Michael Gehring
52d3077206
bin/xbps-checkvers: avoid infinite loops when checking reverts
2017-07-16 20:08:25 +00:00
Michael Gehring
a2aec39d74
lib/package_unpack.c: refuse to unpack to absolute paths
2017-07-13 17:17:12 +00:00
Michael Gehring
63596b5a06
xbps-remove.1: fix invalid escape
2017-07-11 04:30:23 +02:00
Michael Gehring
0886012d72
xbps-reconfigure.1: fix invalid escape
2017-07-11 04:30:03 +02:00
Michael Gehring
25418f98af
xbps-query.1: fix invalid escape
2017-07-11 04:29:45 +02:00
Michael Gehring
a61fd5f8c1
xbps-pkgdb.1: fix invalid escape
2017-07-11 04:29:19 +02:00
Michael Gehring
b9656b1546
xbps-install.1: fix invalid escape
2017-07-11 04:28:57 +02:00
Michael Gehring
681acd08ef
xbps-dgraph.1: fix invalid escape
2017-07-11 04:28:34 +02:00
Michael Gehring
ae3f5546bf
xbps-checkvers.1: fix invalid escape
2017-07-11 04:28:13 +02:00
Michael Gehring
13a38fa6ba
xbps-alternatives.1: fix invalid escape
2017-07-11 04:27:51 +02:00
Michael Gehring
cdb5bcdd0c
xbps.d.5: fix invalid escape
2017-07-11 04:01:38 +02:00
Michael Gehring
4aae026615
lib/package_unpack.c: verify signed pkgver matches
...
$ARCH-repodata is currently not protected by a signature. While most of
the package metadata is also embedded into the .xbps files, which are
protected by a signature, xbps-install ignores it
(https://github.com/voidlinux/xbps/blob/1670ff000d1cc8b073dd93542e16b9c1c496bb9a/lib/package_unpack.c#L123 )
and relies entirely on $ARCH-repodata.
This enables anyone who is able to modify the $ARCH-repodata to
substitute packages. This patch adds a check that verifies the signed
pkgver matches the one in the repodata, so at least downgrades posing as
updates are detected.
This is an incomplete fix as the whole transaction is still set up with
the unsigned repodata and other issues surely exist. The real fix is
signing $ARCH-repodata.
2017-07-09 12:46:01 +00:00
Michael Gehring
5e4f445b90
bin/xbps-rindex: use xbps_file_hash_raw while signing
...
Fixes #243
2017-06-27 20:05:15 +02:00
Michael Gehring
2984d6a5ec
bin/xbps-install/fetch_cb.c: flush stdout when printing progress
2016-10-05 20:18:43 +02:00
Michael Gehring
3dce6ab1ed
bin/xbps-query: add --list-repolock-pkgs
2016-09-21 14:11:04 +02:00
Michael Gehring
3a1892028a
xbps-checkvers: fix build with glibc-2.24 ( #188 )
2016-08-15 12:44:25 +02:00
Michael Gehring
46744c412d
lib/fetch/common.c: fix build with -Werror=misleading-indentation
...
Fixes #179
2016-06-03 20:26:52 +02:00
Michael Gehring
2d6e865d00
lib/repo: plug stage repo mem leak
2016-05-04 09:46:14 +02:00
Michael Gehring
793de8399c
lib: dont call EVP_cleanup in fp2str
...
Calling EVP_cleanup here undoes initialization already done in
lib/fetch/common.c ssl_init() causing subsequent attempts to call
SSL_CTX_new() to fail. Which ultimately is the root cause for #170 .
Fixes #170
2016-04-24 16:40:25 +02:00
Michael Gehring
dedc93d17d
xbps-create: add -c/--changelog
2016-04-23 08:42:15 +02:00
Michael Gehring
530149d90d
lib/portableproplib: fix various oob reads/segfaults
...
Applies the following patches from NetBSD:
http://cvsweb.netbsd.org/bsdweb.cgi/src/common/lib/libprop/prop_object.c?rev=1.30&content-type=text/x-cvsweb-markup
http://cvsweb.netbsd.org/bsdweb.cgi/src/common/lib/libprop/prop_object_impl.h?rev=1.31.12.1&content-type=text/x-cvsweb-markup
2016-04-07 15:07:11 +02:00
Michael Gehring
51511231bf
lib/repo.c: fix potential null pointer deref
2016-04-07 02:15:49 +02:00
Michael Gehring
604499d6f2
contributors: fix typo
2016-02-08 15:10:07 +01:00
Michael Gehring
3bfc7b5e6d
alternatives: fix dirname() buffer reuse
2016-02-08 15:10:07 +01:00
Michael Gehring
ab0d5c847d
libxbps: define _WITH_GETLINE for FreeBSD
2016-02-08 15:09:58 +01:00
Michael Gehring
618e504d30
actually use HAVE_FDATASYNC
2016-02-08 15:09:43 +01:00
Michael Gehring
0f56b68eac
add HAVE_STRNSTR
2016-02-08 15:09:33 +01:00
Michael Gehring