| Age | Commit message (Collapse) | Author |
|---|
|
system() runs the provided command via a shell, which is subject to
command injection. Even though pacman already provides a mechanism to
sign and verify the databases containing the urls, certain distributions
have yet to get their act together and start signing databases, leaving
them vulnerable to MITM attacks. Replacing the system call with an
almost equivalent exec call removes the possibility of a shell-injection
attack for those users.
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
|
|
If we use make dist to create the official, signed release tarballs,
those will not have meson build files by default since autotools doesn't
know what they are.
Also distribute all src/common/ files. We never strictly needed any of
them to be distributed with autotools, because the dist tarball
dereferences the symlinks (???), but only some of them were being
distributed, and meson needs them to be in the right location as we only
build libcommon from the primary files.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
This includes a patch from Andrew to fix pactest's TAP output for
subtests. Original TAP support in meson was added in 0.50, but 0.51
contains a bugfix that ensures the test still work with the --verbose
flag passed to meson test, so let's depend on that.
|
|
Make it clearer that the targets are matched against both directories
and regular files and free up File to potentially refer specifically to
regular files in the future. File is retained as a deprecated alias for
Path for the time being to avoid breaking existing hooks and will be
removed in a future release.
See FS#53136.
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Previously, pacman's test suite would fail when compiled without
signature support.
Adds a require_capability method to pmtest objects. Currently
recognized values are 'gpg', 'curl', and 'nls'; although only gpg is
used presently. Missing features are indicated by running pactest with
one of the --without-<feature> options.
This modifies pmenv to run each case as independent tests. Previously,
a single pmenv could run multiple tests, combining there output into
a single TAP stream but making it impossible to properly skip an entire
test case. This change does not affect running pactest.py with a single
test (as both autotools and meson do), but will affect anybody manually
running pactest.py with multiple tests at once.
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Unused since 12e00af5315135a29a66c9aaa01e141a32d4634b
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Commit 2ee7a8d89ad693617307260604e1d58757fd2978 replaced a manual check
for a local package with a check for the "oldpkg" member, which gets set
at the beginning of the transaction. If the package was also in the
remove list, such as when a package gets replaced, it would no longer be
in the local db and pacman would try to remove it twice, resulting in
superfluous error messages.
Fixes: FS#50875, FS#55534
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Provide both build systems in parallel for now, to ensure that we work
out all the differences between the two. Some time from now, we'll give
up on autotools.
Meson tends to be faster and probably easier to read/maintain. On my
machine, the full meson configure+build+install takes a little under
half as long as a similar autotools-based invocation.
Building with meson is a two step process. First, configure the build:
meson build
Then, compile the project:
ninja -C build
There's some mild differences in functionality between meson and
autotools. specifically:
1) No singular update-po target. meson only generates individual
update-po targets for each textdomain (of which we have 3). To make
this easier, there's a build-aux/update-po script which finds all
update-po targets and runs them.
2) No 'make dist' equivalent. Just run 'git archive' to generate a
suitable tarball for distribution.
|
|
If poll() is interrupted by a signal, alpm was closing the socket it
uses for listening to script/hook output. This would drop script output
at the least and kill the script at the worst.
Fixes FS#60396
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Front-ends or libraries may set signals to be ignored, which gets
inherited across fork and exec. This can cause scripts to malfunction
if they expect the signal. To make matters worse, scripts written in
bash can't reset signals that were ignored when bash was started.
Fixes FS#56756
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Use BytesIO instead of StringIO, and ensure that we unicode-encode data
where needed.
|
|
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Many of these are pointless (e.g. there is no need to explicitly turn on
spellchecking and language dictionaries for the manpages by default).
The only useful modelines are the ones enforcing the project coding
standards for indentation style (and "maybe" filetype/syntax, but
everything except the asciidoc manpages and makepkg.conf is already
autodetected), and indent style can be applied more easily with
.editorconfig
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
make update-copyright OLD=2017 NEW=201
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Signed-off-by: Stefan Klinger <git@stefan-klinger.de>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Signed-off-by: Michael Straube <straubem@gmx.de>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
|
|
If the user replaces a directory with a symlink, libalpm would get
confused because the trailing slash causes system calls to resolve the
symlink. This leads to errors and a misleading message during upgrades.
Even though libalpm does not support this, it should not be giving
misleading errors.
Also adds an overflow check.
Fixes FS#51377
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
|
|
Allows for safer, more fine-grained control for overwriting files than
--force's all-or-nothing approach.
Implements FS#31549.
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Opens the test file(s), test output, and any log files in the test
environment in an editor after the tests run for review. Simplifies
debugging tests by avoiding the need to use --keep-root and manually
opening the relevant files. The editor used can be set with --editor or
$EDITOR, falling back to vim.
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
When replacing a file with a directory, any files under that directory
do not need to be checked for conflicts. This prevents possible
false-positive conflicts where the file being replaced is a symlink.
We were already skipping the directory children when the file was owned
by the previous version of a package being upgraded. This extends that
to other packages being removed.
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Some database files (install, mtree, and changelog) are extracted
directly from the package, but DBONLY was skipping extraction
altogether, causing those files to be missing after the transaction.
Fixes #52052
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Moved to the pacman-contrib project
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
parseopts is used in makepkg and other scripts such as pacman-key as a
getopt replacement.
Instead of including it in those scripts via a macro, move it to
libmakepkg/util/parseopts.sh and have scripts source this file where
appropriate.
To keep the parseopts test, a new variable was introduced:
PM_LIBMAKEPKG_DIR
Signed-off-by: Alad Wenter <alad@archlinux.info>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Also add pactest which captures this leak when run under valgrind.
Reported-by: Sergey Petrenko
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Cyclic dependencies (A depends on B, B depends on A) were not selected
because neither package could be removed individually, so
can_remove_package would always return false for both. By preselecting
all dependencies then filtering back out any dependencies still required
by any packages that will not be uninstalled, groups of unneeded cyclic
dependencies can be found.
Fixes FS#41031
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
When printing a list of URLs of packages to be updated, pacman was ignoring any
replacements that would be made in the update process.
Fixes FS#35812
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Relying on localdb to determine which trigger operations should match is
completely broken for PostTransaction hooks because the localdb has
already been updated. Store a copy of the old version of any packages
being updated to use instead.
Fixes FS#47996
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Check if we overwrote an exiting pacnew file before unlinking it.
Otherwise, updating to a version with an unchanged file would delete
existing pacnew files.
FS#47993
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
The test introduced herein illustrates a behavior that may be unexpected
to package writers.
It creates a package "pkg3" that is configured to depend on a
"dependency" which version is between 3 and 4, inclusive. Two other
packages are already present, providing "dependency" in version 2 and 5,
respectively. So, the situation looks roughly like this:
pkg1 pkg3 pkg2
provides depends on provides
| <------------> |
version __________2____________3____________4____________5___________...
This seems to be enough to satisfy pacman when installing "pkg3". From
an iterative standpoint, this is completely logical: First, the
requirement "dependency>=3" is checked. There is a package that
satisfies this restriction, it is called "pkg2". Afterwards,
"dependency<=4" is covered in the same way by "pkg1".
Nonetheless, what a package writer intends when specifying
depends=('dependency>=3' 'dependency<=4')
is most probably that pacman should only allow this package to be
installed when there indeed is a package present that provides a version
of "dependency" that lies _between_ 3 and 5.
Signed-off-by: Dominik Fischer <d dot f dot fischer at web dot de>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
make update-copyright OLD=2015 NEW=2016
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
When replacing a file with a directory, any files inside the new
directory cannot possibly exist on the filesystem and can be skipped.
This allows cross-package symlink-to-directory transitions when there
are files with the same name under both the symlinked directory and the
new directory.
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
When a symlink to a directory is changing to a directory, any package file
inside the new directory can create an unexpected conflict with the filesystem.
Reported by Neofytos and Luca from Chakra.
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Newlines clutter tap output and can potentially confuse TAP parsers.
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Especially when maintaining local templates in addition to the ones
stored in /usr/share/makepkg-template, it can be useful to include
templates stored in multiple different locations into one PKGBUILD. This
patch makes this possible by allowing --template-dir to be specified
multiple times.
This also introduces a dedicated error message when a template cannot be
found, in contrast to the already existing "Couldn't detect version for
template '%s'".
If a template of the same name is present in more than one of the given
directories, the last one always takes precedence.
Neither the default behaviour without the option given, nor the handling
of a single template dir is changed.
Signed-off-by: Dominik Fischer <d.f.fischer@web.de>
Signed-off-by: Florian Pritz <bluewind@xinu.at>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
Paths from noupgrade, the transaction skip_remove, and package backup
lists were combined into a single list matched using fnmatch causing
paths with glob characters to match unrelated files.
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|
|
|
|
LIBCURL was never set in the Makefile so XferCommand was always being
set in the test file. This removes the only substitution in our test
files which will prevent the TESTS file from being rebuilt every time
configure is run.
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
|