Cache servers differ from regular servers in that they do not produce
warnings and are not removed from the server pool for "soft errors"
(i.e. the server was reachable, but the download failed) and they are
not used for databases. If a host is used for both a cache server and a
regular server, it may still be removed from the server pool for soft
errors that occur when used as cache server and removal from the server
pool for soft errors will not affect future attempted use as a cache
server.
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Meson automatically sets _FILE_OFFSET_BITS but that value was not
getting carried through to the libalpm pkgconfig file, breaking
downstream projects that relied on it.
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
During a package build we call prepare_buildenv in multiple stages of
the process. For debug packages, one of the hooks is buildenv_debugflags
which populates the debug flags to the according variables.
The issue is that the behavior of the current implementation of
buildenv_debugflags is not idempotent, so consecutive calls will append
the same flags again. In certain cases this isn't an issue, however
for context aware build frontends like cargo any change of the build
inputs leads to a fresh build. This means that any invocation of such
a build ecosystem inside the package() function will trigger a full
rebuild, which is not desired.
To fix this issue, this commit makes buildenv_debugflags idempotent
by only appending flags once to the target variables.
Signed-off-by: Levente Polyak <anthraxx@archlinux.org>
Currently, the file glob used to clean the $srcdir misses dotfiles.
This commit instead removes the directory entirely and recreates it.
Since the directory has to exist prior to deletion, the creation commands
are duplicated. Perhaps they could be moved to a function later on.
The directory cannot be removed while inside it, so the directory change
is moved down the line. One important insight here is that almost all functions
after it are actually independent of $pwd, allowing the optimization of just
not changing directory. They do however depend on the existence of $srcdir, so
it has to be recreated.
The only exception to this is `extract_sources` which depends on $pwd being $srcdir.
An alternative proposal wanted to extend the file matching for deletion, but it
was deemed impractical.
chroot() requires CAP_SYS_CHROOT. If the caller has put us in the
right root directory already, don't call chroot(). This allows
running pacman in a containerized environment without CAP_SYS_CHROOT.
This patch implements a new verify function in makepkg. It allows us to
do arbitrary authentication on sources before extraction.
There are several new signing and validation methods being implemented
and it would be hard to have `makepkg` implement support for things such
as sequoia, cosign or minisign. This would allow us to distribute
generic validation functions.
Signed-off-by: Morten Linderud <morten@linderud.pw>
Some user had erros while updating their system.
:: Proceed with installation? [Y/n]
:: Retrieving packages...
checking keyring...
checking package integrity...
error: failed to commit transaction (invalid or corrupted package)
Errors occurred, no packages were upgraded.
The issue was filecache_find returning null and alpm passing that null
path to check validity. How this happened I have no idea. It may be
something to do with the user's cachedir being a network drive.
Also warn when the file exists but it is not a regular file or can not
be opened.
Clarify if repo-add does not create a new database due to failures
or due to there being nothing to do.
Signed-off-by: Allan McRae <allan@archlinux.org>
As noted in the fakechroot(1) man page, fakeroot and fakechroot
might wrap the same C library functions. Arch Linux hit this
recently with calls to stat(). It is important to start the fake
environment in proper order - fakeroot should be started inside
fakechroot.
Signed-off-by: Allan McRae <allan@archlinux.org>
Passing a path with a trailing slash to --root or --rootdir can lead to a
double slash at the start of paths. e.g.
$ pacman --root / -v 2>1 | grep " //"
Log File : //var/log/pacman.log
In MSYS2, paths starting with // will hit the network and fail.
Avoid this be explicitly stripping the trailing / from paths passed to these
flags.
Signed-off-by: Allan McRae <allan@archlinux.org>
This is similar to -C in git/make/nina. Sadly -C is already taken for
us.
This is useful for scripts where you for loop over packages, as well as
when I'm testing makepkg builds and I'm too lazy to cd.
Add provides "%P" and replaces "%R" as format attribute.
Signed-off-by: Jelle van der Waa <jelle@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
Replace concat_alpm_depends() with concat_list() which takes an
additional parameter to handle the formatting of non-string
data types.
Signed-off-by: Allan McRae <allan@archlinux.org>
makepkg assumes that the remote git repo is named "origin" at several
places in its handling of git sources. It is possible to set the remote
repo name since git v2.30.0 (with bug fix for bare checkouts in v2.30.2).
Add "--origin=origin" to all git clone commands.
Signed-off-by: Allan McRae <allan@archlinux.org>
When ever pacman prints a conflict, it now prints pkgname-version,
instead of just pkgname.
alpm_conflict_t now carries *alpm_pkg_ts instead of just the
names of each package.
Fixes FS#12536 (point 2)
Controlling the type of getmntinfo's param was decided by
whether or not we had the statvfs type avaliable. But getmntinfo uses
statfs regardless of this except on netbsd where it uses statvfs.
Add a check to detect which type our version of the function uses.
MD5 isn't a very good checksum, and the PKGBUILD page on the Arch Wiki
states that it should not be used, instead recommending sha256 or b2.
This patch changes the default from md5 to sha256 because that seems to
be the most commonly used checksum today.
Signed-off-by: Ben Westover <kwestover.kw@gmail.com>
This feature makes bzr VCS build inputs immutable by adding support for
pinning a bzr checkout by a hash of its content using the deterministic
export functionality `bzr export`.
This feature allows to preserve security implications of immutable build inputs
using a trusted cryptographic hash function of the content.
Signed-off-by: Levente Polyak <anthraxx@archlinux.org>
This feature makes Mercurial VCS build inputs immutable by adding
support for pinning a Mercurial checkout by a hash of its content using
the deterministic export functionality `hg archive`.
This feature aids packagers by allowing them to use simple and
convenient refnames (instead of full commit hashes) in the `PKGBUILD`
while still preserving security implications of immutable build inputs
using a trusted cryptographic hash function of the content.
Signed-off-by: Levente Polyak <anthraxx@archlinux.org>
This feature makes Git VCS build inputs immutable by adding support for
pinning a Git checkout by a hash of its content using the deterministic
export functionality `git archive`.
This feature aids packagers by allowing them to use simple and
convenient refnames (instead of full commit hashes) in the `PKGBUILD`
while still preserving security implications of immutable build inputs
using a trusted cryptographic hash function of the content.
Previously VCS source downloads have been skipped for `--geninteg` and
`--source` as both options did not need a checkout. This commit changes
this behavior by forcing the download of all sources as integrity checks
and generation requires to have an up to date state.
Signed-off-by: Levente Polyak <anthraxx@archlinux.org>
