summaryrefslogtreecommitdiff
path: root/dpkg-deb
AgeCommit message (Collapse)AuthorFilesLines
2019-11-26Merge https://salsa.debian.org/dpkg-team/dpkgIgor Pashev5-20/+26
2019-10-30libdpkg: Add new C locale switch over supportGuillem Jover1-0/+1
This will make it possible to select either the current locale or a specified one, currently only C is selectable. We use this because the uselocale(3) POSIX API is recent, and the system might not have it available, so we might need to fallback to use setlocale(3) instead, which even though is not thread-safe, it's better than nothing.
2019-10-30dpkg-deb: Fold two adjacent if conditionals into a single oneGuillem Jover1-1/+2
Warned-by: cppcheck
2019-06-03dpkg-deb: Honor --nocheck when building packages with newlines in filenamesGuillem Jover1-1/+1
Fixes: commit 438db7a31e074691e70e8ace7fff91631030624b Closes: #929727 Stable-Candidate: 1.18.x
2019-06-03dpkg-deb: Validate ar member magic before normalizing any of its fieldsGuillem Jover1-2/+3
If the header is not valid, we should not try to normalize or even consider it is in any sane state.
2018-08-30libdpkg: Split push_cleanup() into push_cleanup_fallback()Guillem Jover1-1/+1
We separate the function in one that takes one callback, and another that takes two. This simplifies most of the call sites which only need one callback.
2018-08-30libdpkg: Rename struct pkginfo files member to archivesGuillem Jover1-2/+2
Rename matching types and macros, so that the purpose of the symbols is clear, and to open the way for moving the fsys files list from the dpkg clientdata.
2018-08-01dpkg-deb: Surround condition in ternary operator with parensGuillem Jover1-1/+2
This makes it extra clear the precedence of the operators. Warned-by: cppcheck
2018-03-25build: Enable clang -Wdocumentation warning if availableGuillem Jover1-4/+4
Fix a couple of function parameter typos surfaced by the new warning. Warned-by: clang
2018-01-16dpkg-deb: Fix directory traversal with --raw-extractGuillem Jover2-8/+10
Guarantee that the DEBIAN pathname does not exist. Closes: #879982 Reported-by: Jakub Wilk <jwilk@jwilk.net>
2017-11-19Fix crashIgor Pashev1-3/+2
2017-11-19Merge git://anonscm.debian.org/dpkg/dpkgIgor Pashev6-235/+241
2017-10-17dpkg-deb: Fix capitalization of Debian in output messagesGuillem Jover1-4/+4
Here Debian refers to the distribution and in English this needs to be capitalized. No translation will be unfuzzed, as the capitalization rules change among locales. Warned-by: spellintian
2017-10-16dpkg-deb: Make --uniform-compression the new default behaviorGuillem Jover1-2/+3
Add support for negating the option via --no-uniform-compression.
2017-09-24dpkg-deb: Add support for rootless buildsGuillem Jover3-0/+9
This sets the control member entries always to root:root, and makes it possible to do the same for the data member entries via the new --root-onwer-group option. Closes: #291320 Based-on-patch-by: Niels Thykier <niels@thykier.net> Signed-off-by: Guillem Jover <guillem@debian.org>
2017-09-24dpkg-deb: Refactor tarball_pack options into a new structGuillem Jover1-6/+16
2017-09-24dpkg-deb: Sanity check config maintainer script file type and permissionsGuillem Jover1-0/+1
This is a well-known executable maintainer script, that ideally should be handled by dpkg itself. But for now we will at least sanity check its file type and permissions.
2017-05-06doc: Spelling fixesJosh Soref1-1/+1
Signed-off-by: Guillem Jover <guillem@debian.org>
2016-10-30libdpkg: Use our own dpkg_ar_hdr instead of relying on the system oneGuillem Jover1-1/+1
The ar format is not standardized and some systems might provide a different format than the one used by dpkg. For example on AIX.
2016-10-30Cast off_t variables to intmax_t when printing them with %jdGuillem Jover1-1/+1
Warned-by: clang
2016-10-30dpkg-deb: Generate reproducible file modes for the .deb control memberGuillem Jover1-8/+14
Closes: #787980
2016-10-30dpkg-deb: Remove obsolete --old and --new optionsGuillem Jover1-22/+0
2016-10-30dpkg-deb: Obsolete bzip2 and lzma compression methodsGuillem Jover1-3/+3
2016-07-31dpkg-deb: Fix typo in code commentGuillem Jover1-1/+1
2016-07-03build: Uniformize library build optionsGuillem Jover1-2/+2
Make all of them consistently follow the pattern --with-lib<name>. Rename the m4 macros, preprocessor defines, and automake _LIBS flags.
2016-07-03dpkg-deb: Set ar timestamp and tar mtime clamping to SOURCE_DATE_EPOCHGuillem Jover1-1/+20
The ar and tar file entries contain a timestamp which is usually filled with the current build time and the file mtime respectively. This causes the generated deb(5) packages to not be reproducible for the same source package and same build environment. We now check if the environment variable SOURCE_DATE_EPOCH is defined, parse that and use it as the timestamp for ar and to clamp the mtime in the tar file entries. This variable is specified to contain the timestamp of the source release date in seconds since the epoch. Closes: #759999 Base-on-patch-by: Jérémy Bobbio <lunar@debian.org>
2016-07-03dpkg-deb: Use same timestamp for the ar container as for tar mtime clampingGuillem Jover1-0/+2
We use the same timestamp for all ar members, and the tarball mtime clamping for each tar file entry.
2016-07-03dpkg-deb: Use new GNU tar --clamp-mtime optionGuillem Jover1-3/+15
This will guarantee that no file in binary packages has an mtime later than the specified time. Which will be required to make binary packages reproducible. The option was officially added in GNU tar 1.29, but in Debian it was introduced as a vendor patch in 1.28, so on Debian we depend on the latter instead of the former version. Closes: #759886
2016-07-03libdpkg: Add new struct dpkg_ar and basic operationsGuillem Jover2-44/+35
Switch current code to use dpkg_ar instead of taking a filename and a file descriptor arguments.
2016-05-02dpkg-deb: Promote a print to a warning for missing control filesGuillem Jover1-1/+1
2016-05-02dpkg-deb: Use info() instead of plain printf()Guillem Jover1-3/+2
2016-04-01dpkg-deb, scripts: Make the Architecture field mandatory on package buildsGuillem Jover1-10/+5
We still accept source and binary packages with missing or empty Architecture fields, but when building either of these, we require the field to be present.
2016-02-27dpkg-deb: Use the treewalk module to build the .deb control memberGuillem Jover1-23/+25
We reduce external dependencies on commands, and get sorted file lists. Closes: #719845
2016-02-27dpkg-deb: Use the treewalk module to build the .deb data memberGuillem Jover1-65/+21
We reduce external dependencies on commands, avoid a read syscall per byte on the pipe, reduce code substantially, and get sorted file lists.
2015-12-19dpkg-deb: Fix off-by-one write access on ctrllenbuf variableHanno Böck1-1/+1
This affects old format .deb packages. Fixes: CVE-2015-0860 Warned-by: afl Signed-off-by: Guillem Jover <guillem@debian.org> Stable-Candidate: 1.16.x 1.17.x
2015-12-12Use new str_fmt() instead of m_asprintf()Guillem Jover3-11/+8
It should make the code more clear, and in many cases it avoids having to use a temporary variable.
2015-10-18dpkg-deb: Refactor tarball packing into a new functionGuillem Jover1-31/+56
2015-10-18dpkg-deb: Generate the control build dir just onceGuillem Jover1-17/+19
2015-10-18Update Ian Jackson's email addressGuillem Jover5-5/+5
2015-09-14dpkg-deb: Fix off-by-one write access on versionbuf variableGuillem Jover1-1/+1
Closes: #798324 Warned-by: afl Reported-by: Jacek Wielemborek <d33tah@gmail.com> Stable-Candidate: 1.16.x 1.17.x
2015-07-30dpkg-deb: Move tar option --no-recursion before -TRichard Purdie1-1/+1
With tar > 1.28 the --no-recursion option is now positional, and needs to be passed before the -T option, otherwise the tarball will end up with duplicated entries. Stable-Candidate: 1.16.x 1.17.x Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Guillem Jover <guillem@debian.org>
2015-07-16Merge git://anonscm.debian.org/dpkg/dpkgIgor Pashev4-94/+133
Conflicts: debian/changelog debian/dpkg.manpages lib/compat/strsignal.c scripts/Dpkg/Shlibs.pm
2015-05-30dpkg-deb: Set correct default compression value for control.tar.gz memberGuillem Jover1-0/+2
Regression introduced in commit f1f9887b8f96965d6046857d12fda24c053c6d4b. The compressor independent way to denote the default value has been to use -1, but that needs to be fixed up to the actual default value per compressor, before the compressor specific setup. When using the gzip command-line tool this is a fatal error as it does not recognize the argument «-c-1». When using the zlib shared library this makes the code always default to the compression level 1, as ‘-’ is ignored by gzdopen(). The current minimal fix is to call compressor_check_params() when setting up the default control.tar compressor paramaters, although that makes the API hard to use correctly. This will be improved in the future. Closes: #786654
2015-05-30libdpkg: Rename DPKG_VERSION_ARCH to PACKAGE_RELEASEGuillem Jover1-1/+1
This avoids confusing the project-wide macro with the DPKG_VERSION_ namespaced ones.
2015-05-19dpkg-deb, dpkg: Do not allow pathnames with embedded newlinesGuillem Jover1-0/+2
None of the deb toolchain supports embedded newlines in filenames, we could try to escape them but then we'd need to add support in other tools to unescape these too, and this does not sem worth the trouble. Closes: #720761
2015-04-21Remove some unnecessary includes of assert.hNiels Thykier2-2/+0
Signed-off-by: Niels Thykier <niels@thykier.net>
2015-04-21dpkg: Use badusage() instead of ohshit() for command-line errorsGuillem Jover1-2/+2
2015-04-18debian: Update my copyright yearsGuillem Jover2-1/+2
2015-04-10Consistently use proper quotation marks all over the placeGuillem Jover4-29/+30
That is "" or '', and not the unbalanced `' pair.
2015-04-01dpkg-deb: Use path_remove_tree() instead of direcly calling «rm -rf»Guillem Jover1-15/+1
generated by cgit v1.2.3 (git 2.39.1) at 2025-07-25 01:15:19 +0000