +305,7 @@ libcommon = static_library( include_directories : includes, install : false) -alpm_deps = [crypto_provider, libarchive, libcurl, gpgme] +alpm_deps = [crypto_provider, libarchive, libcurl, libintl, gpgme] libalpm_a = static_library( 'alpm_objlib', -- 2.26.2

2 1

[pacman-dev] [PATCH] ci: cache packages
by Filipe Laíns 11 Jun '20

11 Jun '20

Results in ~40s saved in each job. Signed-off-by: Filipe Laíns <lains(a)archlinux.org> --- .gitlab-ci.yml | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 4961352eb..46da925cf 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,12 +1,19 @@ variables: MAKEFLAGS: "-j10" VERBOSE: 1 + PACMAN_OPTS: --needed --noconfirm --cachedir .pkg-cache + +cache: + key: pkgs-v1 + paths: + # For some reason Gitlab CI only supports storing cache/artifacts in a path relative to the build directory + - .pkg-cache .arch-test: image: archlinux/base before_script: - > - pacman -Syu --needed --noconfirm + pacman -Syu $PACMAN_OPTS base-devel git gpgme libarchive curl python @@ -30,14 +37,14 @@ arch-debug: arch-docs: extends: .arch-test script: - - pacman -Syu --needed --noconfirm asciidoc + - pacman -Syu $PACMAN_OPTS asciidoc - meson -Ddoc=enabled build - ninja -C build arch-autoconf: extends: .arch-test script: - - pacman -Syu --needed --noconfirm autoconf-archive + - pacman -Syu $PACMAN_OPTS autoconf-archive - autoreconf -i - ./configure --enable-warningflags --disable-doc - make @@ -46,7 +53,7 @@ arch-autoconf: arch-distcheck: extends: .arch-test script: - - pacman -Syu --needed --noconfirm autoconf-archive asciidoc + - pacman -Syu $PACMAN_OPTS autoconf-archive asciidoc - autoreconf -i - ./configure --enable-warningflags - fakechroot make distcheck @@ -54,7 +61,7 @@ arch-distcheck: arch-clang: extends: .arch-test script: - - pacman -Syu --needed --noconfirm clang + - pacman -Syu $PACMAN_OPTS clang - CC=clang meson build - ninja -C build - fakechroot meson test -C build @@ -62,7 +69,7 @@ arch-clang: arch-valgrind: extends: .arch-test script: - - pacman -Syu --needed --noconfirm autoconf-archive valgrind + - pacman -Syu $PACMAN_OPTS autoconf-archive valgrind - autoreconf -i - ./configure --enable-warningflags --disable-doc - make @@ -98,6 +105,7 @@ arch-no-nls: debian: image: debian:bullseye + cache: {} before_script: - apt update - > @@ -113,6 +121,7 @@ debian: fedora: image: fedora + cache: {} before_script: - > dnf -y install -- 2.26.2

2 1

[pacman-dev] [PATCH] makepkg/repo-add: do not accept public-only keys for signing
by Eli Schwartz 09 Jun '20

09 Jun '20

If it's not listed by --list-secret-key we don't care if it has been imported into your keyring, it's unusable. And you might not have a private key at all in the no-keyid-specified case. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- Overlaps previous patch to fix GPGKEY handling. scripts/makepkg.sh.in | 2 +- scripts/repo-add.sh.in | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index cc8de5aa..9e75ef17 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -1293,7 +1293,7 @@ fi # check if gpg signature is to be created and if signing key is valid if { [[ -z $SIGNPKG ]] && check_buildenv "sign" "y"; } || [[ $SIGNPKG == 'y' ]]; then SIGNPKG='y' - if ! gpg --list-key ${GPGKEY:+"$GPGKEY"} &>/dev/null; then + if ! gpg --list-secret-key ${GPGKEY:+"$GPGKEY"} &>/dev/null; then if [[ ! -z $GPGKEY ]]; then error "$(gettext "The key %s does not exist in your keyring.")" "${GPGKEY}" else diff --git a/scripts/repo-add.sh.in b/scripts/repo-add.sh.in index 272d8d22..160fd93a 100644 --- a/scripts/repo-add.sh.in +++ b/scripts/repo-add.sh.in @@ -137,7 +137,7 @@ check_gpg() { fi if (( ! VERIFY )); then - if ! gpg --list-key ${GPGKEY:+"$GPGKEY"} &>/dev/null; then + if ! gpg --list-secret-key ${GPGKEY:+"$GPGKEY"} &>/dev/null; then if [[ ! -z $GPGKEY ]]; then error "$(gettext "The key ${GPGKEY} does not exist in your keyring.")" elif (( ! KEY )); then -- 2.27.0

1 0

[pacman-dev] makepkg: package_...() can export variables to each other
by Erich Eckner 05 Jun '20

05 Jun '20

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi, I stumbled upon the fact, that variables set in one package_...() function of a split package are accessible by following package_...() functions. Is this by design or may I try to provide a patch to restore env after the call to package_...()? Note: packaging-relevant variables (e.g. depends_x86_64) are cleaned across function calls. Simple example: - ------8<------8<------8<------ arch=(any) pkgbase=test pkgname=(ta tb) pkgver=0 pkgrel=1 package_ta() { _test='hi, there!' } package_tb() { echo "$_test" } - ------>8------>8------>8------ regards, Erich -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEE3p92iMrPBP64GmxZCu7JB1Xae1oFAl7Z9qsACgkQCu7JB1Xa e1pc+xAAtKJyAv0JgX0skAmVmMEit+q456ZwKJAL0Kxe8059RNrwzwHvpcvso183 Pc3eqSbxMIRbTGrA2dyweWX42uO8DJuq39LTYNyHQR6KPY7rtaoAMEq/ypF6prc9 EKfD8wq+E5P3i3Ti4YyS8kKfEYfPLvA6O99r/U4GI8GZiFwNoq8LwvKvMnXYxqS2 6oEviKxYFw8wXlYjcCOOTb6WzgNZVyXbpos3B1kx0yuDRW6qhqicVa0levnWUp+M wh8Cx4LXIwCJKLawaA3VzmGXnsbHQq6UatMKeT4z+OcFFHq80q19KJlR8mfP41mc 1Wt+PYwQm+6zyekzcuzz/b6CX0RHK/hEHJJgXGu1awxpzADAWAt3l0HvjGJ+zKiK qhpnbWykGVAwBCE6EwrQsOFAfL9vqzwz9c1tIycKEmbIUs+aFPMbSQVOynnolXGj m1wpbs58+HOHVMcA/ozzkOT1Of+rlLZQHfc87QQuCaJp419sXEPTzFVdNg7d/ok2 m/Z3KmARycCeEu9TpNLYCcR1/OeayBlHnbjhGaESsgiqenqap27CKRiy2TextYt6 56kiGxIj3EbZz7tE3oJE0eQbAeefFctU42O1nbiPpmUZMHdobJqzNtBxB45pKmYm 3YRQqgd+WzMdY583ifqK7dlooUeLkc61eX+AppJrAZ2UNaHAoP4= =q2Yz -----END PGP SIGNATURE-----

3 2

[pacman-dev] [PATCH v4] Fallback to detached signatures during keyring check
by Anatol Pomozov 04 Jun '20

04 Jun '20

Pacman has a 'key in keyring' verification step that makes sure the signatures have a valid keyid. Currently pacman parses embedded package signatures only. Add a fallback to detached signatures. If embedded signature is missing then it tries to read corresponding *.sig file and get keyid from there. Verification: debug: found cached pkg: /var/cache/pacman/pkg/glib-networking-2.64.3-1-x86_64.pkg.tar.zst debug: found detached signature /var/cache/pacman/pkg/glib-networking-2.64.3-1-x86_64.pkg.tar.zst.sig with size 310 debug: found signature key: A5E9288C4FA415FA debug: looking up key A5E9288C4FA415FA locally debug: key lookup success, key exists Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- lib/libalpm/alpm.h | 11 +++++++++++ lib/libalpm/package.c | 40 ++++++++++++++++++++++++++++++++++++++++ lib/libalpm/sync.c | 18 +++++++++--------- lib/libalpm/util.c | 37 +++++++++++++++++++++++++++++++++++++ lib/libalpm/util.h | 1 + 5 files changed, 98 insertions(+), 9 deletions(-) diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index c6a13273..0ba57109 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -1403,6 +1403,17 @@ alpm_db_t *alpm_pkg_get_db(alpm_pkg_t *pkg); */ const char *alpm_pkg_get_base64_sig(alpm_pkg_t *pkg); +/** Extracts package signature either from embedded package signature + * or if it is absent then reads data from detached signature file. + * @param pkg a pointer to package. + * @param sig output parameter for signature data. Callee function allocates + * a buffer needed for the signature data. Caller is responsible for + * freeing this buffer. + * @param sig_len output parameter for the signature data length. + * @return 0 on success, negative number on error. + */ +int alpm_pkg_get_sig(alpm_pkg_t *pkg, unsigned char **sig, size_t *sig_len); + /** Returns the method used to validate a package during install. * @param pkg a pointer to package * @return an enum member giving the validation method diff --git a/lib/libalpm/package.c b/lib/libalpm/package.c index 5c5fa073..0885b27b 100644 --- a/lib/libalpm/package.c +++ b/lib/libalpm/package.c @@ -268,6 +268,46 @@ const char SYMEXPORT *alpm_pkg_get_base64_sig(alpm_pkg_t *pkg) return pkg->base64_sig; } +int SYMEXPORT alpm_pkg_get_sig(alpm_pkg_t *pkg, unsigned char **sig, size_t *sig_len) +{ + if(pkg != NULL) { + RET_ERR(pkg->handle, ALPM_ERR_WRONG_ARGS, -1); + } + + if(pkg->base64_sig) { + int ret = alpm_decode_signature(pkg->base64_sig, sig, sig_len); + if(ret != 0) { + RET_ERR(pkg->handle, ALPM_ERR_SIG_INVALID, -1); + } + return 0; + } else { + char *pkgpath = NULL, *sigpath = NULL; + alpm_errno_t err; + int ret = -1; + + pkgpath = _alpm_filecache_find(pkg->handle, pkg->filename); + if(!pkgpath) { + GOTO_ERR(pkg->handle, ALPM_ERR_PKG_NOT_FOUND, cleanup); + } + sigpath = _alpm_sigpath(pkg->handle, pkgpath); + if(!sigpath || _alpm_access(pkg->handle, NULL, sigpath, R_OK)) { + GOTO_ERR(pkg->handle, ALPM_ERR_SIG_MISSING, cleanup); + } + err = _alpm_read_file(sigpath, sig, sig_len); + if(err == ALPM_ERR_OK) { + _alpm_log(pkg->handle, ALPM_LOG_DEBUG, "found detached signature %s with size %ld\n", + sigpath, *sig_len); + } else { + GOTO_ERR(pkg->handle, err, cleanup); + } + ret = 0; +cleanup: + FREE(pkgpath); + FREE(sigpath); + return ret; + } +} + const char SYMEXPORT *alpm_pkg_get_arch(alpm_pkg_t *pkg) { ASSERT(pkg != NULL, return NULL); diff --git a/lib/libalpm/sync.c b/lib/libalpm/sync.c index 8c01ad95..9350793a 100644 --- a/lib/libalpm/sync.c +++ b/lib/libalpm/sync.c @@ -880,18 +880,18 @@ static int check_keyring(alpm_handle_t *handle) } level = alpm_db_get_siglevel(alpm_pkg_get_db(pkg)); - if((level & ALPM_SIG_PACKAGE) && pkg->base64_sig) { - unsigned char *decoded_sigdata = NULL; - size_t data_len; - int decode_ret = alpm_decode_signature(pkg->base64_sig, - &decoded_sigdata, &data_len); - if(decode_ret == 0) { + if((level & ALPM_SIG_PACKAGE)) { + unsigned char *sig = NULL; + size_t sig_len; + int ret = alpm_pkg_get_sig(pkg, &sig, &sig_len); + if(ret == 0) { alpm_list_t *keys = NULL; - if(alpm_extract_keyid(handle, pkg->name, decoded_sigdata, - data_len, &keys) == 0) { + if(alpm_extract_keyid(handle, pkg->name, sig, + sig_len, &keys) == 0) { alpm_list_t *k; for(k = keys; k; k = k->next) { char *key = k->data; + _alpm_log(handle, ALPM_LOG_DEBUG, "found signature key: %s\n", key); if(!alpm_list_find(errors, key, key_cmp) && _alpm_key_in_keychain(handle, key) == 0) { keyinfo = malloc(sizeof(struct keyinfo_t)); @@ -905,8 +905,8 @@ static int check_keyring(alpm_handle_t *handle) } FREELIST(keys); } - free(decoded_sigdata); } + free(sig); } } diff --git a/lib/libalpm/util.c b/lib/libalpm/util.c index 76728eb4..b70a8192 100644 --- a/lib/libalpm/util.c +++ b/lib/libalpm/util.c @@ -1489,3 +1489,40 @@ void _alpm_alloc_fail(size_t size) { fprintf(stderr, "alloc failure: could not allocate %zu bytes\n", size); } + +/** This functions reads file content. + * + * Memory buffer is allocated by the callee function. It is responsibility + * of the caller to free the buffer. + * + * @param filepath filepath to read + * @param data pointer to output buffer + * @param data_len size of the output buffer + * @return error code for the operation + */ +alpm_errno_t _alpm_read_file(const char *filepath, unsigned char **data, size_t *data_len) +{ + struct stat st; + FILE *fp; + + if((fp = fopen(filepath, "rb")) == NULL) { + return ALPM_ERR_NOT_A_FILE; + } + + if(fstat(fileno(fp), &st) != 0) { + fclose(fp); + return ALPM_ERR_NOT_A_FILE; + } + *data_len = st.st_size; + + MALLOC(*data, *data_len, fclose(fp); return ALPM_ERR_MEMORY); + + if(fread(*data, *data_len, 1, fp) != 1) { + FREE(*data); + fclose(fp); + return ALPM_ERR_SYSTEM; + } + + fclose(fp); + return ALPM_ERR_OK; +} diff --git a/lib/libalpm/util.h b/lib/libalpm/util.h index 4fc6e718..03c8ed44 100644 --- a/lib/libalpm/util.h +++ b/lib/libalpm/util.h @@ -155,6 +155,7 @@ int _alpm_fnmatch_patterns(alpm_list_t *patterns, const char *string); int _alpm_fnmatch(const void *pattern, const void *string); void *_alpm_realloc(void **data, size_t *current, const size_t required); void *_alpm_greedy_grow(void **data, size_t *current, const size_t required); +alpm_errno_t _alpm_read_file(const char *filepath, unsigned char **data, size_t *data_len); #ifndef HAVE_STRSEP char *strsep(char **, const char *); -- 2.27.0

1 0