prepare release

Generate a message template when omitting the commit message (includes
the same subject line that is used if a commit message is specified).

Also, use two newlines to separate the subject line from the message
body as it looks much clearer that way.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Signed-off-by: Pierre Schmitz <pierre@archlinux.de>

Makefile

@@ -1,10 +1,11 @@
-V=0.9.19
+V=0.9.26
+
+PREFIX = /usr/local
 
 BINPROGS = \
 	checkpkg \
 	commitpkg \
 	archco \
-	communityco \
 	archrelease \
 	archrm \
 	archbuild \
@@ -49,23 +50,30 @@ ARCHBUILD_LINKS = \
 all:
 
 install:
-	install -dm0755 $(DESTDIR)/usr/bin
+	install -dm0755 $(DESTDIR)$(PREFIX)/bin
-	install -dm0755 $(DESTDIR)/usr/sbin
+	install -dm0755 $(DESTDIR)$(PREFIX)/sbin
-	install -dm0755 $(DESTDIR)/usr/share/devtools
+	install -dm0755 $(DESTDIR)$(PREFIX)/share/devtools
-	install -m0755 ${BINPROGS} $(DESTDIR)/usr/bin
+	install -m0755 ${BINPROGS} $(DESTDIR)$(PREFIX)/bin
-	install -m0755 ${SBINPROGS} $(DESTDIR)/usr/sbin
+	install -m0755 ${SBINPROGS} $(DESTDIR)$(PREFIX)/sbin
-	install -m0644 ${CONFIGFILES} $(DESTDIR)/usr/share/devtools
+	install -m0644 ${CONFIGFILES} $(DESTDIR)$(PREFIX)/share/devtools
-	for l in ${COMMITPKG_LINKS}; do ln -sf commitpkg $(DESTDIR)/usr/bin/$$l; done
+	for l in ${COMMITPKG_LINKS}; do ln -sf commitpkg $(DESTDIR)$(PREFIX)/bin/$$l; done
-	for l in ${ARCHBUILD_LINKS}; do ln -sf archbuild $(DESTDIR)/usr/bin/$$l; done
+	for l in ${ARCHBUILD_LINKS}; do ln -sf archbuild $(DESTDIR)$(PREFIX)/bin/$$l; done
+	install -Dm0644 bash_completion $(DESTDIR)/etc/bash_completion.d/devtools
+	ln -sf archco $(DESTDIR)$(PREFIX)/bin/communityco
 
 uninstall:
-	for f in ${BINPROGS}; do rm -f $(DESTDIR)/usr/bin/$$f; done
+	for f in ${BINPROGS}; do rm -f $(DESTDIR)$(PREFIX)/bin/$$f; done
-	for f in ${SBINPROGS}; do rm -f $(DESTDIR)/usr/sbin/$$f; done
+	for f in ${SBINPROGS}; do rm -f $(DESTDIR)$(PREFIX)/sbin/$$f; done
-	for f in ${CONFIGFILES}; do rm -f $(DESTDIR)/usr/share/devtools/$$f; done
+	for f in ${CONFIGFILES}; do rm -f $(DESTDIR)$(PREFIX)/share/devtools/$$f; done
-	for l in ${COMMITPKG_LINKS}; do rm -f $(DESTDIR)/usr/bin/$$l; done
+	for l in ${COMMITPKG_LINKS}; do rm -f $(DESTDIR)$(PREFIX)/bin/$$l; done
-	for l in ${ARCHBUILD_LINKS}; do rm -f $(DESTDIR)/usr/bin/$$l; done
+	for l in ${ARCHBUILD_LINKS}; do rm -f $(DESTDIR)$(PREFIX)/bin/$$l; done
+	rm $(DESTDIR)/etc/bash_completion.d/devtools
+	rm -f $(DESTDIR)$(PREFIX)/bin/communityco
 
 dist:
 	git archive --format=tar --prefix=devtools-$(V)/ $(V) | gzip -9 > devtools-$(V).tar.gz
 
-.PHONY: all install uninstall dist
+upload:
+	scp devtools-$(V).tar.gz gerolde.archlinux.org:/srv/ftp/other/devtools/
+
+.PHONY: all install uninstall dist upload

archco

@@ -1,10 +1,23 @@
 #!/bin/bash
 
+scriptname=${0##*/}
+
 if [ "$1" = '' ]; then
-	echo 'Usage: archco <package name> [<package name>]'
+	echo 'Usage: '$scriptname' <package name> [<package name>]'
 	exit 1
 fi
 
+case $scriptname in
+	archco)
+		SVNURL="svn+ssh://gerolde.archlinux.org/srv/svn-packages";;
+	communityco)
+		SVNURL="svn+ssh://aur.archlinux.org/srv/svn-packages";;
+	*)
+		echo "error: couldn't find svn url for $scriptname"
+		exit 1
+		;;
+esac
+
 for i in "$@"; do
-	svn co svn+ssh://gerolde.archlinux.org/srv/svn-packages/$i
+	svn co "$SVNURL/$i"
 done

archrelease

@@ -9,27 +9,48 @@ if [ "$1" = '' ]; then
 	abort 'Usage: archrelease <repo>'
 fi
 
+# TODO: validate repo is really repo-arch
+
 if [ ! -f PKGBUILD ]; then
 	abort 'archrelease: PKGBUILD not found'
 fi
 
 trunk=$(basename $(pwd))
 
+# Normally this should be trunk, but it may be something
+# such as 'gnome-unstable'
 if [ "$(basename $(dirname $(pwd)))" == "repos" ]; then
-	abort 'archrelease: Not in a package trunk dir'
+	abort 'archrelease: Should not be in repos dir (try from trunk/)'
 fi
 
 if [ ! -z "$(svn status -q)" ]; then
 	abort 'archrelease: You have not committed your changes yet!'
 fi
 
-echo -n 'releasing package...'
+echo -n "releasing package to ${1}..."
 pushd .. >/dev/null
 if [ -d "repos/${1}" ]; then
-	svn rm --force -q "repos/${1}"
+	for file in $(svn ls "repos/${1}"); do
-	svn commit -q -m "archrelease: remove ${1}" || abort
+		svn rm -q "repos/${1}/$file"
+	done
 fi
-svn copy -q -r HEAD "${trunk}" "repos/${1}"
+if [ ! -d repos ]; then
-svn commit -q -m "archrelease: copy ${trunk} to ${1}" || abort
+	mkdir repos
+	svn add -q repos
+fi
+if [ ! -d "repos/${1}" ]; then
+	mkdir "repos/${1}"
+	svn add -q "repos/${1}"
+fi
+known_files=$(svn ls "trunk")
+for file in $known_files; do
+	if [ "$file" != "${file%/}" ]; then
+		abort "archrelease: subdirectories are not supported in package directories!"
+	fi
+done
+for file in $known_files; do
+	svn copy -q -r HEAD "trunk/$file" "repos/${1}/"
+done
+svn commit -q -m "archrelease: copy trunk to ${1}" || abort
 popd >/dev/null
 echo 'done'

bash_completion

@@ -0,0 +1,69 @@
+_devtools_compgen() {
+  local i r
+  COMPREPLY=($(compgen -W '$*' -- "$cur"))
+  for ((i=1; i < ${#COMP_WORDS[@]}-1; i++)); do
+    for r in ${!COMPREPLY[@]}; do
+      if [[ ${COMP_WORDS[i]} = ${COMPREPLY[r]} ]]; then
+        unset 'COMPREPLY[r]'; break
+      fi
+    done
+  done
+}
+
+_archco_pkg() {
+  _devtools_compgen "$(
+      \pacman -$1
+  )"
+}
+
+_archco() {
+  local cur prev 
+  COMPREPLY=()
+  cur=$(_get_cword)
+  prev=${COMP_WORDS[COMP_CWORD-1]}
+
+  _archco_pkg Slq
+  true
+} &&
+complete -F _archco archco communityco
+
+_makechrootpkg() {
+  local cur
+  COMPREPLY=()
+  _get_comp_words_by_ref cur
+
+  case $cur in
+    -*)
+       COMPREPLY=( $( compgen -W '-I -c -d -h -l -r -u' -- "$cur" ) )
+       ;;
+    *)
+      _filedir
+      return 0
+      ;;
+  esac
+
+  true
+} &&
+complete -F _makechrootpkg makechrootpkg
+
+_mkarchroot() {
+  local cur
+  COMPREPLY=()
+  _get_comp_words_by_ref cur
+
+  case $cur in
+    -*)
+       COMPREPLY=( $( compgen -W '-C -M -c -f -h -n -r -u' -- "$cur" ) )
+       ;;
+    *)
+      _filedir
+      return 0
+      ;;
+  esac
+
+  true
+} &&
+complete -F _mkarchroot mkarchroot
+
+
+# ex:et ts=2 sw=2 ft=sh

checkpkg

@@ -32,32 +32,31 @@ TEMPDIR=$(mktemp -d /tmp/checkpkg-script.XXXX)
 cd $TEMPDIR
 
 for _pkgname in ${pkgname[@]}; do
-	pkgfile=${_pkgname}-${pkgver}-${pkgrel}-${CARCH}${PKGEXT}
+	if [ -z ${epoch} ] ; then
-	oldstylepkgfile=${_pkgname}-${pkgver}-${pkgrel}${PKGEXT}
+		pkgfile=${_pkgname}-${pkgver}-${pkgrel}-${CARCH}${PKGEXT}
+	else
+		pkgfile=${_pkgname}-${epoch}:${pkgver}-${pkgrel}-${CARCH}${PKGEXT}
+	fi
 
 	if [ -f "$STARTDIR/$pkgfile" ]; then
-		cp "$STARTDIR/$pkgfile" .
+		ln -s "$STARTDIR/$pkgfile" "$pkgfile"
 	elif [ -f "$PKGDEST/$pkgfile" ]; then
-		cp "$PKGDEST/$pkgfile" .
+		ln -s "$PKGDEST/$pkgfile" "$pkgfile"
-	elif [ -f "$STARTDIR/$oldstylepkgfile" ]; then
-		cp "$STARTDIR/$oldstylepkgfile" .
-	elif [ -f "$PKGDEST/$oldstylepkgfile" ]; then
-		cp "$PKGDEST/$oldstylepkgfile" .
 	else
 		echo "File \"$pkgfile\" doesn't exist"
 		exit 1
 	fi
 
-	tmp=`pacman -Spd --noconfirm $_pkgname`
+	tmp=$(pacman -Spdd --noconfirm $_pkgname)
 
 	if [ $? -ne 0 ]; then
 		echo "Couldn't download previous package for $_pkgname."
 		exit 1
 	fi
 
-	pkgurl=`echo $tmp | rev | cut -d ' ' -f 1 | rev`
+	pkgurl=$(echo $tmp | rev | cut -d ' ' -f 1 | rev)
 
-	oldpkg=`strip_url $pkgurl`
+	oldpkg=$(strip_url $pkgurl)
 
 	if [ "$(basename $oldpkg)" = "$(basename $pkgfile)" ]; then
 		echo "The built package ($_pkgname) is the one in the repo right now!"
@@ -66,11 +65,11 @@ for _pkgname in ${pkgname[@]}; do
 
 	if [ ! -f $oldpkg ]; then
 		if echo $pkgurl | grep '^file:///' > /dev/null 2>&1; then
-			cp `echo $pkgurl | sed 's#^file://##'` .
+			ln -s "${pkgurl#file://}" $(basename "${pkgurl#file://}")
-		elif [ -f $PKGDEST/$oldpkg ]; then
+		elif [ -f "$PKGDEST/$oldpkg" ]; then
-			cp $PKGDEST/$oldpkg .
+			ln -s "$PKGDEST/$oldpkg" "$oldpkg"
-		elif [ -f $STARTDIR/$oldpkg ]; then
+		elif [ -f "$STARTDIR/$oldpkg" ]; then
-			cp $STARTDIR/$oldpkg .
+			ln -s "$STARTDIR/$oldpkg" "$oldpkg"
 		else
 			wget --quiet $pkgurl
 		fi
@@ -88,9 +87,8 @@ for _pkgname in ${pkgname[@]}; do
 		mkdir -p pkg
 		cd pkg
 		bsdtar xf ../"$pkgfile" > /dev/null
-		for i in `diff ../filelist-$_pkgname-old ../filelist-$_pkgname | grep \> | grep \.so | awk '{print $2}'`; do
+		for i in $(diff ../filelist-$_pkgname-old ../filelist-$_pkgname | grep \> | grep '\.so' | awk '{print $2}'); do
-			echo -n "${i}: "
+			echo "${i}: " "$(objdump -p $i | grep SONAME)"
-			objdump -p $i | grep SONAME
 		done
 		cd ..
 	else

commitpkg

@@ -51,44 +51,37 @@ fi
 . PKGBUILD
 pkgbase=${pkgbase:-$pkgname}
 
-# set up repo-specific opts depending on how we were called
+case "$cmd" in
-server='gerolde.archlinux.org'
+	commitpkg)
-if [ "$cmd" == 'extrapkg' ]; then
+		if [ $# -eq 0 ]; then
-	repo='extra'
+			abort 'usage: commitpkg <reponame> [-l limit] [-a arch] [commit message]'
-elif [ "$cmd" == 'corepkg' ]; then
+		fi
-	repo='core'
+		repo="$1"
-elif [ "$cmd" == 'testingpkg' ]; then
+		shift
-	repo='testing'
+		;;
-elif [ "$cmd" == 'stagingpkg' ]; then
+	*pkg)
-	repo='staging'
+		repo="${cmd%pkg}"
-elif [ "$cmd" == 'communitypkg' ]; then
+		;;
-	repo='community'
+	*)
-	server='aur.archlinux.org'
+		abort 'usage: commitpkg <reponame> [-l limit] [-a arch] [commit message]'
-elif [ "$cmd" == 'community-testingpkg' ]; then
+		;;
-	repo='community-testing'
+esac
-	server='aur.archlinux.org'
+
-elif [ "$cmd" == 'community-stagingpkg' ]; then
+case "$repo" in
-	repo='community-staging'
+	core|extra|testing|staging)
-	server='aur.archlinux.org'
+		server='gerolde.archlinux.org' ;;
-elif [ "$cmd" == 'multilibpkg' ]; then
+	community*|multilib*)
-	repo='multilib'
+		server='aur.archlinux.org' ;;
-	server='aur.archlinux.org'
+	*)
-elif [ "$cmd" == 'multilib-testingpkg' ]; then
+		server='gerolde.archlinux.org'
-	repo='multilib-testing'
+		echo "Non-standard repository $repo in use, defaulting to server $server" ;;
-	server='aur.archlinux.org'
+esac
-else
-	if [ $# -eq 0 ]; then
-		abort 'usage: commitpkg <reponame> [-l limit] [commit message]'
-	fi
-	repo="$1"
-	shift
-fi
 
 # check if all local source files are under version control
-for s in ${source[@]}; do
+for s in "${source[@]}"; do
-	echo $s | grep -Fvq '://' && \
+	if [[ $s != *://* ]] && ! svn status -v "$s" | grep -q '^[ AMRX~]'; then
-	svn status $s | grep -q '^\?' && \
+		abort "$s is not under version control"
-	abort "$s is not under version control"
+	fi
 done
 
 # check if changelog and install files are under version control
@@ -97,29 +90,58 @@ for i in 'changelog' 'install'; do
 	for file in $filelist; do
 		# evaluate any bash variables used
 		eval file=${file}
-		if svn status ${file} | grep -q '^\?'; then
+		if ! svn status -v "${file}" | grep -q '^[ AMRX~]'; then
 			abort "${file} is not under version control"
 		fi
 	done
 done
 
 # see if any limit options were passed, we'll send them to rsync
-unset rsyncopts
+rsyncopts='-e ssh -p --chmod=ug=rw,o=r -c -h -L --progress --partial -y'
 if [ "$1" = '-l' ]; then
-	rsyncopts="--bwlimit=$2"
+	rsyncopts="$rsyncopts --bwlimit=$2"
 	shift 2
 fi
 
-echo -n 'committing changes to trunk...'
+if [ "$1" = "-a" ]; then
-if [ -n "$1" ]; then
+	commit_arch=$2
-	svn commit -q -m "upgpkg: $pkgbase $pkgver-$pkgrel
+	shift 2
-$1" || abort
-else
-	svn commit -q || abort
 fi
-echo 'done'
+
+if [ -n "$(svn status -q)" ]; then
+	echo -n 'committing changes to trunk...'
+	msgtemplate="upgpkg: $pkgbase $(get_full_version ${epoch:-0} $pkgver $pkgrel)
+
+	"
+	if [ -n "$1" ]; then
+		svn commit -q -m "${msgtemplate}${1}" || abort
+	else
+		msgfile="$(mktemp)"
+		echo "$msgtemplate" > "$msgfile"
+		if [ -n "$SVN_EDITOR" ]; then
+			$SVN_EDITOR "$msgfile"
+		elif [ -n "$VISUAL" ]; then
+			$VISUAL "$msgfile"
+		elif [ -n "$EDITOR" ]; then
+			$EDITOR "$msgfile"
+		else
+			vi "$msgfile"
+		fi
+		[ -s "$msgfile" ] || abort
+		svn commit -q -F "$msgfile" || abort
+		unlink "$msgfile"
+	fi
+	echo 'done'
+fi
+
+declare -a uploads
 
 for _arch in ${arch[@]}; do
+	if [ -n "$commit_arch" ] && [ "${_arch}" != "$commit_arch" ]; then
+		echo "skipping ${_arch}"
+		continue
+	fi
+
 	for _pkgname in ${pkgname[@]}; do
 		fullver=$(get_full_version ${epoch:-0} $pkgver $pkgrel)
 		pkgfile=$(getpkgfile "$_pkgname-$fullver-${_arch}".pkg.tar.?z 2>/dev/null)
@@ -133,13 +155,31 @@ for _arch in ${arch[@]}; do
 			echo "skipping ${_arch}"
 			continue 2
 		fi
+		uploads+=("$pkgfile")
 
-		echo -n 'uploading '
+		if [[ $SIGNPKG == 'y' ]]; then
-		rsync -p --chmod 'ug=rw,o=r' -c -h -L --progress $rsyncopts --partial "${pkgfile}" -e ssh "$server:staging/$repo/${pkgfile##*/}" || abort
+			echo "Signing package ${pkgfile}..."
+			if [[ -n $GPGKEY ]]; then
+				SIGNWITHKEY="-u ${GPGKEY}"
+			fi
+			gpg --detach-sign --use-agent ${SIGNWITHKEY} "${pkgfile}" || abort
+		fi
+
+		sigfile="${pkgfile}.sig"
+		if [ -f "${sigfile}" ]; then
+			uploads+=("$sigfile")
+		elif [[ $SIGNPKG == 'y' ]]; then
+			abort "Signature ${pkgfile}.sig was not found"
+		fi
 	done
 	archrelease $repo-${_arch} || abort
 done
 
+if [[ ${#uploads[*]} -gt 0 ]]; then
+	echo 'uploading all package and signature files'
+	rsync $rsyncopts "${uploads[@]}" "$server:staging/$repo/" || abort
+fi
+
 if [ "${arch[*]}" == 'any' ]; then
 	if [ -d ../repos/$repo-i686 -a -d ../repos/$repo-x86_64 ]; then
 		pushd ../repos/ >/dev/null
@@ -150,4 +190,13 @@ if [ "${arch[*]}" == 'any' ]; then
 		echo 'done'
 		popd >/dev/null
 	fi
+else
+	if [ -d ../repos/$repo-any ]; then
+		pushd ../repos/ >/dev/null
+		echo "removing $repo-any..."
+		svn rm $repo-any
+		svn commit -q -m "removed $repo-any for $pkgname"
+		echo 'done'
+		popd >/dev/null
+	fi
 fi

communityco

@@ -1,10 +0,0 @@
-#!/bin/bash
-
-if [ "$1" = '' ]; then
-	echo 'Usage: communityco <package name> [<package name>]'
-	exit 1
-fi
-
-for i in "$@"; do
-	svn co svn+ssh://aur.archlinux.org/srv/svn-packages/$i
-done

lddd

@@ -4,9 +4,9 @@
 #
 
 ifs=$IFS
-IFS=':'
+IFS="${IFS}:"
 
-libdirs='/lib:/usr/lib:/opt/qt/lib:/opt/kde/lib:/usr/lib/libfakeroot:/opt/NX/lib'
+libdirs="/lib /usr/lib /usr/local/lib $(cat /etc/ld.so.conf.d/*)"
 extras=
 
 TEMPDIR=$(mktemp -d /tmp/lddd-script.XXXX)
@@ -25,9 +25,9 @@ for tree in $PATH $libdirs $extras; do
 	-name '*.mcopclass' ! -name '*.mcoptype')
 	IFS=$ifs
 	for i in $files; do
-		if [ `file $i | grep -c 'ELF'` -ne 0 ]; then
+		if [ $(file $i | grep -c 'ELF') -ne 0 ]; then
 			#  Is an ELF binary.
-			if [ `ldd $i 2>/dev/null | grep -c 'not found'` -ne 0 ]; then
+			if [ $(ldd $i 2>/dev/null | grep -c 'not found') -ne 0 ]; then
 				#  Missing lib.
 				echo "$i:" >> $TEMPDIR/raw.txt
 				ldd $i 2>/dev/null | grep 'not found' >> $TEMPDIR/raw.txt

makechrootpkg

@@ -74,8 +74,12 @@ done
 # Canonicalize chrootdir, getting rid of trailing /
 chrootdir=$(readlink -e "$chrootdir")
 
-[[ -z $copy ]] && copy=$default_copy
+if [[ ${copy:0:1} = "/" ]]; then
-copydir="$chrootdir/$copy"
+	copydir=$copy
+else
+	[[ -z $copy ]] && copy=$default_copy
+	copydir="$chrootdir/$copy"
+fi
 
 # Pass all arguments after -- right to makepkg
 MAKEPKG_ARGS="$MAKEPKG_ARGS ${*:$OPTIND}"
@@ -153,10 +157,10 @@ fi
 if [ -n "$install_pkg" ]; then
 	pkgname="$(basename "$install_pkg")"
 	cp "$install_pkg" "$copydir/$pkgname"
-	mkarchroot -r "pacman -U /$pkgname" "$copydir"
+	mkarchroot -r "pacman -U /$pkgname --noconfirm" "$copydir"
 	ret=$?
 	rm "$copydir/$pkgname"
-	#exit early, we've done all we need to
+	# Exit early, we've done all we need to
 	exit $ret
 fi
 
@@ -167,11 +171,11 @@ fi
 [ -d "$copydir/build" ] || mkdir "$copydir/build"
 
 if [ "$REPACK" != "1" ]; then
-	#Remove anything in there UNLESS -R (repack) was passed to makepkg
+	# Remove anything in there UNLESS -R (repack) was passed to makepkg
 	rm -rf "$copydir/build/"*
 fi
 
-# read .makpekg.conf even if called via sudo
+# Read .makepkg.conf even if called via sudo
 if [ -n "${SUDO_USER}" ]; then
 	makepkg_conf="/$(eval echo ~${SUDO_USER})/.makepkg.conf"
 else
@@ -277,7 +281,7 @@ if mkarchroot -r "/chrootbuild" "$copydir"; then
 		fi
 	done
 
-	for l in "${copydir}"/build/{namcap,*-{build,package,package_*}}.log; do
+	for l in "${copydir}"/build/{namcap,*-{build,check,package,package_*}}.log; do
 		[ -f "$l" ] && mv "$l" "${WORKDIR}"
 	done
 else

makepkg-i686.conf

@@ -29,9 +29,9 @@ CHOST="i686-pc-linux-gnu"
 #-- Exclusive: will only run on i686
 # -march (or -mcpu) builds exclusively for an architecture
 # -mtune optimizes for an architecture, but builds for whole processor family
-CFLAGS="-march=i686 -mtune=generic -O2 -pipe"
+CFLAGS="-march=i686 -mtune=generic -O2 -pipe -fstack-protector --param=ssp-buffer-size=4 -D_FORTIFY_SOURCE=2"
-CXXFLAGS="-march=i686 -mtune=generic -O2 -pipe"
+CXXFLAGS="-march=i686 -mtune=generic -O2 -pipe -fstack-protector --param=ssp-buffer-size=4 -D_FORTIFY_SOURCE=2"
-LDFLAGS="-Wl,--hash-style=gnu -Wl,--as-needed"
+LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,--hash-style=gnu"
 #-- Make Flags: change this for DistCC/SMP systems
 #MAKEFLAGS="-j2"
 

makepkg-x86_64.conf

@@ -29,9 +29,9 @@ CHOST="x86_64-unknown-linux-gnu"
 #-- Exclusive: will only run on x86_64
 # -march (or -mcpu) builds exclusively for an architecture
 # -mtune optimizes for an architecture, but builds for whole processor family
-CFLAGS="-march=x86-64 -mtune=generic -O2 -pipe"
+CFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fstack-protector --param=ssp-buffer-size=4 -D_FORTIFY_SOURCE=2"
-CXXFLAGS="-march=x86-64 -mtune=generic -O2 -pipe"
+CXXFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fstack-protector --param=ssp-buffer-size=4 -D_FORTIFY_SOURCE=2"
-LDFLAGS="-Wl,--hash-style=gnu -Wl,--as-needed"
+LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,--hash-style=gnu"
 #-- Make Flags: change this for DistCC/SMP systems
 #MAKEFLAGS="-j2"
 

mkarchroot

@@ -73,7 +73,7 @@ if [ -z "$cache_dir" ]; then
 fi
 
 if [ -f /etc/pacman.d/mirrorlist ]; then
-	host_mirror=$(pacman -Sdp extra/devtools 2>/dev/null | sed -E 's#(.*/)extra/os/.*#\1$repo/os/$arch#')
+	host_mirror=$(pacman -Sddp extra/devtools 2>/dev/null | sed -E 's#(.*/)extra/os/.*#\1$repo/os/$arch#')
 fi
 if [ -z "${host_mirror}" ]; then
 	host_mirror='http://mirrors.kernel.org/archlinux/$repo/os/$arch'
@@ -220,7 +220,7 @@ else
 	fi
 
 	if [ -e "${working_dir}/etc/locale.gen" ]; then
-		echo -e 'en_US.UTF-8 UTF-8\nde_DE.UTF-8 UTF-8' > "${working_dir}/etc/locale.gen"
+		sed -i 's@^#\(en_US\|de_DE\)\(\.UTF-8\)@\1\2@' "${working_dir}/etc/locale.gen"
 		chroot "${working_dir}" locale-gen
 	fi