Attempting to compile pacman with gcc8 results in several warnings like:
remove.c: In function ‘unlink_file.isra.4’:
remove.c:407:34: warning: ‘.pacsave.’ directive output may be truncated writing 9 bytes into a region of size between 1 and 4096 [-Wformat-truncation=]
Fix by adding checks to error out if snprintf tries to reserve a
truncated filename. Because the return values are checked, gcc delegates
the truncation response to our code instead of throwing warnings.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
In commit cb0f2bd038 the changes from
commit 81d233b793 seem to have been
inadvertently backed out.
Right now the current check doesn't do anything, since "fail" is always
nothing and therefore successful.
Fixes FS#58505
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
Checking the file extension to determine if something is a signature is
currently done in three places:
- verify_file_signature: uses $file to print status, reuses it for
comparison
- source_has_signatures: uses $netfile, but removes url component if
filename component exists
- generate_one_checksum: uses $netfile and fails to detect renamed files
This leads to inconsistent behavior when trying to use a signature of
the form "foo-1.0.tar.gz.asc::https://example.com/foo-1.0.tar.gz.pgp"
Fix this by treating the third case like the second case.
Reported-by: Giancarlo Razzolini <grazzolini@archlinux.org>
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
Adding the architecture to the 'installed' elements of the .BUILDINFO
file makes it easier to retrieve the packages needed to reconstruct
the build environment.
Signed-off-by: Robin Broda <robin@broda.me>
Signed-off-by: Allan McRae <allan@archlinux.org>
Architecture information is required for repro tooling
This is a revised version of https://patchwork.archlinux.org/patch/475/
Signed-off-by: Robin Broda <robin@broda.me>
Signed-off-by: Allan McRae <allan@archlinux.org>
Since bash 4.1 extglobs can be used within [[ ... ]] regardless of
whether the shopt is set. Our configure.ac requires bash 4.1.0 at a
minimum for pacman scripts.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
micro-optimization: We only care about temporarily enforcing extglob, so
that is the only one we need to explicitly restore.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
In commit 91b72cc386 support was added for
linting depends/etc. to ensure they contain only valid dependency
specifiers. However it did not properly take into account the
possibility of dependencies linked to a specific pkgrel or epoch, which
promptly failed to build because "-" and ":" is not allowed in a pkgver.
pkgrel is something supported by pacman and useful for e.g. split packages
which cannot be mismatched even if the pkgver is the same. Fix by
removing an optional suffixed "-$decimal" when checking for a valid
pkgver.
epoch is kind of difficult to do without :D so likewise fix by removing
an optional prefixed "$integer:"
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
Some scripts are using `break 2` to break out of the option parsing
loop.
Since a single `break` is sufficient in these cases, remove the extra
argument.
Signed-off-by: Rafael Ascensão <rafa.almas@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
pkg-config has built-in dependency handling, but we currently insert the
raw $LIBS into libalpm's own linker flags and fail to handle Cflags at
all.
For dependencies which support pkg-config, simply use that instead.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
depends, provides, conflicts, replaces, and other variables that are
meant to contain package names, are now checked to ensure
1) the name component contains only characters that would equate to
a valid pkgname.
2) the version component contains only characters that would equate
to a valid pkgver.
3) comparison operator is a valid comparison operator (e.g. provides
only allows exact = while optdepends doesn't allow anything)
This also refactors pkgname into a shared utility function, wires up
pkgbase optdepends and provides to use it, and gives pkgver a touchup
to allow referencing where it was called from.
Fixes FS#57833 and a bit of extra.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
We use an extended glob here, but were relying on having it globally set
in makepkg. This causes it to fail when used in scripts.
Since scripts using libmakepkg may not want extglob to be set, save and
restore the environment while explicitly setting extglob only where we
need it.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
print_all_package_names used in_opt_array to check whether or not the
PKGBUILD itself has options=('debug' 'split') -- while checking to see
if it was enabled per split package which doesn't make sense as these
options apply globally. This prevented debug packages from being listed
if enabled via makepkg.conf rather than per PKGBUILD.
Instead, use check_option to determine whether makepkg actually thinks
it is meant to try creating a split debug package.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
Rather than manually crafting foo_backup in a loop and eval'ing them
with a complicated escape pattern, store every splitpkg_overrides
element into a single variable via the eval-friendly `declare` builtin.
An alternative to eval would be using `printf -v` but this does not work
for arrays.
This has the additional benefit of reducing the number of
variables/arrays floating around in the environment.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
Currently the only things we check are:
- Things that should be arrays, are not strings, and vice versa (this
was mostly copy-pasted from the similar code in lint_pkgbuild).
- Variables that are meant to contain pathname components cannot contain
a newline character, because newline characters in pathnames are weird
and also don't play well with future changes intended for the
--packagelist option.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
In commit c6b04c0465 package signing was
moved out of fakeroot, and as part of this process, the global pkgname
variable was modified in order to extract the built package names.
However, if a debug package was not available and added to the list of
packages, the function was aborted early, before the pkgname array was
restored, thereby corrupting the later stages of makepkg and
specifically the install_package function which needs to know which
pkgnames to install.
Fix this by inlining the debug package signing inside the `if` check,
and as added security switch to using `for pkg in "${pkgname[@]}"` as is
done in many other parts of makepkg, since package signing does not
depend on the value of pkgname for anything.
Additionally, since debug packages may not actually exist, check if the
package file exists first.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
Followup on c6b04c0465 which refactored
the signing function to run outside of fakeroot, and in the process
moved the status message to outside the $SIGNPKG check.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
Additionally provide a separate error for failure to create the
directory vs lack of write permissions on a pre-existing directory.
This also means we now consistently try to create any nonexistent *DEST
directories as needed before aborting with E_FS_PERMISSIONS. Previously
only $BUILDDIR received that kindness.
Fixes FS#43537
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
This fixes an issue where smartcards, such a Yubikey, would cause the
keyring to fail locally signing, thus also failing to verify signed
packages.
Signed-off-by: Eric Renfro <psi-jack@linux-help.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
makepkg configures the umask 0022 as a sane default for building
packages. After installing dependencies, it sources `/etc/profile`
again. If the user configured a umask other than Arch's default of
0022 (or 022) in `/etc/profile`, this sane default is now gone and
needs to be set again.
Signed-off-by: Allan McRae <allan@archlinux.org>
In order to detect if pkgver contains whitespace, we need to quote it.
Previously, only the characters up to the first whitespace was checked.
Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
Before this change, LC_TIME=zh_TW.UTF-8 makepkg has the following line:
==> Making package: foobar 1-1 (日 2月 11 01:13:42 CST 2018)
With this patch, this line becomes:
==> Making package: foobar 1-1 (西元2018年02月11日 (週日) 01時13分57秒)
The latter is more natural for a Chinese native speaker.
Signed-off-by: Chih-Hsuan Yen <yan12125@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
The acinclude.m4 uses AS_VAR_APPEND macro. This marco is introduced in 2.64[1], hence we bump AC_PREREQ to 2.64 to avoid undefined marco on 2.63 autoconf.
[1] https://lists.gnu.org/archive/html/autoconf/2009-07/msg00079.html
Signed-off-by: Huáng Jùnliàng <i@jhuang.me>
Signed-off-by: Allan McRae <allan@archlinux.org>
bump libarchive requirement to >= 3.0.0 as we use `archive_write_free` available from 3.0.0
Signed-off-by: Huáng Jùnliàng <i@jhuang.me>
Signed-off-by: Allan McRae <allan@archlinux.org>
Currently this seems to be only theoretically useful. The most likely
reason for wanting a packagelist is in order to script makepkg and
derive the filenames for the packages we want to install or repo-add,
but in the current implementation this requires a lot of additional
post-processing which must be duplicated in every utility to wrap
makepkg.
- It is of minimal use to know what packages might get created on some
other device utilizing a different CPU/OS architecture, so don't list
them.
- It is non-trivial to reimplement makepkg's logic for sourcing any of
several makepkg.conf configuration files, then applying environment
overrides in order to get the PKGDEST and PKGEXT, so include them
directly in the returned filenames.
- Output is delimited by newlines, for readability. For maximum
parsing reliability, libmakepkg needs to learn how to lint the PKGDEST
and PKGEXT variables to ensure they do not contain newlines, which
will be submitted in a separate patch.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
Query operations act on the local db, not the filesystem. Also, a
valid use case for -Qo is to discover what package owns a deleted file
so it can be reinstalled.
Closes FS#55856.
Signed-off-by: Ivy Foster <iff@escondida.tk>
Signed-off-by: Allan McRae <allan@archlinux.org>
S_ISDIR is int and "returns non-zero" if the file is a directory.
Signed-off-by: Ivy Foster <iff@escondida.tk>
Signed-off-by: Allan McRae <allan@archlinux.org>
Add a new man page which describes the structure of a BUILDINFO file
included in a package produced by makepkg.
Signed-off-by: Jelle van der Waa <jelle@vdwaa.nl>
Signed-off-by: Allan McRae <allan@archlinux.org>
Recent versions of GnuPG are perfectly capable of using sane defaults,
and the default SKS keyserver over hkps:// is better than hardcoding the
same keyserver over hkp:// anyway.
Fixes FS#55278
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
In commit ab2be5794d return codes were
implemented, and the output of install_package was improperly assigned
to a variable when the return code was wanted.
All we need to do is restore the previous exit handling, but return $?
instead of hardcoding "0".
Reported-by: xftroxgpx <xftroxgpx@protonmail.com>
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
