Compare commits

...

3 Commits

Author SHA1 Message Date
Robin Candau
4c6e9c037b Merge branch 'exit_on_nvchecker_cmd_source' into 'master'
fix(version): Fail if the 'cmd' source is used in .nvchecker.toml

See merge request archlinux/devtools!295
2025-08-11 01:04:48 +02:00
Aaron Liu
3f0ebbc6d2 fix(license): add .gitignore to REUSE defaults
36 packages use this while 26 use *.pam and 21 use *.logrotate. Seems
anecdotally common enough to add this here.
2025-08-08 14:13:32 +02:00
Robin Candau
cfb99fd2d8 fix(version): Fail if the 'cmd' source is used in .nvchecker.toml
The [cmd](https://nvchecker.readthedocs.io/en/latest/usage.html#find-with-a-command) source allows nvchecker to use a shell command line to get versions. Using this source within `.nvchecker.toml` would result in `pkgctl version {check,upgrade}` to run arbitrary commands which isn't desirable, as it can lead to various issues (e.g. missing packages / dependencies to run said commands or even executing malicious commands in hypothetical worst case scenarios)
2025-01-04 12:25:32 +01:00
2 changed files with 7 additions and 0 deletions

View File

@@ -188,6 +188,7 @@ path = [
"README.md",
"keys/**",
".SRCINFO",
".gitignore",
".nvchecker.toml",
"*.install",
"*.sysusers",

View File

@@ -350,6 +350,12 @@ nvchecker_check_config() {
printf "non-pkgbase section not supported in %s: %s" "${config}" "${property}"
return 1
fi
# check if the config is using the 'cmd' source
if grep --extended-regexp --quiet '^\s*source\s*=\s*["'\'']cmd["'\'']\s*$' "${config}"; then
printf "using the 'cmd' source in %s is disallowed" "${config}"
return 1
fi
}
nvchecker_check_error() {