summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* Sign database even if emptyRay Kohler2011-03-27
| | | | | | | | Move the create_signature() call outside the case of non-empty databases, so it will be called regardless. Signed-off-by: Ray Kohler <ataraxia937@gmail.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* makepkg: allow PKGEXT and SRCEXT to be overridden by env variablesRay Kohler2011-03-27
| | | | | | Signed-off-by: Ray Kohler <ataraxia937@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
* Rely on the return value of type instead of its outputDave Reisner2011-03-27
| | | | | Signed-off-by: Dave Reisner <d@falconindy.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* lib/dload: abstract out helper function to set utimesDave Reisner2011-03-27
| | | | | | | | This greatly simplifies the cleanup fallthrough in our download function and we'll be able to reuse this for signatures. Signed-off-by: Dave Reisner <d@falconindy.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* lib/dload: remove proxy debug outputDave Reisner2011-03-27
| | | | | Signed-off-by: Dave Reisner <d@falconindy.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* lib/dload: code simplificationDave Reisner2011-03-27
| | | | | | | | | Based on the fact that localf always points to the same file, there's no need to code in multiple fopen calls with varying results. Instead, track the desired file open mode and make a single call to fopen. Signed-off-by: Dave Reisner <d@falconindy.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* lib/dload: merge get_{destfile,tempfile} into get_fullpathDave Reisner2011-03-27
| | | | | | | | Create a more general function that allows appending a suffix to a filepath. Signed-off-by: Dave Reisner <d@falconindy.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* pacman/pacman.c: fix setting of useragent stringDave Reisner2011-03-27
| | | | | | | libcurl doesn't natively honor the HTTP_USER_AGENT environment variable. Signed-off-by: Dave Reisner <d@falconindy.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* lib/dload: pass a struct with filename and size to curl_progressDave Reisner2011-03-27
| | | | | | | | This lets us determine the real size of the file on disk so that we can properly bump the progress bar when we're resuming a download. Signed-off-by: Dave Reisner <d@falconindy.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* Merge branch 'maint'Dan McGee2011-03-24
|\
| * Add -T, --deptest to usage messageRay Kohler2011-03-24
| | | | | | | | | | | | | | Fixes FS #23369 Signed-off-by: Ray Kohler <ataraxia937@gmail.com> Signed-off-by: Dan McGee <dan@archlinux.org>
| * Make log redirection sanerJan Steffens2011-03-24
| | | | | | | | | | | | | | | | | | My main motivation was to remove the "sync", which can stall for minutes on a busy machine (FS#23378). I also cleaned up the redirection. Signed-off-by: Jan Steffens <jan.steffens@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
| * alpm/db: do not close local DB in alpm_db_unregister_allDave Reisner2011-03-24
| | | | | | | | | | | | | | | | | | pacman 3.5.0 removed alpm_db_register_local, so calling alpm_db_unregister_all leaves the front end in a position where there's no local db, and no way to re-register it. Signed-off-by: Dave Reisner <d@falconindy.com> Signed-off-by: Dan McGee <dan@archlinux.org>
| * Update doc/index.txt with 3.5.1 release dateDan McGee2011-03-23
| | | | | | | | Signed-off-by: Dan McGee <dan@archlinux.org>
* | Fix use of relative paths for packages in repo-addRay Kohler2011-03-24
| | | | | | | | | | | | | | | | | | Move checksum and pgpsig calcluation before changing into the tmpdir, otherwise we can't find the files if a relative path was used. Signed-off-by: Ray Kohler <ataraxia937@gmail.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* | Do not reuse old signatureAllan McRae2011-03-23
| | | | | | | | | | | | | | After updating a database, remove the old signature to prevent it being used in validation if the new signature fails to download. Signed-off-by: Allan McRae <allan@archlinux.org>
* | Download and verify package database signaturesAllan McRae2011-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | If signature verification is needed, attempt to download a signature file for a repo when it is updated. Return an error if unable to download signature only when checking is mandatory, or if signature is invalid. TODO: At the moment the database signature is only checked on download. Should we do anything with a database if it fails to be verified to prevent its future usage? Signed-off-by: Allan McRae <allan@archlinux.org>
* | Refactor signature loading code into common functionDan McGee2011-03-23
| | | | | | | | | | | | | | We can use this for both standalone package signatures as well as standalone database signatures. Signed-off-by: Dan McGee <dan@archlinux.org>
* | Add functions for verifying database signatureAllan McRae2011-03-23
| | | | | | | | | | | | | | | | | | | | | | | | Add a pmpgpsig_t struct to the database entry struct and functions for the lazy loading of database signatures. Add a function for checking database signatures, reusing (and generalizing) the code currently used for checking package signatures. TODO: The code for reading in signature files from the filesystem is duplicated for local packages and database and needs refactoring. Signed-off-by: Allan McRae <allan@archlinux.org>
* | etc/makepkg.conf: use curl in place of wget as a DLAGENTDave Reisner2011-03-23
| | | | | | | | | | Signed-off-by: Dave Reisner <d@falconindy.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* | lib/dload.c: Check for dlcb == NULL earlierDave Reisner2011-03-23
| | | | | | | | | | | | | | | | Our curl callback does a whole lot of work for nothing if the front end never defined a callback to receive the data we'd calculate for it. Signed-off-by: Dave Reisner <d@falconindy.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* | lib/dload.c: don't use deprecated curl symbolsDave Reisner2011-03-23
| | | | | | | | | | | | | | | | CURLINFO_HTTP_CODE is deprecated in favor of CURLINFO_RESPONSE_CODE. Both yield the same values. Signed-off-by: Dave Reisner <d@falconindy.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* | lib/dload.c: don't request compressed transportDave Reisner2011-03-23
| | | | | | | | | | | | | | | | The files we transfer are generally compressed already, so this just adds unnecessary overhead. Signed-off-by: Dave Reisner <d@falconindy.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* | lib/dload.c: Fix progress callback issues on downloadDave Reisner2011-03-23
| | | | | | | | | | | | | | | | | | Use a static variable to effectively track the initialization state of the progress callback via the last byte amount reported as downloaded by libcurl. Signed-off-by: Dave Reisner <d@falconindy.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* | lib/dload.c: fix compiler warnings generated by -Wfloat-equalDave Reisner2011-03-23
| | | | | | | | | | | | | | | | * introduces new macro in util.h (DOUBLE_EQ) for properly comparing floating point values Signed-off-by: Dave Reisner <d@falconindy.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* | buildsys: use libcurl's m4 macro for buildtime detectionDave Reisner2011-03-23
| | | | | | | | | | Signed-off-by: Dave Reisner <d@falconindy.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* | Report output from signature checking to debug logAllan McRae2011-03-23
| | | | | | | | | | | | | | | | Move the (possibly still temporary) output generated during signature checking into the --debug output. Signed-off-by: Allan McRae <allan@archlinux.org> Signed-off-by: Dan McGee <dan@archlinux.org>
* | Added gpg verification options per repo to the config file.Xavier Chantry2011-03-23
| | | | | | | | | | | | | | | | | | | | | | Once we do this, add support for VerifySig to pactest. We just check if the repo name contains Always, Never or Optional to determine the value of VerifySig. The default is Never. pacman uses Always by default but this is not suitable for pactest. Original-work-by: shankar <jatheendra@gmail.com> Signed-off-by: Xavier Chantry <shiningxc@gmail.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* | Remove unnecessary sanity check on db->setserverDan McGee2011-03-23
| | | | | | | | | | | | | | | | We pass in a db object, so no need to go looking for it in the list on the handle. This is a remnant of when we passed in a treename, more than likely. Signed-off-by: Dan McGee <dan@archlinux.org>
* | Let pacman specify GnuPG's home directory.Chris Brannon2011-03-23
| | | | | | | | | | | | | | | | | | | | | | | | GnuPG looks for configuration files and keyrings in its home directory. For a user, that is typically ~/.gnupg. This patch causes pacman to use /etc/pacman.d/gnupg/ as the default GnuPG home. One may override the default using --gpgdir on the command-line or GPGDir in pacman's configuration file. Signed-off-by: Chris Brannon <cmbrannon@cox.net> Signed-off-by: Xavier Chantry <shiningxc@gmail.com> Signed-off-by: Dan McGee <dan@archlinux.org>
* | Add a pactest showing failed GPG verificationDan McGee2011-03-23
| | | | | | | | Signed-off-by: Dan McGee <dan@archlinux.org>
* | Integrate GPGME into libalpmDan McGee2011-03-23
| | | | | | | | Signed-off-by: Dan McGee <dan@archlinux.org>
* | Add some error codes for signature verificationDan McGee2011-03-23
| | | | | | | | Signed-off-by: Dan McGee <dan@archlinux.org>
* | Add signature directory as option on libalpm handleDan McGee2011-03-23
| | | | | | | | | | | | | | This will serve as the home directory we pass to GPGME when making calls so we can have a libalpm-utilized keyring. Signed-off-by: Dan McGee <dan@archlinux.org>
* | Actually read PGPSIG field in sync DB codeDan McGee2011-03-23
| | | | | | | | Signed-off-by: Dan McGee <dan@archlinux.org>
* | Merge branch 'gpg-libalpm-basics'Dan McGee2011-03-23
|\ \
| * | Add a few pactests for PGP integrationDan McGee2011-03-23
| | | | | | | | | | | | Signed-off-by: Dan McGee <dan@archlinux.org>
| * | Read in .sig files when opening a package fileDan McGee2011-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | If a .sig file sits side-by-side on the filesystem with a package archive, read it in during the package struct creation process so we can verify it at a later time if necessary. Signed-off-by: Dan McGee <dan@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org>
| * | Add PGP signature support to pactestDan McGee2011-03-23
| | | | | | | | | | | | | | | | | | Allow pkg.pgpsig to end up in the created sync databases. Signed-off-by: Dan McGee <dan@archlinux.org>
| * | Allow PGP signature to be read from sync databaseDan McGee2011-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new field to the package struct to hold PGP information and instruct db_read to pick it up from the database. It is currently unused internally but this is the first step. Due to the fact that we store the PGP sig as binary data, we need to store both the data and the length so we have a small utility struct to assist us. Signed-off-by: Dan McGee <dan@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org>
| * | Add base64 algorithms from PolarSSL to libalpmDan McGee2011-03-23
| | | | | | | | | | | | | | | | | | | | | | | | We will need these for GPG functionality (decoding the base64 encoded signature stored in the databases). Signed-off-by: Dan McGee <dan@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org>
* | | Remove libfetch error codeDan McGee2011-03-23
|/ / | | | | | | Signed-off-by: Dan McGee <dan@archlinux.org>
* | Merge branch 'gpg-build-tools'Dan McGee2011-03-23
|\ \
| * | repo-add: add sha256sum values to repo databaseDan McGee2011-03-23
| | | | | | | | | | | | | | | | | | | | | Implements FS#23103. Also modify libalpm so it ignores this value without any warning as we know it is likely to exist. Signed-off-by: Dan McGee <dan@archlinux.org>
| * | repo-add: add symlink to signature fileAllan McRae2011-03-23
| | | | | | | | | | | | Signed-off-by: Allan McRae <allan@archlinux.org>
| * | repo-add: Fix up usage with GPG optionsDan McGee2011-03-23
| | | | | | | | | | | | Signed-off-by: Dan McGee <dan@archlinux.org>
| * | repo-add: add -v/--verify optionDan McGee2011-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is intended to verify an existing signature on a database before making further changes to it and performing updates. Rarely would you use this without immediately resigning it via the -s/--sign option. Instead, it is intended as a "chain of trust" operation where the previous signature is verified to give you some sense that what you sign off on is also safe. Still todo: don't make changes unless the signature is not only good, but also in the accepted list of keys. Signed-off-by: Dan McGee <dan@archlinux.org>
| * | repo-add: allow signing of the package databaseDan McGee2011-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to be fully secure, we can't only sign packages. We also need to sign our repository metadata to prevent database falsification, dependency injection, etc. Add an '-s/--sign' option that allows this functionality, and will generate a .sig file side-by-side with the package database. While at it, fix the issue where a signature file would never be found because of 'cd' madness (this needs fixing in another commit). Signed-off-by: Dan McGee <dan@archlinux.org>
| * | Add PGPSIG field in repo-addGeoffroy Carrier2011-03-23
| | | | | | | | | | | | | | | | | | | | | | | | Use base64 encoding to store the value in the database if a .sig file exists for the package being added. Signed-off-by: Geoffroy Carrier <geoffroy.carrier@koon.fr> Signed-off-by: Dan McGee <dan@archlinux.org>
| * | makepkg: place signature symlink in build dirAllan McRae2011-03-22
| | | | | | | | | | | | | | | | | | | | | Be consistent in package and signature placements when using PKGDEST. Signed-off-by: Allan McRae <allan@archlinux.org>
generated by cgit v1.2.3-70-g09d2 (git 2.47.0) at 2024-12-26 15:48:38 +0000