diff mbox

[pacman-dev,v2] libmakepkg/integrity: fix regression that broke --install

Message ID 20180315004211.26013-1-eschwartz@archlinux.org
State Accepted, archived
Headers show

Commit Message

Eli Schwartz March 15, 2018, 12:42 a.m. UTC
In commit c6b04c04653ba9933fe978829148312e412a9ea7 package signing was
moved out of fakeroot, and as part of this process, the global pkgname
variable was modified in order to extract the built package names.

However, if a debug package was not available and added to the list of
packages, the function was aborted early, before the pkgname array was
restored, thereby corrupting the later stages of makepkg and
specifically the install_package function which needs to know which
pkgnames to install.

Fix this by inlining the debug package signing inside the `if` check,
and as added security switch to using `for pkg in "${pkgname[@]}"` as is
done in many other parts of makepkg, since package signing does not
depend on the value of pkgname for anything.

Additionally, since debug packages may not actually exist, check if the
package file exists first.

Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
---

v2: rm unused variable, also fix case where debug packages aren't
created because no debug symbols were found.

 .../libmakepkg/integrity/generate_signature.sh.in  | 23 ++++++++++------------
 1 file changed, 10 insertions(+), 13 deletions(-)

--
2.16.2

Comments

Allan McRae March 15, 2018, 12:53 a.m. UTC | #1
On 15/03/18 10:42, Eli Schwartz wrote:
> In commit c6b04c04653ba9933fe978829148312e412a9ea7 package signing was
> moved out of fakeroot, and as part of this process, the global pkgname
> variable was modified in order to extract the built package names.
> 
> However, if a debug package was not available and added to the list of
> packages, the function was aborted early, before the pkgname array was
> restored, thereby corrupting the later stages of makepkg and
> specifically the install_package function which needs to know which
> pkgnames to install.
> 
> Fix this by inlining the debug package signing inside the `if` check,
> and as added security switch to using `for pkg in "${pkgname[@]}"` as is
> done in many other parts of makepkg, since package signing does not
> depend on the value of pkgname for anything.
> 
> Additionally, since debug packages may not actually exist, check if the
> package file exists first.
> 
> Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
> ---
> 
> v2: rm unused variable, also fix case where debug packages aren't
> created because no debug symbols were found.
> 

Looks good!

A
diff mbox

Patch

diff --git a/scripts/libmakepkg/integrity/generate_signature.sh.in b/scripts/libmakepkg/integrity/generate_signature.sh.in
index 8bb69984..785792bb 100644
--- a/scripts/libmakepkg/integrity/generate_signature.sh.in
+++ b/scripts/libmakepkg/integrity/generate_signature.sh.in
@@ -50,28 +50,25 @@  create_package_signatures() {
 	if [[ $SIGNPKG != 'y' ]]; then
 		return 0
 	fi
-	local pkgarch pkg_file
-	local pkgname_backup=("${pkgname[@]}")
+	local pkg pkgarch pkg_file
 	local fullver=$(get_full_version)

 	msg "$(gettext "Signing package(s)...")"

-	for pkgname in ${pkgname_backup[@]}; do
-		pkgarch=$(get_pkg_arch $pkgname)
-		pkg_file="$PKGDEST/${pkgname}-${fullver}-${pkgarch}${PKGEXT}"
+	for pkg in "${pkgname[@]}"; do
+		pkgarch=$(get_pkg_arch $pkg)
+		pkg_file="$PKGDEST/${pkg}-${fullver}-${pkgarch}${PKGEXT}"

 		create_signature "$pkg_file"
 	done

 	# check if debug package needs a signature
 	if ! check_option "debug" "y" || ! check_option "strip" "y"; then
-		return
+		pkg=$pkgbase-@DEBUGSUFFIX@
+		pkgarch=$(get_pkg_arch)
+		pkg_file="$PKGDEST/${pkg}-${fullver}-${pkgarch}${PKGEXT}"
+		if [[ -f $pkg_file ]]; then
+			create_signature "$pkg_file"
+		fi
 	fi
-
-	pkgname=$pkgbase-@DEBUGSUFFIX@
-	pkgarch=$(get_pkg_arch)
-	pkg_file="$PKGDEST/${pkgname}-${fullver}-${pkgarch}${PKGEXT}"
-	create_signature "$pkg_file"
-
-	pkgname=("${pkgname_backup[@]}")
 }