ci: try fix ext

Reviewed-on: artix/artools#96

.github/workflows/lint.yaml

@@ -0,0 +1,28 @@
+name: Artools shellcheck
+run-name: ${{ gitea.actor }}
+on:
+  push:
+    branches:
+      - ci
+    tags:
+      - 0.*
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout repo
+        uses: actions/checkout@main
+      - name: Run ShellCheck shell-linter
+        uses: azohra/shell-linter@latest
+        with:
+          path: "src/base/*.in,src/pkg/*.in,src/iso/*.in"
+          severity: "error"
+      - name: Run ShellCheck action-shellcheck
+        uses: ludeeus/action-shellcheck@master
+        env:
+          SHELLCHECK_OPTS: -x -s bash
+        with:
+          additional_files: "src/base/*.in*"
+          #scandir: 'src/base'
+

Makefile

@@ -1,6 +1,6 @@
 SHELL=/bin/bash
 
-V=0.31
+V=0.32
 BUILDTOOLVER ?= $(V)
 
 CHROOTVER=0.12
@@ -36,28 +36,6 @@ TOOLS_CONFIGS_BASE=$(wildcard config/conf/*base*)
 TOOLS_CONFIGS_PKG=$(wildcard config/conf/*pkg*)
 TOOLS_CONFIGS_ISO=$(wildcard config/conf/*iso*)
 
-LN_BUILDPKG = \
-	buildpkg-system-x86_64 \
-	buildpkg-system-gremlins-x86_64 \
-	buildpkg-system-goblins-x86_64 \
-	buildpkg-world-x86_64 \
-	buildpkg-world-gremlins-x86_64 \
-	buildpkg-world-goblins-x86_64 \
-	buildpkg-lib32-x86_64 \
-	buildpkg-lib32-gremlins-x86_64 \
-	buildpkg-lib32-goblins-x86_64 \
-	buildpkg-galaxy-x86_64 \
-	buildpkg-galaxy-gremlins-x86_64 \
-	buildpkg-galaxy-goblins-x86_64
-
-LN_BUILDISO = \
-	buildiso-world \
-	buildiso-world-gremlins \
-	buildiso-world-goblins \
-	buildiso-galaxy \
-	buildiso-galaxy-gremlins \
-	buildiso-galaxy-goblins
-
 all: binprogs_base binprogs_pkg binprogs_iso library_base library_pkg library_iso conf_base conf_pkg conf_iso
 binprogs_base: $(BINPROGS_BASE)
 binprogs_pkg: $(BINPROGS_PKG)
@@ -134,12 +112,8 @@ install_pkg: binprogs_pkg
 
 	for conf in $(notdir $(MAKEPKG_CONFIGS)); do install -Dm0644 $(BUILDDIR)/makepkg.conf.d/$$conf $(DESTDIR)$(DATADIR)/makepkg.conf.d/$${conf##*/}; done
 	for a in $(SETARCH_ALIASES); do install -m0644 $$a -t $(DESTDIR)$(DATADIR)/setarch-aliases.d; done
-	for l in $(LN_BUILDPKG); do ln -sf buildpkg $(DESTDIR)$(PREFIX)/bin/$$l; done
 	ln -sf find-libdeps $(DESTDIR)$(PREFIX)/bin/find-libprovides
 
-	# compat symlink
-	ln -sf repopkg $(DESTDIR)$(PREFIX)/bin/deploypkg
-
 install_iso: binprogs_iso
 	install -dm0755 $(DESTDIR)$(SYSCONFDIR)/$(TOOLS)
 	install -dm0755 $(DESTDIR)$(PREFIX)/bin
@@ -149,8 +123,6 @@ install_iso: binprogs_iso
 
 	for conf in $(notdir $(TOOLS_CONFIGS_ISO)); do install -Dm0644 $(BUILDDIR)/$(TOOLS)/$$conf $(DESTDIR)$(SYSCONFDIR)/$(TOOLS)/$${conf##*/}; done
 
-	for l in $(LN_BUILDISO); do ln -sf buildiso $(DESTDIR)$(PREFIX)/bin/$$l; done
-
 install: all install_base install_pkg install_iso
 
 uninstall:
@@ -161,8 +133,6 @@ uninstall:
 	for conf in $(notdir $(MAKEPKG_CONFIGS)); do rm -f $(DESTDIR)$(DATADIR)/makepkg.conf.d/$${conf##*/}; done
 	for conf in $(notdir $(PACMAN_CONFIGS)); do rm -f $(DESTDIR)$(DATADIR)/pacman.conf.d/$${conf##*/}; done
 	for f in $(notdir $(SETARCH_ALIASES)); do rm -f $(DESTDIR)$(DATADIR)/setarch-aliases.d/$$f; done
-	for l in $(LN_BUILDPKG); do rm -f $(DESTDIR)$(PREFIX)/bin/$$l; done
-	for l in $(LN_BUILDISO); do rm -f $(DESTDIR)$(PREFIX)/bin/$$l; done
 	rm -f $(DESTDIR)$(PREFIX)/bin/find-libprovides
 	rmdir --ignore-fail-on-non-empty \
 		$(DESTDIR)$(DATADIR)/setarch-aliases.d \

README.md

@@ -74,11 +74,11 @@ Specifying args will override artools-{base,pkg,iso}.conf settings.
 Both, pacman.conf and makepkg.conf for chroots are loaded from
 
 ```bash
-usr/share/artools/makepkg.conf.d/makepkg.conf
+usr/share/artools/makepkg.conf.d/${arch}.conf
 ```
 
 ```bash
-usr/share/artools/pacmanconf.d/${repo}.conf
+usr/share/artools/pacmanconf.d/${repo}-${arch}.conf
 ```
 
 and can be overridden dropping them in

config/conf/artools-base.conf

@@ -10,3 +10,11 @@
 
 # the workspace directory
 # WORKSPACE_DIR="${USER_HOME}/artools-workspace"
+
+# the arch to build
+# ARCH=$(uname -m)
+
+# default pacman.conf repos to include
+# possible buildpkg values: {system,world,galaxy,lib32}{-gremlins,-goblins}
+# possible buildiso values: {world,galaxy}{-gremlins,-goblins}
+# REPO="world"

config/makepkg/x86_64.conf

@@ -44,7 +44,8 @@ CFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions \
         -Wp,-D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security \
         -fstack-clash-protection -fcf-protection"
 CXXFLAGS="$CFLAGS -Wp,-D_GLIBCXX_ASSERTIONS"
-LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
+LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now \
+         -Wl,-z,pack-relative-relocs"
 LTOFLAGS="-flto=auto"
 RUSTFLAGS=""
 #-- Make Flags: change this for DistCC/SMP systems

src/iso/buildiso.in

@@ -197,8 +197,10 @@ gen_iso_fn(){
 prepare_build(){
     load_profile
 
-    pacman_conf="${DATADIR}/pacman.conf.d/${repo}.conf"
-    [[ -f "${USER_CONF_DIR}/pacman.conf.d/${repo}.conf" ]] && pacman_conf="${USER_CONF_DIR}/pacman.conf.d/${repo}.conf"
+    pacman_conf="${DATADIR}/pacman.conf.d/${repo}-${arch}.conf"
+    if [[ -f "${USER_CONF_DIR}/pacman.conf.d/${repo}-${arch}.conf" ]]; then
+        pacman_conf="${USER_CONF_DIR}/pacman.conf.d/${repo}-${arch}.conf"
+    fi
 
     iso_file=$(gen_iso_fn).iso
 
@@ -324,17 +326,21 @@ boot_only=false
 basestrap_args=(-GMc)
 cmd=${0##*/}
 
-repo=${cmd#buildiso-}
+repo=${REPO}
 owner=${SUDO_USER:-$USER}
 profile='base'
 chroots_iso="${CHROOTS_DIR}/buildiso"
-arch=$(uname -m)
+arch=${ARCH}
 
 usage() {
     printf 'Usage: %s [options]\n' "${cmd}"
     printf '    -p <profile>       Profile [default: %s]\n' "${profile}"
     printf '    -r <dir>           Chroots directory\n'
     printf '                       [default: %s]\n' "${chroots_iso}"
+    printf '    -R <repo>          Build repo\n'
+    printf '                       [default: %s]\n' "${repo}"
+    printf '    -a <arch>          Build arch\n'
+    printf '                       [default: %s]\n' "${arch}"
     printf '    -t <dir>           Target directory\n'
     printf '                       [default: %s]\n' "${ISO_POOL}"
     printf '    -i <name>          Init system to use\n'
@@ -358,11 +364,13 @@ usage() {
 
 orig_args=("$@")
 
-opts='p:r:t:i:g:czsbxmdqh'
+opts='p:r:R:t:i:g:a:czsbxmdqh'
 
 while getopts "${opts}" arg; do
     case "${arg}" in
         p) profile="$OPTARG" ;;
+        a) arch="$OPTARG" ;;
+        R) repo="$OPTARG" ;;
         r) chroots_iso="$OPTARG" ;;
         t) ISO_POOL="$OPTARG" ;;
         i) INITSYS="$OPTARG" ;;

src/lib/base/util.sh

@@ -32,6 +32,10 @@ load_base_config(){
 
     WORKSPACE_DIR=${WORKSPACE_DIR:-"${USER_HOME}/artools-workspace"}
 
+    ARCH=${ARCH:-"$(uname -m)"}
+
+    REPO=${REPO:-'world'}
+
     return 0
 }
 

src/lib/pkg/admin.sh

@@ -15,6 +15,7 @@ artixpkg_admin_usage() {
     COMMANDS
         transfer          Transfer obsolete repository to landfill
         query             Query maintainers and topics
+        topic             Manage topics
 
     OPTIONS
         -h, --help     Show this help text
@@ -55,6 +56,14 @@ artixpkg_admin() {
             artixpkg_admin_query "$@"
             exit 0
         ;;
+        topic)
+            _ARTOOLS_COMMAND+=" $1"
+            shift
+            # shellcheck source=src/lib/pkg/admin/query.sh
+            source "${LIBDIR}"/pkg/admin/topic.sh
+            artixpkg_admin_topic "$@"
+            exit 0
+        ;;
         -*)
             die "invalid argument: %s" "$1"
         ;;

src/lib/pkg/admin/query.sh

@@ -19,8 +19,8 @@ artixpkg_admin_query_usage() {
         -h, --help                 Show this help text
 
     EXAMPLES
-        $ ${COMMAND} --maintainer maintainer-mynickname
-        $ ${COMMAND} --topic myopic
+        $ ${COMMAND} --maintainer tux
+        $ ${COMMAND} --topic mytopic
 _EOF_
 }
 

src/lib/pkg/admin/topic.sh

@@ -0,0 +1,139 @@
+#!/bin/bash
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+[[ -z ${ARTOOLS_INCLUDE_ADMIN_TOPIC_SH:-} ]] || return 0
+ARTOOLS_INCLUDE_ADMIN_TOPIC_SH=1
+
+set -e
+
+
+artixpkg_admin_topic_usage() {
+    local -r COMMAND=${_ARTOOLS_COMMAND:-${BASH_SOURCE[0]##*/}}
+    cat <<- _EOF_
+    Usage: ${COMMAND} [OPTIONS] [PKGBASE]...
+
+    OPTIONS
+        -a, --add              Add a topic
+        -d, --del              Delete a topic
+        -j, --jobs N           Run up to N jobs in parallel (default: $(nproc))
+        -h, --help             Show this help text
+
+    EXAMPLES
+        $ ${COMMAND} --add mytopic libfoo
+        $ ${COMMAND} --del mytopic libbar
+        $ ${COMMAND} --add mytopic libfoo libbar
+        $ ${COMMAND} --del mytopic libfoo libbar
+_EOF_
+}
+
+
+
+artixpkg_admin_topic() {
+    if (( $# < 1 )); then
+        artixpkg_admin_topic_usage
+        exit 0
+    fi
+
+    # options
+    local pkgbases=()
+    local pkgbase
+
+    local ADD_TOPIC
+    local DEL_TOPIC
+    local ADD=0
+    local DEL=0
+    local jobs=
+    jobs=$(nproc)
+
+    local RUNCMD=${_ARTOOLS_COMMAND:-${BASH_SOURCE[0]##*/}}
+
+    while (( $# )); do
+        case $1 in
+            -a|--add)
+                (( $# <= 1 )) && die "missing argument for %s" "$1"
+                ADD_TOPIC="$2"
+                ADD=1
+                RUNCMD+=" -a ${ADD_TOPIC}"
+                shift 2
+            ;;
+            --add=*)
+                ADD_TOPIC="${1#*=}"
+                ADD=1
+                RUNCMD+=" --add=${ADD_TOPIC}"
+                shift
+            ;;
+            -d|--del)
+                (( $# <= 1 )) && die "missing argument for %s" "$1"
+                DEL_TOPIC="$2"
+                DEL=1
+                RUNCMD+=" -d ${DEL_TOPIC}"
+                shift 2
+            ;;
+            --del=*)
+                DEL_TOPIC="${1#*=}"
+                DEL=1
+                RUNCMD+=" --del=${DEL_TOPIC}"
+                shift
+            ;;
+            -h|--help)
+                artixpkg_admin_topic_usage
+                exit 0
+            ;;
+            -j|--jobs)
+                (( $# <= 1 )) && die "missing argument for %s" "$1"
+                jobs=$2
+                shift 2
+            ;;
+            --)
+                shift
+                break
+            ;;
+            -*)
+                die "invalid argument: %s" "$1"
+            ;;
+            *)
+                break
+            ;;
+        esac
+    done
+
+    pkgbases+=("$@")
+
+    if [[ -n ${GIT_TOKEN} ]]; then
+
+        # parallelization
+        if [[ ${jobs} != 1 ]] && (( ${#pkgbases[@]} > 1 )); then
+            if [[ -n ${BOLD} ]]; then
+                export ARTOOLS_COLOR=always
+            fi
+            if ! parallel --bar --jobs "${jobs}" "${RUNCMD}" ::: "${pkgbases[@]}"; then
+                die 'Failed to manage some topic, please check the output'
+                exit 1
+            fi
+            exit 0
+        fi
+
+        for pkgbase in "${pkgbases[@]}"; do
+
+            # topics meta
+            if (( ADD )); then
+                local gitname
+                gitname=$(get_compliant_name "${pkgbase}")
+                if ! add_topic "${gitname}" "${ADD_TOPIC}"; then
+                    warning "failed to add the topic: ${ADD_TOPIC}"
+                fi
+            fi
+
+            if (( DEL )); then
+                local gitname
+                gitname=$(get_compliant_name "${pkgbase}")
+                if ! remove_topic "${gitname}" "${DEL_TOPIC}"; then
+                    warning "failed to delete the topic: ${DEL_TOPIC}"
+                fi
+            fi
+
+        done
+
+    fi
+}

src/lib/pkg/db/db.sh

@@ -137,7 +137,6 @@ update_yaml_base() {
     local name
     local pkgnames
     local arches
-    local pkgbase
 
     pkgbase="${pkgbase:-${pkgname}}"
     version="$(get_full_version)"
@@ -277,7 +276,8 @@ show_db() {
     if ! yq -r ${REPO_DB} 1>/dev/null 2>/dev/null; then
         die "${REPO_DB} invalid!"
     fi
-    yq -rP '. | .repos |= with_entries(select(.value.version))' "${REPO_DB}"
+    yq -rP '. | with_entries(select(.value.name))' "${REPO_DB}"
+    yq -rP '. | .repos | with_entries(select(.value.version))' "${REPO_DB}"
     return 0
 }
 

src/lib/pkg/git/clone.sh

@@ -20,6 +20,8 @@ artixpkg_git_clone_usage() {
         -m, --maintainer=NAME      Clone all packages of the named maintainer
         --protocol https           Clone the repository over https
         -t, --topic=NAME           Clone all packages of the named topic
+        -a, --agent=NAME           Set the CI agent (default: official)
+                                   Possible values: [official, galaxy]
         -j, --jobs N               Run up to N jobs in parallel (default: $(nproc))
         --all                      Clone all existing packages, useful for cache warming
         -h, --help                 Show this help text
@@ -27,8 +29,9 @@ artixpkg_git_clone_usage() {
     EXAMPLES
         $ ${COMMAND} libfoo linux libbar
         $ ${COMMAND} --maintainer tux
-        $ ${COMMAND} --topic myopic
-        $ ${COMMAND} -j 8 --topic myopic
+        $ ${COMMAND} --topic mytopic
+        $ ${COMMAND} -j 8 --topic mytopic
+        $ ${COMMAND} --agent galaxy libfoo
 _EOF_
 }
 
@@ -90,6 +93,15 @@ artixpkg_git_clone() {
                 TOPIC="${1#*=}"
                 shift
             ;;
+            -a|--agent)
+                (( $# <= 1 )) && die "missing argument for %s" "$1"
+                CONFIGURE_OPTIONS+=("$1" "$2")
+                shift 2
+            ;;
+            --agent=*)
+                CONFIGURE_OPTIONS+=("${1}")
+                shift
+            ;;
             --all)
                 CLONE_ALL=1
                 shift

src/lib/pkg/git/config.sh

@@ -13,10 +13,14 @@ set -e
 
 commit_ci(){
     [[ -d .artixlinux ]] || mkdir .artixlinux
-    printf "@Library('artix-ci') import org.artixlinux.RepoPackage\n" > "${REPO_CI}"
+    if [[ ${AGENT} == ${ARTIX_DB[11]} ]]; then
+        printf "@Library('artix-ci@${AGENT}') import org.artixlinux.RepoPackage\n" > "${REPO_CI}"
+    else
+        printf "@Library('artix-ci') import org.artixlinux.RepoPackage\n" > "${REPO_CI}"
+    fi
     {
-    printf '\n'
-    printf 'PackagePipeline(new RepoPackage(this))\n'
+        printf '\n'
+        printf 'PackagePipeline(new RepoPackage(this))\n'
     } >> "${REPO_CI}"
 
     git add "${REPO_CI}"
@@ -30,14 +34,18 @@ artixpkg_git_config_usage() {
 
     OPTIONS
         -m, --maintainer       Set the maintainer topic via gitea api
-        -u, --upstream         Add upstream arch remote
+        -d, --drop             Drop the maintainer topic via gitea api
+        -a, --agent=NAME       Set the CI agent (default: official)
+                               Possible values: [official, galaxy]
         --protocol https       Configure remote url to use https
         -j, --jobs N           Run up to N jobs in parallel (default: $(nproc))
         -h, --help             Show this help text
 
     EXAMPLES
-        $ ${COMMAND} --maintainer tux
-        $ ${COMMAND} --upstream libfoo
+        $ ${COMMAND} --maintainer libfoo
+        $ ${COMMAND} --agent=galaxy libfoo
+        $ ${COMMAND} -a galaxy libfoo
+        $ ${COMMAND} --drop libfoo
         $ ${COMMAND} *
 _EOF_
 }
@@ -101,10 +109,12 @@ artixpkg_git_config() {
     local paths=()
 
     local SET_TOPIC=0
-    local UPSTREAM=0
+    local DROP_TOPIC=0
+    local AGENT=
+    local CI_ADDED=0
 
     # variables
-    local -r command=${_ARTOOLS_COMMAND:-${BASH_SOURCE[0]##*/}}
+    local RUNCMD=${_ARTOOLS_COMMAND:-${BASH_SOURCE[0]##*/}}
     local path realpath pkgbase
     local PACKAGER GPGKEY packager_name packager_email
 
@@ -116,10 +126,21 @@ artixpkg_git_config() {
         ;;
         -m|--maintainer)
             SET_TOPIC=1
+            RUNCMD+=" -m"
             shift
         ;;
-        -u|--upstream)
-            UPSTREAM=1
+        -d|--drop)
+            DROP_TOPIC=1
+            RUNCMD+=" -d"
+            shift
+        ;;
+        -a|--agent)
+            (( $# <= 1 )) && die "missing argument for %s" "$1"
+            AGENT="$2"
+            shift 2
+        ;;
+        --agent=*)
+            AGENT="${1#*=}"
             shift
         ;;
         --protocol=https)
@@ -199,7 +220,7 @@ artixpkg_git_config() {
         if [[ -n ${BOLD} ]]; then
             export ARTOOLS_COLOR=always
         fi
-        if ! parallel --bar --jobs "${jobs}" "${command}" ::: "${paths[@]}"; then
+        if ! parallel --bar --jobs "${jobs}" "${RUNCMD}" ::: "${paths[@]}"; then
             die 'Failed to configure some packages, please check the output'
             exit 1
         fi
@@ -253,17 +274,27 @@ artixpkg_git_config() {
                     fi
                 fi
             fi
-            if (( UPSTREAM )); then
-                local remote_url
-                remote_url="${GIT_UPSTREAM_URL}/${pkgbase}".git
-                if ! git remote add upstream "${remote_url}"; then
-                    warning "failed to set the upstream: ${remote_url}"
+
+            if (( DROP_TOPIC )); then
+                if [[ -n ${GIT_TOKEN} ]]; then
+                    local topic gitname
+                    topic="maintainer-${packager_name}"
+                    gitname=$(get_compliant_name "${pkgbase}")
+                    if ! remove_topic "${gitname}" "${topic}"; then
+                        warning "failed to drop the maintainer topic: ${topic}"
+                    fi
                 fi
             fi
 
             if [[ ! -f ${REPO_CI} ]]; then
                 msg "Adding ci support ..."
                 commit_ci
+                CI_ADDED=1
+            fi
+
+            if [[ -n ${AGENT} ]] && (( ! CI_ADDED )); then
+                msg "Switching ci support for [%s] ..." "${AGENT}"
+                commit_ci
             fi
 
             if [[ ! -f ${REPO_DB} ]]; then

src/lib/pkg/git/create.sh

@@ -20,7 +20,8 @@ artixpkg_git_create_usage() {
 
     OPTIONS
         -c, --clone           Clone the Git repository after creation
-        -t, --team=NAME       Assign team name [default: world]
+        -t, --team=NAME       Assign team name (default: world)
+                              Possible values: [system, world, lib32, galaxy]
         -h, --help            Show this help text
 
     EXAMPLES
@@ -34,9 +35,15 @@ artixpkg_git_create() {
     local pkgbase
     local clone=0
     local config=0
-    local TEAM='world'
+    local TEAM="${ARTIX_DB[5]}"
+    local AGENT=()
 
-    local TEAMS=(system world lib32)
+    local TEAMS=(
+        "${ARTIX_DB[2]}"
+        "${ARTIX_DB[5]}"
+        "${ARTIX_DB[8]}"
+        "${ARTIX_DB[11]}"
+        )
     # variables
     local path
 
@@ -101,10 +108,13 @@ artixpkg_git_create() {
             fi
             msg_success "Successfully created ${pkgbase}"
         fi
+        if [[ ${TEAM} == ${ARTIX_DB[11]} ]]; then
+            AGENT+=(--agent="${TEAM}")
+        fi
         if (( clone )); then
-            artixpkg_git_clone "${pkgbase}"
+            artixpkg_git_clone "${AGENT[@]}" "${pkgbase}"
         elif (( config )); then
-            artixpkg_git_config
+            artixpkg_git_config "${AGENT[@]}"
         fi
 
     done

src/lib/pkg/repo.sh

@@ -11,31 +11,27 @@ source "${LIBDIR}"/pkg/db/db.sh
 set -e
 
 
-check_pkgbuild_validity() {
-    # shellcheck source=contrib/makepkg/PKGBUILD.proto
-    . ./PKGBUILD
-
-    # skip when there are no sources available
-    if (( ! ${#source[@]} )); then
-        return
+show_agent() {
+    local agent="orion"
+    msg "Checking agent ..."
+    if grep @galaxy "${REPO_CI}" &>/dev/null; then
+        agent="taurus"
     fi
+    msg2 "agent: %s" "$agent"
+}
 
-    # validate sources hash algo is at least > sha1
-    local bad_algos=("cksums" "md5sums" "sha1sums")
-    local good_hash_algo=false
-
-    # from makepkg libmakepkg/util/schema.sh
-    for integ in "${known_hash_algos[@]}"; do
-        local sumname="${integ}sums"
-        if [[ -n ${!sumname} ]] && ! in_array "${sumname}" "${bad_algos[@]}"; then
-            good_hash_algo=true
-            break
-        fi
-    done
-
-    if ! $good_hash_algo; then
-        die "PKGBUILD lacks a secure cryptographic checksum, insecure algorithms: ${bad_algos[*]}"
+has_remote_changes() {
+    local status
+    msg "Checking for remote changes ..."
+    git fetch origin &>/dev/null
+    status=$(git status -sb --porcelain)
+    if [[ "$status" == *behind* ]]; then
+        msg2 "changes: yes"
+        error "Remote changes detected! Please pull (%s)" "${pkgbase}"
+        return 0
     fi
+    msg2 "changes: no"
+    return 1
 }
 
 artixpkg_repo_usage() {

src/lib/pkg/repo/add.sh

@@ -8,6 +8,30 @@ ARTOOLS_INCLUDE_REPO_ADD_SH=1
 set -e
 
 
+check_pkgbuild_validity() {
+    # skip when there are no sources available
+    if (( ! ${#source[@]} )); then
+        return
+    fi
+
+    # validate sources hash algo is at least > sha1
+    local bad_algos=("cksums" "md5sums" "sha1sums")
+    local good_hash_algo=false
+
+    # from makepkg libmakepkg/util/schema.sh
+    for integ in "${known_hash_algos[@]}"; do
+        local sumname="${integ}sums"
+        if [[ -n ${!sumname} ]] && ! in_array "${sumname}" "${bad_algos[@]}"; then
+            good_hash_algo=true
+            break
+        fi
+    done
+
+    if ! $good_hash_algo; then
+        die "PKGBUILD lacks a secure cryptographic checksum, insecure algorithms: ${bad_algos[*]}"
+    fi
+}
+
 artixpkg_repo_add_usage() {
     local -r COMMAND=${_ARTOOLS_COMMAND:-${BASH_SOURCE[0]##*/}}
     cat <<- _EOF_
@@ -86,45 +110,57 @@ artixpkg_repo_add() {
             fi
             ( cd "${pkgbase}" || return
 
-                if [[ ! -f PKGBUILD ]]; then
-                    die "No PKGBUILD found in (%s)" "${pkgbase}"
-                fi
+                if ! has_remote_changes; then
 
-                # shellcheck source=contrib/makepkg/PKGBUILD.proto
-                source PKGBUILD
-
-                update_yaml_base
-                update_yaml_add "${REBUILD}" "${ADD}" "${NOCHECK}" "${DEST}"
-
-                local commit_msg
-                commit_msg=$(get_commit_msg 'add' "${DEST}")
-
-                if [[ -n $(git status --porcelain --untracked-files=no) ]]; then
-
-                    stat_busy 'Staging files'
-                    for f in $(git ls-files --others); do
-                        git add "$f"
-                    done
-                    for f in $(git ls-files --modified); do
-                        git add "$f"
-                    done
-                    for f in $(git ls-files --deleted); do
-                        git rm "$f"
-                    done
-                    stat_done
-
-                    msg 'Commit'
-                    git commit -m "${commit_msg}"
-
-                    if (( PUSH )); then
-                        msg "Push (${pkgbase})"
-                        git push origin master
+                    if [[ ! -f PKGBUILD ]]; then
+                        die "No PKGBUILD found in (%s)" "${pkgbase}"
                     fi
 
-                    msg "Querying ${pkgbase} ..."
-                    if ! show_db; then
-                        warning "Could not query ${REPO_DB}"
+                    # shellcheck source=contrib/makepkg/PKGBUILD.proto
+                    source PKGBUILD
+
+                    check_pkgbuild_validity
+
+                    manage-pkgbuild-keys --export
+
+                    update_yaml_base
+                    update_yaml_add "${REBUILD}" "${ADD}" "${NOCHECK}" "${DEST}"
+
+                    local commit_msg
+                    commit_msg=$(get_commit_msg 'add' "${DEST}")
+
+                    if [[ -f .SRCINFO ]]; then
+                        rm .SRCINFO
                     fi
+
+                    if [[ -n $(git status --porcelain --untracked-files=no) ]]; then
+
+                        stat_busy 'Staging files'
+                        for f in $(git ls-files --others); do
+                            git add "$f"
+                        done
+                        for f in $(git ls-files --modified); do
+                            git add "$f"
+                        done
+                        for f in $(git ls-files --deleted); do
+                            git rm "$f"
+                        done
+                        stat_done
+
+                        msg 'Commit'
+                        git commit -m "${commit_msg}"
+
+                        if (( PUSH )); then
+                            msg "Push (${pkgbase})"
+                            git push origin master
+                        fi
+
+                        msg "Querying ${pkgbase} ..."
+                        if ! show_db; then
+                            warning "Could not query ${REPO_DB}"
+                        fi
+                    fi
+
                 fi
             )
         fi

src/lib/pkg/repo/import.sh

@@ -10,43 +10,36 @@ set -e
 
 patch_pkgbase(){
     local name="$1"
-    local pkgbuild
-    pkgbuild=PKGBUILD
-
-    sed -e 's|arch-meson|artix-meson|' -i "${pkgbuild}"
-
     case "${name}" in
-        glibc)
-            sed -e 's|{locale,systemd/system,tmpfiles.d}|{locale,tmpfiles.d}|' \
-                -e '/nscd.service/d' \
-                -i "${pkgbuild}"
-        ;;
-        linux|linux-lts|linux-zen|linux-hardened|linux-rt|linux-rt-lts)
-            sed -e 's|KBUILD_BUILD_HOST=.*|KBUILD_BUILD_HOST=artixlinux|' -i "${pkgbuild}"
+        linux|linux-lts|linux-zen|linux-hardened|linux-rt*)
+            sed -e 's|KBUILD_BUILD_HOST=.*|KBUILD_BUILD_HOST=artixlinux|' -i PKGBUILD
             sed -e 's|CONFIG_DEFAULT_HOSTNAME=.*|CONFIG_DEFAULT_HOSTNAME="artixlinux"|' \
                 -i config
         ;;
-        gstreamer|gst-plugins-*|licenses)
+        *)
             sed -e 's|https://www.archlinux.org/|https://www.artixlinux.org/|' \
                 -e 's|(Arch Linux)|(Artix Linux)|' \
-                -i "${pkgbuild}"
+                -e 's|arch-meson|artix-meson|' \
+                -i PKGBUILD
         ;;
     esac
+    git --no-pager diff PKGBUILD
 }
 
-
 artixpkg_repo_import_usage() {
     local -r COMMAND=${_ARTOOLS_COMMAND:-${BASH_SOURCE[0]##*/}}
     cat <<- _EOF_
     Usage: ${COMMAND} [OPTIONS] [PKGBASE]...
 
     OPTIONS
-        --switch TAG       Switch the current workspace to a specified version tag
+        --tag TAG          Switch the current workspace to a specified version tag
+        --del              Delete files before rsync import
         -h, --help         Show this help text
 
     EXAMPLES
         $ ${COMMAND} libfoo
-        $ ${COMMAND} libfoo --switch TAG
+        $ ${COMMAND} --tag TAG libfoo
+        $ ${COMMAND} --tag TAG --del libfoo
 _EOF_
 }
 
@@ -61,25 +54,45 @@ artixpkg_repo_import() {
     local pkgbase
     local TAG
     local rsync_args=()
-    rsync_args+=(-aWxvci --progress --delete-before --no-R --no-implied-dirs)
-    rsync_args+=(--exclude '.git' --exclude '.gitignore' --exclude 'README.md' --exclude '.artixlinux')
+    rsync_args+=(
+        -axcihW
+        --no-R
+        --no-implied-dirs
+        --exclude '.artixlinux'
+        --exclude '.git'
+        --exclude '.gitignore'
+        --exclude 'README.md'
+        --exclude '*.service'
+        --exclude '.SRCINFO'
+        --exclude '*.socket'
+        --exclude '*.timer'
+    )
 
     while (( $# )); do
         case $1 in
-        --switch=*)
-            TAG="${1#*=}"
-            shift
-        ;;
-        -h|--help)
-            artixpkg_repo_import_usage
-            exit 0
-        ;;
-        -*)
-            die "invalid argument: %s" "$1"
-        ;;
-        *)
-            break
-        ;;
+            --tag)
+                (( $# <= 1 )) && die "missing argument for %s" "$1"
+                TAG="$2"
+                shift 2
+            ;;
+            --tag=*)
+                TAG="${1#*=}"
+                shift
+            ;;
+            --del)
+                rsync_args+=(--delete-before)
+                shift
+            ;;
+            -h|--help)
+                artixpkg_repo_import_usage
+                exit 0
+            ;;
+            -*)
+                die "invalid argument: %s" "$1"
+            ;;
+            *)
+                break
+            ;;
         esac
     done
 
@@ -101,9 +114,8 @@ artixpkg_repo_import() {
                 fi
                 stat_done
 
-                stat_busy "Fetching upstream tags"
+                msg2 "Fetching upstream tags"
                 git fetch --tags upstream main
-                stat_done
 
                 local latest version
                 latest=$(git describe --tags FETCH_HEAD)
@@ -112,21 +124,27 @@ artixpkg_repo_import() {
                     version="${TAG}"
                 fi
 
-                stat_busy "Importing upstream changeset for ${version}"
+                if ! has_remote_changes; then
+                    show_agent
+                    msg "Querying ${pkgbase} ..."
+                    if ! show_db; then
+                        warning "Could not query ${REPO_DB}"
+                    fi
 
-                git checkout "${version}" -b "${version}" &>/dev/null
-                local temp
-                temp=$(mktemp -d --tmpdir "${pkgbase}.XXXXXXXXXX")
+                    git checkout "${version}" -b "${version}" &>/dev/null
+                    local temp
+                    temp=$(mktemp -d --tmpdir "${pkgbase}.XXXXXXXXXX")
 
-                rsync "${rsync_args[@]}" "$(pwd)"/ "${temp}"/ &>/dev/null
-                git checkout master &>/dev/null
-                git branch -D "${version}" &>/dev/null
+                    rsync "${rsync_args[@]}" "$(pwd)"/ "${temp}"/ &>/dev/null
+                    git checkout master &>/dev/null
+                    git branch -D "${version}" &>/dev/null
 
-                rsync "${rsync_args[@]}" "${temp}"/ "$(pwd)"/ &>/dev/null
+                    msg "Importing upstream changeset for ${version}"
+                    rsync "${rsync_args[@]}" "${temp}"/ "$(pwd)"/ #&>/dev/null
 
-                patch_pkgbase "${pkgbase}"
-
-                stat_done
+                    msg2 "Patching ${pkgbase} ..."
+                    patch_pkgbase "${pkgbase}"
+                fi
             )
         fi
 

src/lib/pkg/repo/move.sh

@@ -80,38 +80,71 @@ artixpkg_repo_move() {
             fi
             ( cd "${pkgbase}" || return
 
-                if [[ ! -f PKGBUILD ]]; then
-                    die "No PKGBUILD found in (%s)" "${pkgbase}"
-                fi
+                if ! has_remote_changes; then
 
-                local commit_msg
-                commit_msg=$(get_commit_msg 'move' "${DEST}" "${SRC}")
+                    if [[ ! -f PKGBUILD ]]; then
+                        die "No PKGBUILD found in (%s)" "${pkgbase}"
+                    fi
 
-                update_yaml_move "${SRC}" "${DEST}"
+                    local commit_msg src_version dest_version
+                    commit_msg=$(get_commit_msg 'move' "${DEST}" "${SRC}")
 
-                if [[ -n $(git status --porcelain --untracked-files=no) ]]; then
+                    src_version=$(version_from_yaml "${SRC}")
+                    dest_version=$(version_from_yaml "${DEST}")
+
+                    if [[ "$src_version" != null ]]; then
+
+                        local ret
+                        ret=$(vercmp "$src_version" "$dest_version")
+
+                        if (( ret > 0 )); then
+
+                            update_yaml_move "${SRC}" "${DEST}"
+
+                            if [[ -f .SRCINFO ]]; then
+                                rm .SRCINFO
+                            fi
+
+                            if [[ -n $(git status --porcelain --untracked-files=no) ]]; then
+
+                                stat_busy 'Staging files'
+                                for f in $(git ls-files --modified); do
+                                    if [[ "$f" == "${REPO_DB}" ]]; then
+                                        git add "$f"
+                                    fi
+                                done
+                                stat_done
+
+                                msg 'Commit'
+                                git commit -m "${commit_msg}"
+
+                                if (( PUSH )); then
+                                    msg "Push (${pkgbase})"
+                                    git push origin master
+                                fi
+
+                                msg "Querying ${pkgbase} ..."
+                                if ! show_db; then
+                                    warning "Could not query ${REPO_DB}"
+                                fi
+
+                            fi
+
+                        elif (( ret < 0 )); then
+
+                            error "${pkgbase}: invalid move: version $src_version < $dest_version!"
+
+                        else
+                            error "${pkgbase}: invalid move: version $src_version = $dest_version!"
 
-                    stat_busy 'Staging files'
-                    for f in $(git ls-files --modified); do
-                        if [[ "$f" == "${REPO_DB}" ]]; then
-                            git add "$f"
                         fi
-                    done
-                    stat_done
 
-                    msg 'Commit'
-                    git commit -m "${commit_msg}"
-
-                    if (( PUSH )); then
-                        msg "Push (${pkgbase})"
-                        git push origin master
+                    else
+                        error "${pkgbase}: invalid move: version $src_version!"
                     fi
 
-                    msg "Querying ${pkgbase} ..."
-                    if ! show_db; then
-                        warning "Could not query ${REPO_DB}"
-                    fi
                 fi
+
             )
         fi
 

src/lib/pkg/repo/remove.sh

@@ -73,36 +73,40 @@ artixpkg_repo_remove() {
             fi
             ( cd "${pkgbase}" || return
 
-                if [[ ! -f PKGBUILD ]]; then
-                    die "No PKGBUILD found in (%s)" "${pkgbase}"
-                fi
+                if ! has_remote_changes; then
 
-                local commit_msg
-                commit_msg=$(get_commit_msg 'remove' "${DEST}")
-
-                update_yaml_remove "${DEST}"
-
-                if [[ -n $(git status --porcelain --untracked-files=no) ]]; then
-
-                    stat_busy 'Staging files'
-                    for f in $(git ls-files --modified); do
-                        if [[ "$f" == "${REPO_DB}" ]]; then
-                            git add "$f"
-                        fi
-                    done
-                    stat_done
-
-                    msg 'Commit'
-                    git commit -m "${commit_msg}"
-
-                    if (( PUSH )); then
-                        msg "Push (${pkgbase})"
-                        git push origin master
+                    if [[ ! -f PKGBUILD ]]; then
+                        die "No PKGBUILD found in (%s)" "${pkgbase}"
                     fi
 
-                    msg "Querying ${pkgbase} ..."
-                    if ! show_db; then
-                        warning "Could not query ${REPO_DB}"
+                    local commit_msg
+                    commit_msg=$(get_commit_msg 'remove' "${DEST}")
+
+                    update_yaml_remove "${DEST}"
+
+                    if [[ -n $(git status --porcelain --untracked-files=no) ]]; then
+
+                        stat_busy 'Staging files'
+                        for f in $(git ls-files --modified); do
+                            if [[ "$f" == "${REPO_DB}" ]]; then
+                                git add "$f"
+                            fi
+                        done
+                        stat_done
+
+                        msg 'Commit'
+                        git commit -m "${commit_msg}"
+
+                        if (( PUSH )); then
+                            msg "Push (${pkgbase})"
+                            git push origin master
+                        fi
+
+                        msg "Querying ${pkgbase} ..."
+                        if ! show_db; then
+                            warning "Could not query ${REPO_DB}"
+                        fi
+
                     fi
 
                 fi

src/lib/pkg/repo/show.sh

@@ -8,18 +8,6 @@ ARTOOLS_INCLUDE_REPO_SHOW_SH=1
 set -e
 
 
-has_changeset(){
-    git fetch origin &>/dev/null
-
-    if [[ $(git rev-parse HEAD) != $(git rev-parse @{u}) ]]; then
-        msg2 "changes: yes"
-        git status -sb
-        return 0
-    fi
-    msg2 "changes: no"
-    return 1
-}
-
 artixpkg_repo_show_usage() {
     local -r COMMAND=${_ARTOOLS_COMMAND:-${BASH_SOURCE[0]##*/}}
     cat <<- _EOF_
@@ -84,28 +72,27 @@ artixpkg_repo_show() {
             fi
             ( cd "${pkgbase}" || return
 
-                msg "Checking origin for changes"
-                if has_changeset; then
-                    warning "Remote changes detected! Please update (%s)" "${pkgbase}"
-                fi
+                if ! has_remote_changes; then
+                    if [[ ! -f PKGBUILD ]]; then
+                        die "No PKGBUILD found in (%s)" "${pkgbase}"
+                    fi
 
-                if [[ ! -f PKGBUILD ]]; then
-                    die "No PKGBUILD found in (%s)" "${pkgbase}"
-                fi
+                    show_agent
 
-                msg "Querying ${pkgbase} ..."
-                if ! show_db; then
-                    warning "Could not query ${REPO_DB}"
-                fi
+                    msg "Querying ${pkgbase} ..."
+                    if ! show_db; then
+                        warning "Could not query ${REPO_DB}"
+                    fi
 
-                if (( SRC_BASE )); then
-                    msg "Showing srcinfo base ..."
-                    show_srcinfo_base
-                fi
+                    if (( SRC_BASE )); then
+                        msg "Showing srcinfo base ..."
+                        show_srcinfo_base
+                    fi
 
-                if (( SRC_PKGS )); then
-                    msg "Showing srcinfo pkgs ..."
-                    show_srcinfo_pkgs
+                    if (( SRC_PKGS )); then
+                        msg "Showing srcinfo pkgs ..."
+                        show_srcinfo_pkgs
+                    fi
                 fi
 
             )

src/pkg/buildpkg.in

@@ -16,26 +16,27 @@ source "${LIBDIR}"/base/chroot.sh
 create_first=false
 rebuild=false
 
-mkchrootpkg_args=(-c -n)
+mkchrootpkg_args=(-c)
 
 base_packages=('base-devel')
 chroots_pkg="${CHROOTS_DIR}/buildpkg"
 
-cmd=${0##*/}
-
-tag=${cmd#buildpkg-}
-arch=${tag##*-}
-repo=${tag%-*}
+arch=${ARCH}
+repo=${REPO}
 
 usage() {
     printf 'Usage: %s [options] -- [mkchrootpkg_args]\n' "${0##*/}"
     printf '    -r <dir>           Create chroots in this directory\n'
-    printf '    -d <dir>           Destination repo chroot\n'
+    printf '                       [default: %s]\n' "${chroots_pkg}"
+    printf '    -d <dest>          Destination repo chroot\n'
+    printf '                       [default: %s]\n' "${repo}"
     printf '    -a <arch>          Build arch chroot\n'
+    printf '                       [default: %s]\n' "${arch}"
     printf '    -c                 Recreate the chroot before building\n'
     printf '    -m                 Major rebuild\n'
     printf '    -N                 Disable check() function\n'
-    printf '    -C                 Run checkpkg after built\n'
+    printf '    -C                 Run checkpkg after build\n'
+    printf '    -n                 Run namcap after build\n'
     printf '    -h                 This help\n'
     printf '\n'
     printf 'Default mkchrootpkg_args args: %s\n' "${mkchrootpkg_args[*]}"
@@ -43,7 +44,7 @@ usage() {
     exit "$1"
 }
 
-opts='hcCNmr:d:a:'
+opts='hcCNmnr:d:a:'
 
 while getopts "${opts}" arg; do
     case "${arg}" in
@@ -54,6 +55,7 @@ while getopts "${opts}" arg; do
         m) rebuild=true; repo=${repo%-*} ;;
         C) mkchrootpkg_args+=(-C) ;;
         N) mkchrootpkg_args+=(-N) ;;
+        n) mkchrootpkg_args+=(-n) ;;
         h|?) usage 0 ;;
     esac
 done
@@ -62,15 +64,9 @@ if [[ "${repo}" == lib32* ]]; then
     base_packages+=('multilib-devel')
 fi
 
-pacman_conf="${DATADIR}/pacman.conf.d/${repo}.conf"
-if [[ -f ${USER_CONF_DIR}/pacman.conf.d/${repo}.conf ]]; then
-    pacman_conf="${USER_CONF_DIR}/pacman.conf.d/${repo}.conf"
-fi
-if [[ -f ${DATADIR}/pacman.conf.d/${repo}-${arch}.conf ]]; then
-    pacman_conf="${DATADIR}/pacman.conf.d/${repo}-${arch}.conf"
-    if [[ -f ${USER_CONF_DIR}/pacman.conf.d/${repo}-${arch}.conf ]]; then
-        pacman_conf="${USER_CONF_DIR}/pacman.conf.d/${repo}-${arch}.conf"
-    fi
+pacman_conf="${DATADIR}/pacman.conf.d/${repo}-${arch}.conf"
+if [[ -f ${USER_CONF_DIR}/pacman.conf.d/${repo}-${arch}.conf ]]; then
+    pacman_conf="${USER_CONF_DIR}/pacman.conf.d/${repo}-${arch}.conf"
 fi
 
 makepkg_conf="${DATADIR}/makepkg.conf.d/${arch}.conf"

src/pkg/checkpkg.in

@@ -97,6 +97,8 @@ STARTDIR=$(pwd)
 (( RMDIR )) && trap 'rm -rf $TEMPDIR' EXIT INT TERM QUIT
 TEMPDIR=$(mktemp -d --tmpdir checkpkg-script.XXXX)
 
+changed=0
+
 for _pkgname in "${pkgname[@]}"; do
     comparepkg=$_pkgname
     pkgurl=
@@ -151,10 +153,16 @@ for _pkgname in "${pkgname[@]}"; do
     if ! diff_output="$(sdiff -s "$TEMPDIR/libraries-$_pkgname-old" "$TEMPDIR/libraries-$_pkgname")"; then
         message="Sonames differ in $_pkgname!"
         (( WARN )) && warning "$message" || msg "$message"
-        printf "%s\n" "$diff_output"
+        printf "%s\n" "$diff_output" 2>&1 | tee "${pkgfile##*/}-checkpkg.log"
+        changed=1
     else
         msg "No soname differences for %s." "$_pkgname"
     fi
 done
 
-(( RMDIR )) || msg "Files saved to %s" "$TEMPDIR"
+if ! (( RMDIR )); then
+    msg "Files saved to %s" "$TEMPDIR"
+fi
+
+exit "$changed"
+

src/pkg/ckchrootpkg.in

@@ -0,0 +1,111 @@
+#!/bin/bash
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+LIBDIR=${LIBDIR:-'@libdir@'}
+
+# shellcheck source=src/lib/base/util.sh
+source "${LIBDIR}"/base/util.sh
+# shellcheck source=src/lib/base/message.sh
+source "${LIBDIR}"/base/message.sh
+# shellcheck source=src/lib/base/chroot.sh
+source "${LIBDIR}"/base/chroot.sh
+
+shopt -s nullglob
+
+chrootdir=
+makepkg_user=
+passeddir="${CHROOTS_DIR}/buildpkg"
+
+arch=${ARCH}
+repo=${REPO}
+
+copy=$USER
+[[ -n ${SUDO_USER:-} ]] && copy=$SUDO_USER
+[[ -z "$copy" || $copy = root ]] && copy=copy
+
+usage() {
+    printf 'Usage: %s [options] -r <chrootdir>\n' "${0##*/}"
+    printf '    -r <dir>           Create chroots in this directory\n'
+    printf '                       Default: %s\n' "${passeddir}"
+    printf '    -d <dest>          Destination repo chroot\n'
+    printf '                       Default: %s\n' "${repo}"
+    printf '    -a <arch>          Build arch chroot\n'
+    printf '                       Default: %s\n' "${arch}"
+    printf '    -l <copy>          The directory to use as the working copy of the chroot\n'
+    printf '                       Useful for maintaining multiple copies\n'
+    printf '                       Default: %s\n' "$copy"
+    printf '    -U                 Run makepkg as a specified user\n'
+    exit 1
+}
+
+opts='hr:l:U:d:a:'
+
+while getopts "${opts}" arg; do
+    case "$arg" in
+        r) passeddir="$OPTARG" ;;
+        l) copy="$OPTARG" ;;
+        U) makepkg_user="$OPTARG" ;;
+        d) repo="$OPTARG" ;;
+        a) arch="$OPTARG" ;;
+        h|*) usage ;;
+    esac
+done
+
+[[ ! -f PKGBUILD ]] && die 'This must be run in a directory containing a PKGBUILD.'
+[[ -n $makepkg_user && -z $(id -u "$makepkg_user") ]] && die 'Invalid makepkg user.'
+makepkg_user=${makepkg_user:-${SUDO_USER:-$USER}}
+
+check_root "" "${BASH_SOURCE[0]}" "$@"
+
+# # Canonicalize chrootdir, getting rid of trailing /
+chrootdir=$(readlink -e "$passeddir")
+
+chrootdir="$chrootdir"/"${repo}-${arch}"
+
+[[ ! -d $chrootdir ]] && die "No chroot dir defined, or invalid path '%s'" "$passeddir"
+[[ ! -d $chrootdir/root ]] && die "Missing chroot dir root directory. Try using: mkchroot %s/root base-devel" "$chrootdir"
+
+if [[ ${copy:0:1} = / ]]; then
+    copydir=$copy
+else
+    copydir="$chrootdir/$copy"
+fi
+
+umask 0022
+
+ORIG_HOME=$HOME
+IFS=: read -r _ _ _ _ _ HOME _ < <(getent passwd "${SUDO_USER:-$USER}")
+load_makepkg_config
+HOME=$ORIG_HOME
+
+[[ -d $PKGDEST ]]    || PKGDEST=$PWD
+[[ -d $SRCDEST ]]    || SRCDEST=$PWD
+[[ -d $SRCPKGDEST ]] || SRCPKGDEST=$PWD
+[[ -d $LOGDEST ]]    || LOGDEST=$PWD
+
+msg "Running checkpkg"
+mapfile -t pkgnames < <(bash -c 'source PKGBUILD; printf "%s\n" "${pkgname[@]}"')
+
+mapfile -t remotepkgs < <(pacman --config "$copydir"/etc/pacman.conf \
+    --dbpath "$copydir"/var/lib/pacman \
+    -Sddp "${pkgnames[@]}")
+
+if ! wait $!; then
+    warning "Skipped checkpkg due to missing repo packages"
+    exit 0
+fi
+
+# download package files if any non-local location exists
+for remotepkg in "${remotepkgs[@]}"; do
+    if [[ $remotepkg != file://* ]]; then
+        msg2 "Downloading current versions"
+        chroot-run "$copydir" pacman --noconfirm -Swdd "${pkgnames[@]}"
+        mapfile -t remotepkgs < <(pacman --config "$copydir"/etc/pacman.conf \
+            --dbpath "$copydir"/var/lib/pacman \
+            -Sddp "${pkgnames[@]}")
+        break
+    fi
+done
+
+sudo -u "$makepkg_user" checkpkg --rmdir --warn --makepkg-config "$copydir/etc/makepkg.conf" "${remotepkgs[@]/#file:\/\//}"

src/pkg/export-pkgbuild-keys.in

@@ -1,73 +0,0 @@
-#!/bin/bash
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-LIBDIR=${LIBDIR:-'@libdir@'}
-
-# shellcheck source=src/lib/base/message.sh
-source "${LIBDIR}"/base/message.sh
-
-usage() {
-    cat <<- _EOF_
-        Usage: ${BASH_SOURCE[0]##*/}
-
-        Export the PGP keys from a PKGBUILDs validpgpkeys array into the keys/pgp/
-        subdirectory. Useful for distributing packager validated source signing
-        keys alongside PKGBUILDs.
-
-        OPTIONS
-            -h, --help      Show this help text
-_EOF_
-}
-
-# option checking
-while (( $# )); do
-    case $1 in
-        -h|--help) usage; exit 0 ;;
-        *) die "invalid argument: %s" "$1" ;;
-    esac
-done
-
-if [[ ! -f PKGBUILD ]]; then
-    die "This must be run a directory containing a PKGBUILD."
-fi
-
-mapfile -t validpgpkeys < <(
-    # shellcheck source=contrib/makepkg/PKGBUILD.proto
-    . ./PKGBUILD
-    if (( ${#validpgpkeys[@]} )); then
-        printf "%s\n" "${validpgpkeys[@]}"
-    fi
-)
-
-msg "Exporting ${#validpgpkeys[@]} PGP keys..."
-if (( ${#validpgpkeys[@]} == 0 )); then
-    exit 0
-fi
-
-trap 'rm -rf $TEMPDIR' EXIT INT TERM QUIT
-TEMPDIR=$(mktemp -d --tmpdir export-pkgbuild-keys.XXXXXXXXXX)
-
-mkdir -p keys/pgp
-error=0
-
-for key in "${validpgpkeys[@]}"; do
-    gpg --output "$TEMPDIR/$key.asc" --armor --export --export-options export-minimal "$key" 2>/dev/null
-
-    # gpg does not give a non-zero return value if it fails to export...
-    if [[ -f $TEMPDIR/$key.asc ]]; then
-        msg2 "Exported $key"
-        mv "$TEMPDIR/$key.asc" "keys/pgp/$key.asc"
-    else
-        if [[ -f keys/pgp/$key.asc ]]; then
-            warning "Failed to update key: $key"
-        else
-            error "Key unavailable: $key"
-            error=1
-        fi
-    fi
-done
-
-if (( error )); then
-    die "Failed to export all \'validpgpkeys\' entries."
-fi

src/pkg/manage-pkgbuild-keys.in

@@ -0,0 +1,97 @@
+#!/bin/bash
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+LIBDIR=${LIBDIR:-'@libdir@'}
+
+# shellcheck source=src/lib/base/message.sh
+source "${LIBDIR}"/base/message.sh
+
+
+usage() {
+    cat <<- _EOF_
+        Usage: ${BASH_SOURCE[0]##*/}
+
+        Export or import the PGP keys from a PKGBUILDs validpgpkeys array into/from the keys/pgp/
+        subdirectory. Useful for distributing packager validated source signing
+        keys alongside PKGBUILDs.
+
+        OPTIONS
+            -i, --import    Import keys
+            -e, --export    Export keys
+            -h, --help      Show this help text
+_EOF_
+}
+
+action=
+
+# option checking
+while (( $# )); do
+    case $1 in
+        -i|--import) action="import"; shift ;;
+        -e|--export) action="export"; shift ;;
+        -h|--help) usage; exit 0 ;;
+        *) die "invalid argument: %s" "$1" ;;
+    esac
+done
+
+if [[ ! -f PKGBUILD ]]; then
+    die "This must be run a directory containing a PKGBUILD."
+fi
+
+mapfile -t validpgpkeys < <(
+    # shellcheck source=contrib/makepkg/PKGBUILD.proto
+    . ./PKGBUILD
+    if (( ${#validpgpkeys[@]} )); then
+        printf "%s\n" "${validpgpkeys[@]}"
+    fi
+)
+
+if [[ "$action" == 'export' ]]; then
+    msg "Exporting ${#validpgpkeys[@]} PGP keys..."
+    if (( ${#validpgpkeys[@]} == 0 )); then
+        exit 0
+    fi
+
+    trap 'rm -rf $TEMPDIR' EXIT INT TERM QUIT
+    TEMPDIR=$(mktemp -d --tmpdir export-pkgbuild-keys.XXXXXXXXXX)
+
+    mkdir -p keys/pgp
+    error=0
+
+
+    for key in "${validpgpkeys[@]}"; do
+        gpg --output "$TEMPDIR/$key.asc" --armor --export --export-options export-minimal "$key" 2>/dev/null
+
+        # gpg does not give a non-zero return value if it fails to export...
+        if [[ -f $TEMPDIR/$key.asc ]]; then
+            msg2 "Exported $key"
+            mv "$TEMPDIR/$key.asc" "keys/pgp/$key.asc"
+        else
+            if [[ -f keys/pgp/$key.asc ]]; then
+                warning "Failed to update key: $key"
+            else
+                error "Key unavailable: $key"
+                error=1
+            fi
+        fi
+    done
+elif [[ "$action" == 'import' ]]; then
+    msg "Ensuring required PGP keys are present..."
+    for key in "${validpgpkeys[@]}"; do
+        msg2 "Checking for $key..."
+        if ! gpg --recv-keys $key || gpg --fingerprint $key; then
+            if [[ -f keys/pgp/$key.asc ]]; then
+                msg2 "Importing key from local..."
+                gpg --import keys/pgp/$key.asc
+            else
+                error "Key unavailable: $key"
+                error=1
+            fi
+        fi
+    done
+fi
+
+if (( error )); then
+    die "Failed to $action all \'validpgpkeys\' entries."
+fi

src/pkg/mkchrootpkg.in

@@ -205,6 +205,8 @@ _chrootbuild() {
     # No coredumps
     ulimit -c 0
 
+    . /etc/locale.conf
+
     # shellcheck source=/dev/null
     . /etc/profile
 

src/pkg/signpkg.in

@@ -36,5 +36,10 @@ for pkg in "${passfiles[@]}"; do
         msg2 "Found: %s" "${pkgfile}"
         [[ -e "${pkgfile}".sig ]] && rm "${pkgfile}".sig
         sign_pkg "${pkgfile}"
+        ret=0
+    else
+        ret=1
     fi
 done
+
+exit "$ret"