]>
git.ipfire.org Git - pakfire.git/log
Michael Tremer [Fri, 17 Mar 2023 13:29:52 +0000 (13:29 +0000)]
FHS: Check for world-writable files
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 13:24:47 +0000 (13:24 +0000)]
util: Fix path pattern matching with characters after stars
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 13:14:39 +0000 (13:14 +0000)]
file: Remove forgotten debug statements
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 13:05:21 +0000 (13:05 +0000)]
build: Perform BUILDROOT check in C
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 12:17:31 +0000 (12:17 +0000)]
FHS: Check for correct location and permission of shared objects
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 12:13:53 +0000 (12:13 +0000)]
tests: Add check for pakfire_path_match with stars in middle
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 12:03:03 +0000 (12:03 +0000)]
FHS: Fix indentation
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 12:00:35 +0000 (12:00 +0000)]
FHS: Do not allow any executable files in /var
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 11:57:33 +0000 (11:57 +0000)]
FHS: Do not allow any executable files in /usr/share
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 11:56:59 +0000 (11:56 +0000)]
FHS: All files in /boot must be owned by root
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 11:46:30 +0000 (11:46 +0000)]
FHS: Ensure that firmware files are not executable
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 11:06:15 +0000 (11:06 +0000)]
FHS: Rearrange the matrix
No functional changes
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 10:54:40 +0000 (10:54 +0000)]
build: Drop check-include
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 10:53:50 +0000 (10:53 +0000)]
FHS: Check permissions of files in /usr/include
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 10:53:13 +0000 (10:53 +0000)]
FHS: Do not allow any unknown subdirectories in /var
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 10:49:21 +0000 (10:49 +0000)]
FHS: Enfore that all files in /usr/*bin are executable
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 10:40:33 +0000 (10:40 +0000)]
FHS: Do not allow any subdirectories in /usr/bin & /usr/sbin
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 10:37:25 +0000 (10:37 +0000)]
FHS: Implement being able to check for file type
This allows us a more granular filtering
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 10:23:51 +0000 (10:23 +0000)]
FHS: Do not allow any more files in /usr and /usr/src
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 10:18:06 +0000 (10:18 +0000)]
FHS: Implement checking file ownerships
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 10:05:26 +0000 (10:05 +0000)]
build: Drop check-libraries script
This is now covered by the new builtin FHS check.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 10:03:36 +0000 (10:03 +0000)]
build: Drop old FHS script
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 17 Mar 2023 10:00:59 +0000 (10:00 +0000)]
FHS: Implement some simple filesystem checks
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 16 Mar 2023 19:27:28 +0000 (19:27 +0000)]
util: path_matches: Check if pattern is shorter than string
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 16 Mar 2023 15:54:51 +0000 (15:54 +0000)]
util: Implement a simple path matching function that supports **
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 16 Mar 2023 10:27:19 +0000 (10:27 +0000)]
arch: Drop support for all 32 bit architectures
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 16 Mar 2023 09:10:00 +0000 (09:10 +0000)]
compress: Fix wrong variable in threads code
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 16 Mar 2023 09:05:44 +0000 (09:05 +0000)]
packager: Don't initialize an unsigned integer with -1
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 16 Mar 2023 09:04:33 +0000 (09:04 +0000)]
compress: Enable parallel compression for Zstandard if available
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 16 Mar 2023 09:04:04 +0000 (09:04 +0000)]
compress: Create a unified function to create archives
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 16 Mar 2023 08:11:23 +0000 (08:11 +0000)]
snapshots: Call it store/restore
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 16 Mar 2023 08:07:57 +0000 (08:07 +0000)]
snapshots: Do not modify an existing snapshot
Instead, the routines will now write the new snapshot to a temporary
location and replace it more or less atomically.
Fixes: #13045 - Multiple concurrent instances can destroy the snapshot
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 15 Mar 2023 18:48:55 +0000 (18:48 +0000)]
Revert "snapshots: Pass path instead of file descriptor"
This reverts commit
4667a2ca811f6f2b20c1cfb3223dd8b90af4952c .
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 15 Mar 2023 18:40:49 +0000 (18:40 +0000)]
compress: Do not overwrite configuration on extraction
This is somewhat experimental and I would need to think a little bit
more about this.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 15 Mar 2023 18:29:42 +0000 (18:29 +0000)]
jail: Enable all QEMU CPU features by default
When we are emulating a different architecture, QEMU by default emulates
a very basic processor which might not be able to emulate for example
SIMD instructions.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 15 Mar 2023 16:51:23 +0000 (16:51 +0000)]
file: Mark files as executable
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 15 Mar 2023 16:43:36 +0000 (16:43 +0000)]
file: Rename extension check to patterns
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 15 Mar 2023 16:33:18 +0000 (16:33 +0000)]
file: Do not check for SSP for runtime linkers
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 15 Mar 2023 13:28:46 +0000 (13:28 +0000)]
python: Release and acquire the GIL when we need it
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 15 Mar 2023 11:31:07 +0000 (11:31 +0000)]
build: Dump the complete filelist
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 15 Mar 2023 11:30:41 +0000 (11:30 +0000)]
compress: Resolve hardlinks when writing archives
Fixes: #13014
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 15 Mar 2023 10:48:20 +0000 (10:48 +0000)]
file: Correctly fail PIE test
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 15 Mar 2023 03:01:46 +0000 (03:01 +0000)]
build: Show build time at the end
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 15 Mar 2023 03:01:30 +0000 (03:01 +0000)]
string: Add function to format elapsed time
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 14 Mar 2023 18:57:01 +0000 (18:57 +0000)]
file: Perform magic check for all files
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 14 Mar 2023 18:56:20 +0000 (18:56 +0000)]
file: Skip hardening checks for firmware files
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 14 Mar 2023 18:55:32 +0000 (18:55 +0000)]
CFLAGS: Move string formatting stuff into an extra variable
That way, we can clear it easily.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 13 Mar 2023 16:52:44 +0000 (16:52 +0000)]
file: Disable all hardening checks for Relocatable Objects
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 13 Mar 2023 15:34:08 +0000 (15:34 +0000)]
file: Skip SSP check for data libraries
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 11 Mar 2023 16:24:08 +0000 (16:24 +0000)]
build: Implement marking configuration files in archives
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 11 Mar 2023 15:21:59 +0000 (15:21 +0000)]
file: Fix digest comment
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 11 Mar 2023 15:21:45 +0000 (15:21 +0000)]
file: Add missing return type
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 11 Mar 2023 15:16:57 +0000 (15:16 +0000)]
archive: Store MIME type of files
This is going to be helpful in the build service and generally some
useful metadata.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 11 Mar 2023 15:14:27 +0000 (15:14 +0000)]
files: Fix iterating over extended attributes
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 11 Mar 2023 14:07:09 +0000 (14:07 +0000)]
build: Check if ELF files contain debug information
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 11 Mar 2023 13:23:04 +0000 (13:23 +0000)]
file: Show error when the hardening check fails
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 11 Mar 2023 13:20:41 +0000 (13:20 +0000)]
file: Show error when a file has no symbol table
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 11 Mar 2023 13:20:04 +0000 (13:20 +0000)]
file: Show tags for failed execstack/partly RELRO check
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 10 Mar 2023 16:34:48 +0000 (16:34 +0000)]
archive: Be more efficient when reading single files
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 10 Mar 2023 16:25:54 +0000 (16:25 +0000)]
archive: Fix reading files from archives
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 10 Mar 2023 16:10:02 +0000 (16:10 +0000)]
compress: Swap PAKFIRE_WALK_DONE and *_END for semantic reasons
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 10 Mar 2023 15:59:53 +0000 (15:59 +0000)]
archive: Fix reading filelists/extraction on newer formats
Fixes: #12995 - pakfire extracts meta files in archives
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 10 Mar 2023 15:17:38 +0000 (15:17 +0000)]
archive: Drop support for legacy package formats
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 10 Mar 2023 09:31:23 +0000 (09:31 +0000)]
archive: Fix progress bar on extraction
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 10 Mar 2023 14:58:54 +0000 (14:58 +0000)]
macros: Use CET on x86_64
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 10 Mar 2023 14:58:35 +0000 (14:58 +0000)]
macros: Enable libstcd++ assertions
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 10 Mar 2023 09:27:11 +0000 (09:27 +0000)]
hub: Change how we append arguments to the request
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 9 Mar 2023 14:13:33 +0000 (14:13 +0000)]
daemon: Do not send DEBUG messages to the build service and log file
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 9 Mar 2023 20:34:58 +0000 (20:34 +0000)]
repositories: Refactor how we are reading metadata
This is a large rewrite of how we are discovering and reading any
repository metadata.
It first of all makes the code a little bit more straight forward by
breaking steps into their own function.
Those functions will now do "the right thing" depending whether we are
dealing with a local or remote repository and will try to read
repository metdata for local repositories, too.
If that fails, we will of course fall back and scan.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 9 Mar 2023 18:39:56 +0000 (18:39 +0000)]
pakfire: Allow setting a custom cache path through the configuration
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 9 Mar 2023 18:39:31 +0000 (18:39 +0000)]
downloader: Read proxy settings from the general section
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 9 Mar 2023 15:34:35 +0000 (15:34 +0000)]
repo: compose: Ensure that the destination path always exists
realpath() fails if the destination does not exist, so we will try to
create it before.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 9 Mar 2023 13:43:51 +0000 (13:43 +0000)]
repo: Store the real path on stack to avoid it being altered later
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 9 Mar 2023 13:33:12 +0000 (13:33 +0000)]
repos: Try to hardlink packages when possible
Since we no longer change any packages when composing a repository (no
embedded signatures), we can try to hardlink to save disk space and IO.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 9 Mar 2023 13:30:47 +0000 (13:30 +0000)]
repo: Handle relative paths on compose
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 9 Mar 2023 13:14:52 +0000 (13:14 +0000)]
file: Check files for being RELRO
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 7 Mar 2023 11:40:42 +0000 (11:40 +0000)]
file: Check if ELF files have an executable stack
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 7 Mar 2023 11:05:00 +0000 (11:05 +0000)]
build: Refactor hardening checks
Instead of calling many different checks, this will now check once
and store any issues that have been identified.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 8 Mar 2023 11:48:18 +0000 (11:48 +0000)]
repo: Compress the SOLV database using Zstandard
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 8 Mar 2023 11:46:16 +0000 (11:46 +0000)]
repo: Ensure to close the file descriptor after reading the database
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 9 Mar 2023 11:12:04 +0000 (11:12 +0000)]
CFLAGS: Use -fstack-protector-all over -strong
Although -fstack-protector-strong will omit inserting any canary checks
on functions that cannot possibly overflow their stack, we will need all
functions to be protected in order to run our check.
It is more benefitial to us to have the check than optimise for
performance. We also expect LTO to inline all those functions that
possibly do not have a stack.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 9 Mar 2023 10:14:40 +0000 (10:14 +0000)]
IPFire 3: Disable all repositories for now except Bootstrap
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Wed, 8 Mar 2023 11:13:04 +0000 (11:13 +0000)]
archive: Make sure the destination directory exists when copying
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 5 Mar 2023 17:13:07 +0000 (17:13 +0000)]
build: Check if binaries have been built with -fPIC
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 5 Mar 2023 16:33:10 +0000 (16:33 +0000)]
archive: Set download size for new format packages
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 5 Mar 2023 16:02:08 +0000 (16:02 +0000)]
archive: Improve importing filelists from JSON
We no longer build a completely filelist object that is being destroyed
very quickly again. The paths are being sent directly to the package.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 5 Mar 2023 15:48:20 +0000 (15:48 +0000)]
build: Move SSP check into the build process
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 5 Mar 2023 15:41:13 +0000 (15:41 +0000)]
file: Check if files are in ELF format
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 5 Mar 2023 14:10:14 +0000 (14:10 +0000)]
build: Reuse function to walk through the package filelist
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 5 Mar 2023 13:43:23 +0000 (13:43 +0000)]
build: Move checking for broken symlinks into C
Fixes: #13057 - Broken symlink check seems to fail if spaces are in filename
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 5 Mar 2023 13:40:39 +0000 (13:40 +0000)]
file: Use S_IFMT instead of AE_IFMT
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 5 Mar 2023 13:40:05 +0000 (13:40 +0000)]
file: Append symlink target to dump
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 4 Mar 2023 15:04:54 +0000 (15:04 +0000)]
macros: Don't install logrotate files
logrotate has been dropped
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 4 Mar 2023 14:46:32 +0000 (14:46 +0000)]
macros: Don't run MACRO_FIX_AUTOTOOLS all the time any more
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 4 Mar 2023 14:44:51 +0000 (14:44 +0000)]
macros: Fix update config.guess/config.sub macro
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 4 Mar 2023 11:44:59 +0000 (11:44 +0000)]
build: Delete static libraries only when there is a shared object
This brings back the former behaviour.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 28 Feb 2023 17:15:02 +0000 (17:15 +0000)]
packagelist: Refactor the whole thing
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 28 Feb 2023 16:59:23 +0000 (16:59 +0000)]
CLI: requires: Search for all reverse dependencies
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 28 Feb 2023 15:53:15 +0000 (15:53 +0000)]
search: Consolidate using Dataiterator and add file search
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 28 Feb 2023 15:00:46 +0000 (15:00 +0000)]
pakfire_whatprovides/requires: Write to an existant list
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>