1
0
mirror of https://github.com/moparisthebest/pacman synced 2024-12-22 15:58:50 -05:00
Commit Graph

5318 Commits

Author SHA1 Message Date
Simon Gomizelj
dd62fde53e validate %FILEPATH% when parsing repo dbs
Currently we make no effort to validate the %FILENAME% field in the
repo db. This allows for relative paths to be considered valid.

A carefully crafted db entry with a malicious relative path,
(e.g. `../../../../etc/passwd`) will cause pacman to to
overwrite _any_ file on the target's machine.

Add the following validation:

- doesn't start with '.'
- doesn't contain a '/'
- won't overflow PATH_MAX

Signed-off-by: Simon Gomizelj <simongmzlj@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-06-04 13:45:12 +10:00
Allan McRae
fe794ccb25 Restrict pkgname from starting with a dot.
Adding this restriction means we can filter any FILENAME entry from
starting with a "/" or a ".".  Use the term "dot" as it is more
computing relevant compared to "full stop" or "period" which vary
depending on English locale.

Signed-off-by: Allan McRae <allan@archlinux.org>
2013-06-04 13:38:48 +10:00
Eric Bélanger
f1d74d928a Remove backslash typo from makepkg man page
Signed-off-by: Eric Bélanger <snowmaniscool@gmail.com>
Signed-off-by: Dan McGee <dan@archlinux.org>
2013-05-29 14:45:45 +10:00
Jason St. John
7d2c7fb347 Fix various typos in NEWS
imporve -> improve
diskspace -> disk space
BTRFS -> Btrfs
filelists -> file lists
filesize -> file size

Signed-off-by: Jason St. John <jstjohn@purdue.edu>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-05-29 13:56:55 +10:00
Allan McRae
d235f54114 Remove incorrect bug number from NEWS
The wrong bug number is mentioned in commit 32327dc8 and this was
perpetuated into the NEWS file.

Signed-off-by: Allan McRae <allan@archlinux.org>
2013-05-19 22:53:06 +10:00
Allan McRae
8335e169a6 makepkg: Use LOGDEST for logpipe
If LOGDEST is set, we may not check that $startdir is writable. Store
the log pipe in LOGDEST instead.

Signed-off-by: Allan McRae <allan@archlinux.org>
2013-05-18 23:14:21 +10:00
Allan McRae
1ed881fed3 Fix comment typo
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-05-18 22:43:12 +10:00
William Giokas
090c4006d7 contrib: Remove harcoded /etc/pacman.conf
Signed-off-by: William Giokas <1007380@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-05-18 10:43:42 +10:00
Dave Reisner
8be08f7cae Revert "paccache: avoid subshell in calling runcmd"
su is terribad. In addition to reverting, this also removes support for
privilege escalation via su. If you want to use paccache as root and
fail to comprehend how much better sudo is than su, then run paccache
directly via su.

Fixes FS#35173.

This reverts commit 597286eb25.

Signed-off-by: Dave Reisner <dreisner@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-05-18 10:43:16 +10:00
Dave Reisner
72c6d19d64 makepkg: fixup broken revision and repo references
bzr support "worked", but didn't handle any of the actual features we
wanted with makepkg. This moves the revision specification to the proper
place (extraction, rather than download), and fixes an additional broken
reference to $repo which was never set.

Fixes FS#35281.

Signed-off-by: Dave Reisner <dreisner@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-05-18 10:42:30 +10:00
Allan McRae
a4a7336dff 4.1.1 release NEWS, version bumps, etc.
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-05-07 12:53:24 +10:00
Allan McRae
35289bc17e More translation updates
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-05-07 12:53:23 +10:00
Andrew Gregory
692633264a pacman/util.c: add missing braces
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-05-07 12:53:23 +10:00
Andrew Gregory
34da9d25e4 pacman/util.c: fix output flushing in questions
Flush stream before taking input in select_question() and only flush
once during question().  Also fix some tabs inside related fprintf
statements.

Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-05-07 12:53:23 +10:00
Allan McRae
0aa9628560 Pull translation updates from transifex
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-30 21:18:42 +10:00
Eric Bélanger
91b9ea922a Add -V/--version option to makepkg's usage function and man page
Signed-off-by: Eric Bélanger <snowmaniscool@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-30 21:01:38 +10:00
Dave Reisner
c5a4b35528 makepkg: avoid redirecting stdout
If stdout is already redirected, redirecting stderr to stdout can lead
to undesirable results.

Fixes FS#34974.

Signed-off-by: Dave Reisner <dreisner@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-28 23:11:37 +10:00
Allan McRae
c1dfdd2010 Use libalpm version in pkg-config file
We currently use the pacman version number in the libalpm.pc file. It makes
more sense to use the libalpm version.

Fixes FS#34967.

Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-26 12:43:53 +10:00
Eric Bélanger
99b8d78bc6 Add prepare function to PKGBUILD proto files
Signed-off-by: Eric Bélanger <snowmaniscool@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-24 13:57:50 +10:00
Anatol Pomozov
769facca22 Fix spelling errors using 'codespell' tool
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-18 13:20:13 +10:00
Dave Reisner
597286eb25 paccache: avoid subshell in calling runcmd
Avoids problems with one of the worst CLI tools ever created, su.

Fixes FS#34656.

Signed-off-by: Dave Reisner <dreisner@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-12 09:42:43 +10:00
Allan McRae
695f0e443e makepkg: fix svn repo extraction
Copy SVN repos rather than using "svn export" to keep all anotation
files in the repo for build scripts that use (e.g.) "svin info".

Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-12 09:42:43 +10:00
Allan McRae
7e0f528274 Do not use checkout directory for SVN config
Using the checkout directory for the SVN config can result in clashes
between config files and files from the SVN checkout.  Instead, use
a ".makepkg" directory within the checkout.

Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-12 09:42:41 +10:00
Maxime Gauduin
2bf2700b74 Add support for all bzr URLs in the PKGBUILD source array
Add support for all bzr URLs, including "lp:" URLs, in the source array.
This, however, requires an internet connection and will fall back to the
current behavior for offline builds. In that case, only the URL reported
by 'bzr config parent_location' run inside the local repo can be used,
and is outputted.

Signed-off-by: Maxime Gauduin <alucryd@gmail.com>
2013-04-11 10:56:50 +10:00
William Giokas
b7c994db8b makepkg: don't run remove_deps twice when unneeded
remove_deps already has a check and won't run unless -r is specified, so
if this was meant to remove dependencies of a failure no matter what,
then it's not doing it, and with -r it is run twice on a failure for no
real reason.

Signed-off-by: William Giokas <1007380@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-11 10:53:52 +10:00
Allan McRae
3de8f8f1cc Rework callback message to add translation
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-11 10:53:52 +10:00
Allan McRae
32c91e2895 contrib/checkupdates: do not log
Avoid the log file filling up with "[PACMAN] synchronizing package lists".

Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-09 11:52:32 +10:00
Andrew Gregory
95c68d26ef pacman: add -Qkk to usage() help
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-09 11:51:46 +10:00
William Giokas
0f486adfec contrib: Use sysconfdir instead of /etc
Don't force people to see /etc.

Signed-off-by: William Giokas <1007380@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-09 11:51:45 +10:00
Daniel Wallace
f9280a0523 zsh completion: make sure -Ss works
if you put a type in pacman -Ss <regex> it doesn't work because it never
passes through they pointer ->sync_search to set $state.  All of the
other iterations like this have a case, add one for -S*s*

Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-06 13:16:05 +10:00
Simon Gomizelj
0f05bfc340 ctypes.h shouldn't be included twice
Earnestly spotted this on #archlinux.

Signed-off-by: Simon Gomizelj <simongmzlj@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-06 13:01:49 +10:00
William Giokas
7b10519835 doc: fix debug spelling mistake
with -> when

Signed-off-by: William Giokas <1007380@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-06 12:59:02 +10:00
Andrew Gregory
b5a7734a7e use off_t for table_row_t.size
size went from off_t in _display_targets to int in
add_transaction_sizes and back to off_t in humanize_size
leading to potential overflows.

Fixes FS#34616.

Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-06 12:55:09 +10:00
Allan McRae
5caf143faa Bump to version 4.0.0
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-01 15:53:13 +10:00
Allan McRae
e9639ad172 Update translations from transifex
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-01 15:53:12 +10:00
Daniel Wallace
8d3ee29809 remove continue from download_local
Bug exposed by a6291858cc

popd doesn't run in the for loop in download_sources() if the continue
in download_files is executed. Causing the extract_files to extract
everything into $SRCDEST instead of $srcdir

Signed-off-by: Allan McRae <allan@archlinux.org>
2013-04-01 15:53:12 +10:00
Simon Gomizelj
afc77a808d pm_asprintf logs 'failed to allocate' already
Signed-off-by: Simon Gomizelj <simongmzlj@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-03-31 11:08:54 +10:00
Richard Pougnet
c85d155f3a Improve documentation of libalpm interface functions
Add details to the doxygen for the initialization and relase functions
of the library.

Signed-off-by: Richard Pougnet <richard@pougnet.ca>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-03-31 11:08:54 +10:00
Andrew Gregory
950443a438 makepkg: unset GREP_OPTIONS
grep allows options to be set from the environment with GREP_OPTIONS.
Many of these options will alter grep's output, breaking makepkg.
GREP_OPTIONS=--line-number breaks installed dependency removal, for
instance.

Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-03-31 11:08:54 +10:00
Andrew Gregory
d5c0f39144 use default foreground color instead of white
Using white made important text invisible on terminals with white
backgrounds.

Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-03-30 09:06:12 +10:00
Allan McRae
a6291858cc Ensure we are always in $SRCDEST before downloading
When VCS sources were updated, we changed into their root directory.
Any following source was then downloaded to an incorrect place causing
a failure in makepkg.  Ensure we are always in the $SRCDEST directory
before starting any download.

Fixes FS#34488.

Signed-off-by: Allan McRae <allan@archlinux.org>
2013-03-30 09:06:12 +10:00
Allan McRae
3f00a03db4 Final NEW update for pacman-4.1
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-03-30 09:06:12 +10:00
Allan McRae
d413178354 Add releases and dates to table
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-03-30 09:06:12 +10:00
Allan McRae
a31e8bdff6 Document -Qkk
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-03-30 09:06:12 +10:00
Simon Gomizelj
38f0a7d462 signature_display should also be colourized
Signed-off-by: Simon Gomizelj <simongmzlj@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-03-26 15:55:51 +10:00
Kyle Keen
f797749c4e contrib: adding checkupdates
Signed-off-by: Kyle Keen <keenerd@gmail.com>

[Allan: update contrib/README]
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-03-26 15:55:51 +10:00
Allan McRae
bf3618a7c1 contrib: Update bash_completion
Check all options are included in bash-completion.  Alphabetize the
pacman_key options for easier maintenance.

Signed-off-by: Allan McRae <allan@archlinux.org>
2013-03-26 15:55:51 +10:00
Allan McRae
6e2c15099a Remove duplicate option
The "skippgpcheck" option was specified twice.  Also, fix alphabetical
ordering.

Signed-off-by: Allan McRae <allan@archlinux.org>
2013-03-26 15:55:51 +10:00
Daniel Wallace
fb522face1 zsh_completion: remove sigfiles from package files completion
use setopt extendedglob to remove sigfiles from package completion

Signed-off-by: Daniel Wallace <danielwallace@gtmanfred.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-03-26 15:55:51 +10:00
Daniel Wallace
cd6ca88c49 zsh completion: make $tmp local
The tmp variable is conflicting with the $tmp variable in
${^fpath}/_main_complete(N) and which is used to complete all the
functions, and causing an error: command not found: for whatever was in
$tmp (which in this case is the last value in $words[@])

making it local fixes this.

Signed-off-by: Daniel Wallace <danielwallace@gtmanfred.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-03-26 15:55:51 +10:00