]> git.ipfire.org Git - pakfire.git/log
pakfire.git
2 years agofile: Rename NO-* flags to MISSING-*
Michael Tremer [Fri, 17 Mar 2023 15:30:01 +0000 (15:30 +0000)] 
file: Rename NO-* flags to MISSING-*

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agobuild: Do not perform BUILDROOT check on Python bytecode files
Michael Tremer [Fri, 17 Mar 2023 15:00:51 +0000 (15:00 +0000)] 
build: Do not perform BUILDROOT check on Python bytecode files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofilelist: Add option to show a progressbar
Michael Tremer [Fri, 17 Mar 2023 14:56:28 +0000 (14:56 +0000)] 
filelist: Add option to show a progressbar

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofilelist: Add flags argument to walk function
Michael Tremer [Fri, 17 Mar 2023 14:33:30 +0000 (14:33 +0000)] 
filelist: Add flags argument to walk function

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Perform world writable check only for regular files
Michael Tremer [Fri, 17 Mar 2023 14:29:12 +0000 (14:29 +0000)] 
FHS: Perform world writable check only for regular files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agomacros: Define tmpfilesdir
Michael Tremer [Fri, 17 Mar 2023 14:09:11 +0000 (14:09 +0000)] 
macros: Define tmpfilesdir

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Add /root
Michael Tremer [Fri, 17 Mar 2023 14:02:50 +0000 (14:02 +0000)] 
FHS: Add /root

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Set r if file could not be opened
Michael Tremer [Fri, 17 Mar 2023 14:00:08 +0000 (14:00 +0000)] 
file: Set r if file could not be opened

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofiles: Skip payload check for empty files
Michael Tremer [Fri, 17 Mar 2023 13:59:39 +0000 (13:59 +0000)] 
files: Skip payload check for empty files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Do not check for ELF status again when dumping issues
Michael Tremer [Fri, 17 Mar 2023 13:57:33 +0000 (13:57 +0000)] 
file: Do not check for ELF status again when dumping issues

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agobuild: Move strip check into file check
Michael Tremer [Fri, 17 Mar 2023 13:56:40 +0000 (13:56 +0000)] 
build: Move strip check into file check

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agobuild: Rename hardening check to just check
Michael Tremer [Fri, 17 Mar 2023 13:46:50 +0000 (13:46 +0000)] 
build: Rename hardening check to just check

That way, we can include some checks that are not too closely related to
any hardening issues.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agobuild: Move FHS check into hardening checks
Michael Tremer [Fri, 17 Mar 2023 13:41:55 +0000 (13:41 +0000)] 
build: Move FHS check into hardening checks

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Check for world-writable files
Michael Tremer [Fri, 17 Mar 2023 13:29:52 +0000 (13:29 +0000)] 
FHS: Check for world-writable files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoutil: Fix path pattern matching with characters after stars
Michael Tremer [Fri, 17 Mar 2023 13:24:47 +0000 (13:24 +0000)] 
util: Fix path pattern matching with characters after stars

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Remove forgotten debug statements
Michael Tremer [Fri, 17 Mar 2023 13:14:39 +0000 (13:14 +0000)] 
file: Remove forgotten debug statements

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agobuild: Perform BUILDROOT check in C
Michael Tremer [Fri, 17 Mar 2023 13:05:21 +0000 (13:05 +0000)] 
build: Perform BUILDROOT check in C

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Check for correct location and permission of shared objects
Michael Tremer [Fri, 17 Mar 2023 12:17:31 +0000 (12:17 +0000)] 
FHS: Check for correct location and permission of shared objects

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agotests: Add check for pakfire_path_match with stars in middle
Michael Tremer [Fri, 17 Mar 2023 12:13:53 +0000 (12:13 +0000)] 
tests: Add check for pakfire_path_match with stars in middle

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Fix indentation
Michael Tremer [Fri, 17 Mar 2023 12:03:03 +0000 (12:03 +0000)] 
FHS: Fix indentation

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Do not allow any executable files in /var
Michael Tremer [Fri, 17 Mar 2023 12:00:35 +0000 (12:00 +0000)] 
FHS: Do not allow any executable files in /var

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Do not allow any executable files in /usr/share
Michael Tremer [Fri, 17 Mar 2023 11:57:33 +0000 (11:57 +0000)] 
FHS: Do not allow any executable files in /usr/share

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: All files in /boot must be owned by root
Michael Tremer [Fri, 17 Mar 2023 11:56:59 +0000 (11:56 +0000)] 
FHS: All files in /boot must be owned by root

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Ensure that firmware files are not executable
Michael Tremer [Fri, 17 Mar 2023 11:46:30 +0000 (11:46 +0000)] 
FHS: Ensure that firmware files are not executable

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Rearrange the matrix
Michael Tremer [Fri, 17 Mar 2023 11:06:15 +0000 (11:06 +0000)] 
FHS: Rearrange the matrix

No functional changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agobuild: Drop check-include
Michael Tremer [Fri, 17 Mar 2023 10:54:40 +0000 (10:54 +0000)] 
build: Drop check-include

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Check permissions of files in /usr/include
Michael Tremer [Fri, 17 Mar 2023 10:53:50 +0000 (10:53 +0000)] 
FHS: Check permissions of files in /usr/include

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Do not allow any unknown subdirectories in /var
Michael Tremer [Fri, 17 Mar 2023 10:53:13 +0000 (10:53 +0000)] 
FHS: Do not allow any unknown subdirectories in /var

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Enfore that all files in /usr/*bin are executable
Michael Tremer [Fri, 17 Mar 2023 10:49:21 +0000 (10:49 +0000)] 
FHS: Enfore that all files in /usr/*bin are executable

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Do not allow any subdirectories in /usr/bin & /usr/sbin
Michael Tremer [Fri, 17 Mar 2023 10:40:33 +0000 (10:40 +0000)] 
FHS: Do not allow any subdirectories in /usr/bin & /usr/sbin

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Implement being able to check for file type
Michael Tremer [Fri, 17 Mar 2023 10:37:25 +0000 (10:37 +0000)] 
FHS: Implement being able to check for file type

This allows us a more granular filtering

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Do not allow any more files in /usr and /usr/src
Michael Tremer [Fri, 17 Mar 2023 10:23:51 +0000 (10:23 +0000)] 
FHS: Do not allow any more files in /usr and /usr/src

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Implement checking file ownerships
Michael Tremer [Fri, 17 Mar 2023 10:18:06 +0000 (10:18 +0000)] 
FHS: Implement checking file ownerships

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agobuild: Drop check-libraries script
Michael Tremer [Fri, 17 Mar 2023 10:05:26 +0000 (10:05 +0000)] 
build: Drop check-libraries script

This is now covered by the new builtin FHS check.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agobuild: Drop old FHS script
Michael Tremer [Fri, 17 Mar 2023 10:03:36 +0000 (10:03 +0000)] 
build: Drop old FHS script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoFHS: Implement some simple filesystem checks
Michael Tremer [Fri, 17 Mar 2023 10:00:59 +0000 (10:00 +0000)] 
FHS: Implement some simple filesystem checks

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoutil: path_matches: Check if pattern is shorter than string
Michael Tremer [Thu, 16 Mar 2023 19:27:28 +0000 (19:27 +0000)] 
util: path_matches: Check if pattern is shorter than string

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoutil: Implement a simple path matching function that supports **
Michael Tremer [Thu, 16 Mar 2023 15:54:51 +0000 (15:54 +0000)] 
util: Implement a simple path matching function that supports **

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoarch: Drop support for all 32 bit architectures
Michael Tremer [Thu, 16 Mar 2023 10:27:19 +0000 (10:27 +0000)] 
arch: Drop support for all 32 bit architectures

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agocompress: Fix wrong variable in threads code
Michael Tremer [Thu, 16 Mar 2023 09:10:00 +0000 (09:10 +0000)] 
compress: Fix wrong variable in threads code

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agopackager: Don't initialize an unsigned integer with -1
Michael Tremer [Thu, 16 Mar 2023 09:05:44 +0000 (09:05 +0000)] 
packager: Don't initialize an unsigned integer with -1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agocompress: Enable parallel compression for Zstandard if available
Michael Tremer [Thu, 16 Mar 2023 09:04:33 +0000 (09:04 +0000)] 
compress: Enable parallel compression for Zstandard if available

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agocompress: Create a unified function to create archives
Michael Tremer [Thu, 16 Mar 2023 09:04:04 +0000 (09:04 +0000)] 
compress: Create a unified function to create archives

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agosnapshots: Call it store/restore
Michael Tremer [Thu, 16 Mar 2023 08:11:23 +0000 (08:11 +0000)] 
snapshots: Call it store/restore

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agosnapshots: Do not modify an existing snapshot
Michael Tremer [Thu, 16 Mar 2023 08:07:57 +0000 (08:07 +0000)] 
snapshots: Do not modify an existing snapshot

Instead, the routines will now write the new snapshot to a temporary
location and replace it more or less atomically.

Fixes: #13045 - Multiple concurrent instances can destroy the snapshot
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoRevert "snapshots: Pass path instead of file descriptor"
Michael Tremer [Wed, 15 Mar 2023 18:48:55 +0000 (18:48 +0000)] 
Revert "snapshots: Pass path instead of file descriptor"

This reverts commit 4667a2ca811f6f2b20c1cfb3223dd8b90af4952c.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agocompress: Do not overwrite configuration on extraction
Michael Tremer [Wed, 15 Mar 2023 18:40:49 +0000 (18:40 +0000)] 
compress: Do not overwrite configuration on extraction

This is somewhat experimental and I would need to think a little bit
more about this.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agojail: Enable all QEMU CPU features by default
Michael Tremer [Wed, 15 Mar 2023 18:29:42 +0000 (18:29 +0000)] 
jail: Enable all QEMU CPU features by default

When we are emulating a different architecture, QEMU by default emulates
a very basic processor which might not be able to emulate for example
SIMD instructions.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Mark files as executable
Michael Tremer [Wed, 15 Mar 2023 16:51:23 +0000 (16:51 +0000)] 
file: Mark files as executable

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Rename extension check to patterns
Michael Tremer [Wed, 15 Mar 2023 16:43:36 +0000 (16:43 +0000)] 
file: Rename extension check to patterns

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Do not check for SSP for runtime linkers
Michael Tremer [Wed, 15 Mar 2023 16:33:18 +0000 (16:33 +0000)] 
file: Do not check for SSP for runtime linkers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agopython: Release and acquire the GIL when we need it
Michael Tremer [Wed, 15 Mar 2023 13:28:46 +0000 (13:28 +0000)] 
python: Release and acquire the GIL when we need it

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agobuild: Dump the complete filelist
Michael Tremer [Wed, 15 Mar 2023 11:31:07 +0000 (11:31 +0000)] 
build: Dump the complete filelist

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agocompress: Resolve hardlinks when writing archives
Michael Tremer [Wed, 15 Mar 2023 11:30:41 +0000 (11:30 +0000)] 
compress: Resolve hardlinks when writing archives

Fixes: #13014
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Correctly fail PIE test
Michael Tremer [Wed, 15 Mar 2023 10:48:20 +0000 (10:48 +0000)] 
file: Correctly fail PIE test

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agobuild: Show build time at the end
Michael Tremer [Wed, 15 Mar 2023 03:01:46 +0000 (03:01 +0000)] 
build: Show build time at the end

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agostring: Add function to format elapsed time
Michael Tremer [Wed, 15 Mar 2023 03:01:30 +0000 (03:01 +0000)] 
string: Add function to format elapsed time

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Perform magic check for all files
Michael Tremer [Tue, 14 Mar 2023 18:57:01 +0000 (18:57 +0000)] 
file: Perform magic check for all files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Skip hardening checks for firmware files
Michael Tremer [Tue, 14 Mar 2023 18:56:20 +0000 (18:56 +0000)] 
file: Skip hardening checks for firmware files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoCFLAGS: Move string formatting stuff into an extra variable
Michael Tremer [Tue, 14 Mar 2023 18:55:32 +0000 (18:55 +0000)] 
CFLAGS: Move string formatting stuff into an extra variable

That way, we can clear it easily.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Disable all hardening checks for Relocatable Objects
Michael Tremer [Mon, 13 Mar 2023 16:52:44 +0000 (16:52 +0000)] 
file: Disable all hardening checks for Relocatable Objects

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Skip SSP check for data libraries
Michael Tremer [Mon, 13 Mar 2023 15:34:08 +0000 (15:34 +0000)] 
file: Skip SSP check for data libraries

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agobuild: Implement marking configuration files in archives
Michael Tremer [Sat, 11 Mar 2023 16:24:08 +0000 (16:24 +0000)] 
build: Implement marking configuration files in archives

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Fix digest comment
Michael Tremer [Sat, 11 Mar 2023 15:21:59 +0000 (15:21 +0000)] 
file: Fix digest comment

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Add missing return type
Michael Tremer [Sat, 11 Mar 2023 15:21:45 +0000 (15:21 +0000)] 
file: Add missing return type

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoarchive: Store MIME type of files
Michael Tremer [Sat, 11 Mar 2023 15:16:57 +0000 (15:16 +0000)] 
archive: Store MIME type of files

This is going to be helpful in the build service and generally some
useful metadata.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofiles: Fix iterating over extended attributes
Michael Tremer [Sat, 11 Mar 2023 15:14:27 +0000 (15:14 +0000)] 
files: Fix iterating over extended attributes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agobuild: Check if ELF files contain debug information
Michael Tremer [Sat, 11 Mar 2023 14:07:09 +0000 (14:07 +0000)] 
build: Check if ELF files contain debug information

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Show error when the hardening check fails
Michael Tremer [Sat, 11 Mar 2023 13:23:04 +0000 (13:23 +0000)] 
file: Show error when the hardening check fails

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Show error when a file has no symbol table
Michael Tremer [Sat, 11 Mar 2023 13:20:41 +0000 (13:20 +0000)] 
file: Show error when a file has no symbol table

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Show tags for failed execstack/partly RELRO check
Michael Tremer [Sat, 11 Mar 2023 13:20:04 +0000 (13:20 +0000)] 
file: Show tags for failed execstack/partly RELRO check

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoarchive: Be more efficient when reading single files
Michael Tremer [Fri, 10 Mar 2023 16:34:48 +0000 (16:34 +0000)] 
archive: Be more efficient when reading single files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoarchive: Fix reading files from archives
Michael Tremer [Fri, 10 Mar 2023 16:25:54 +0000 (16:25 +0000)] 
archive: Fix reading files from archives

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agocompress: Swap PAKFIRE_WALK_DONE and *_END for semantic reasons
Michael Tremer [Fri, 10 Mar 2023 16:10:02 +0000 (16:10 +0000)] 
compress: Swap PAKFIRE_WALK_DONE and *_END for semantic reasons

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoarchive: Fix reading filelists/extraction on newer formats
Michael Tremer [Fri, 10 Mar 2023 15:59:53 +0000 (15:59 +0000)] 
archive: Fix reading filelists/extraction on newer formats

Fixes: #12995 - pakfire extracts meta files in archives
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoarchive: Drop support for legacy package formats
Michael Tremer [Fri, 10 Mar 2023 15:17:38 +0000 (15:17 +0000)] 
archive: Drop support for legacy package formats

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoarchive: Fix progress bar on extraction
Michael Tremer [Fri, 10 Mar 2023 09:31:23 +0000 (09:31 +0000)] 
archive: Fix progress bar on extraction

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agomacros: Use CET on x86_64
Michael Tremer [Fri, 10 Mar 2023 14:58:54 +0000 (14:58 +0000)] 
macros: Use CET on x86_64

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agomacros: Enable libstcd++ assertions
Michael Tremer [Fri, 10 Mar 2023 14:58:35 +0000 (14:58 +0000)] 
macros: Enable libstcd++ assertions

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agohub: Change how we append arguments to the request
Michael Tremer [Fri, 10 Mar 2023 09:27:11 +0000 (09:27 +0000)] 
hub: Change how we append arguments to the request

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agodaemon: Do not send DEBUG messages to the build service and log file
Michael Tremer [Thu, 9 Mar 2023 14:13:33 +0000 (14:13 +0000)] 
daemon: Do not send DEBUG messages to the build service and log file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agorepositories: Refactor how we are reading metadata
Michael Tremer [Thu, 9 Mar 2023 20:34:58 +0000 (20:34 +0000)] 
repositories: Refactor how we are reading metadata

This is a large rewrite of how we are discovering and reading any
repository metadata.

It first of all makes the code a little bit more straight forward by
breaking steps into their own function.

Those functions will now do "the right thing" depending whether we are
dealing with a local or remote repository and will try to read
repository metdata for local repositories, too.

If that fails, we will of course fall back and scan.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agopakfire: Allow setting a custom cache path through the configuration
Michael Tremer [Thu, 9 Mar 2023 18:39:56 +0000 (18:39 +0000)] 
pakfire: Allow setting a custom cache path through the configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agodownloader: Read proxy settings from the general section
Michael Tremer [Thu, 9 Mar 2023 18:39:31 +0000 (18:39 +0000)] 
downloader: Read proxy settings from the general section

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agorepo: compose: Ensure that the destination path always exists
Michael Tremer [Thu, 9 Mar 2023 15:34:35 +0000 (15:34 +0000)] 
repo: compose: Ensure that the destination path always exists

realpath() fails if the destination does not exist, so we will try to
create it before.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agorepo: Store the real path on stack to avoid it being altered later
Michael Tremer [Thu, 9 Mar 2023 13:43:51 +0000 (13:43 +0000)] 
repo: Store the real path on stack to avoid it being altered later

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agorepos: Try to hardlink packages when possible
Michael Tremer [Thu, 9 Mar 2023 13:33:12 +0000 (13:33 +0000)] 
repos: Try to hardlink packages when possible

Since we no longer change any packages when composing a repository (no
embedded signatures), we can try to hardlink to save disk space and IO.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agorepo: Handle relative paths on compose
Michael Tremer [Thu, 9 Mar 2023 13:30:47 +0000 (13:30 +0000)] 
repo: Handle relative paths on compose

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Check files for being RELRO
Michael Tremer [Thu, 9 Mar 2023 13:14:52 +0000 (13:14 +0000)] 
file: Check files for being RELRO

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agofile: Check if ELF files have an executable stack
Michael Tremer [Tue, 7 Mar 2023 11:40:42 +0000 (11:40 +0000)] 
file: Check if ELF files have an executable stack

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agobuild: Refactor hardening checks
Michael Tremer [Tue, 7 Mar 2023 11:05:00 +0000 (11:05 +0000)] 
build: Refactor hardening checks

Instead of calling many different checks, this will now check once
and store any issues that have been identified.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agorepo: Compress the SOLV database using Zstandard
Michael Tremer [Wed, 8 Mar 2023 11:48:18 +0000 (11:48 +0000)] 
repo: Compress the SOLV database using Zstandard

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agorepo: Ensure to close the file descriptor after reading the database
Michael Tremer [Wed, 8 Mar 2023 11:46:16 +0000 (11:46 +0000)] 
repo: Ensure to close the file descriptor after reading the database

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoCFLAGS: Use -fstack-protector-all over -strong
Michael Tremer [Thu, 9 Mar 2023 11:12:04 +0000 (11:12 +0000)] 
CFLAGS: Use -fstack-protector-all over -strong

Although -fstack-protector-strong will omit inserting any canary checks
on functions that cannot possibly overflow their stack, we will need all
functions to be protected in order to run our check.

It is more benefitial to us to have the check than optimise for
performance. We also expect LTO to inline all those functions that
possibly do not have a stack.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoIPFire 3: Disable all repositories for now except Bootstrap
Michael Tremer [Thu, 9 Mar 2023 10:14:40 +0000 (10:14 +0000)] 
IPFire 3: Disable all repositories for now except Bootstrap

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoarchive: Make sure the destination directory exists when copying
Michael Tremer [Wed, 8 Mar 2023 11:13:04 +0000 (11:13 +0000)] 
archive: Make sure the destination directory exists when copying

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agobuild: Check if binaries have been built with -fPIC
Michael Tremer [Sun, 5 Mar 2023 17:13:07 +0000 (17:13 +0000)] 
build: Check if binaries have been built with -fPIC

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoarchive: Set download size for new format packages
Michael Tremer [Sun, 5 Mar 2023 16:33:10 +0000 (16:33 +0000)] 
archive: Set download size for new format packages

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoarchive: Improve importing filelists from JSON
Michael Tremer [Sun, 5 Mar 2023 16:02:08 +0000 (16:02 +0000)] 
archive: Improve importing filelists from JSON

We no longer build a completely filelist object that is being destroyed
very quickly again. The paths are being sent directly to the package.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agobuild: Move SSP check into the build process
Michael Tremer [Sun, 5 Mar 2023 15:48:20 +0000 (15:48 +0000)] 
build: Move SSP check into the build process

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>