Do not assume the makechrootpkg user's groupname is the same as the username

chown support "$user:$group" but also "$user:" which infers $group
rather than leaving it as root. This looks up the group name in cases
where the default group is e.g. "users" and users do not get their own
unique groups.

Makefile

@@ -1,4 +1,4 @@
-V=20151002
+V=20171108
 
 PREFIX = /usr/local
 
@@ -19,7 +19,6 @@ BINPROGS = \
 	makechrootpkg
 
 CONFIGFILES = \
-	makepkg-i686.conf \
 	makepkg-x86_64.conf \
 	pacman-extra.conf \
 	pacman-testing.conf \
@@ -32,7 +31,6 @@ CONFIGFILES = \
 
 COMMITPKG_LINKS = \
 	extrapkg \
-	corepkg \
 	testingpkg \
 	stagingpkg \
 	communitypkg \
@@ -45,18 +43,13 @@ COMMITPKG_LINKS = \
 	gnome-unstablepkg
 
 ARCHBUILD_LINKS = \
-	extra-i686-build \
 	extra-x86_64-build \
-	testing-i686-build \
 	testing-x86_64-build \
-	staging-i686-build \
 	staging-x86_64-build \
 	multilib-build \
 	multilib-testing-build \
 	multilib-staging-build \
-	kde-unstable-i686-build \
 	kde-unstable-x86_64-build \
-	gnome-unstable-i686-build \
 	gnome-unstable-x86_64-build
 
 CROSSREPOMOVE_LINKS = \
@@ -74,7 +67,7 @@ edit = sed -e "s|@pkgdatadir[@]|$(DESTDIR)$(PREFIX)/share/devtools|g"
 %: %.in Makefile lib/common.sh
 	@echo "GEN $@"
 	@$(RM) "$@"
-	@m4 -P $@.in | $(edit) >$@
+	@{ echo -n 'm4_changequote([[[,]]])'; cat $@.in; } | m4 -P | $(edit) >$@
 	@chmod a-w "$@"
 	@chmod +x "$@"
 	@bash -O extglob -n "$@"
@@ -112,6 +105,10 @@ dist:
 	gpg --detach-sign --use-agent devtools-$(V).tar.gz
 
 upload:
-	scp devtools-$(V).tar.gz devtools-$(V).tar.gz.sig nymeria.archlinux.org:/srv/ftp/other/devtools/
+	scp devtools-$(V).tar.gz devtools-$(V).tar.gz.sig repos.archlinux.org:/srv/ftp/other/devtools/
 
-.PHONY: all clean install uninstall dist upload
+check: $(BINPROGS) bash_completion makepkg-x86_64.conf PKGBUILD.proto
+	shellcheck $^
+
+.PHONY: all clean install uninstall dist upload check
+.DELETE_ON_ERROR:

PKGBUILD.proto

@@ -0,0 +1,48 @@
+#!/hint/bash
+# shellcheck disable=2034
+
+# This is an example PKGBUILD file, so that shellcheck can know what
+# variables to expect be set after including a PKGBUILD.
+
+# Maintainer: Your Name <youremail@domain.com>
+pkgname=NAME
+pkgver=VERSION
+pkgrel=1
+epoch=
+pkgdesc=""
+arch=()
+url=""
+license=('GPL')
+groups=()
+depends=()
+makedepends=()
+checkdepends=()
+optdepends=()
+provides=()
+conflicts=()
+replaces=()
+backup=()
+options=()
+install=
+changelog=
+source=("$pkgname-$pkgver.tar.gz"
+        "$pkgname-$pkgver.patch")
+noextract=()
+md5sums=()
+validpgpkeys=()
+
+prepare() {
+	:
+}
+
+build() {
+	:
+}
+
+check() {
+	:
+}
+
+package() {
+	:
+}

arch-nspawn.in

@@ -1,4 +1,6 @@
 #!/bin/bash
+# License: GNU GPLv2
+#
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; version 2 of the License.
@@ -9,11 +11,12 @@
 # GNU General Public License for more details.
 
 m4_include(lib/common.sh)
-
-CHROOT_VERSION='v3'
+m4_include(lib/archroot.sh)
 
 working_dir=''
 
+files=()
+
 usage() {
 	echo "Usage: ${0##*/} [options] working-dir [systemd-nspawn arguments]"
 	echo "A wrapper around systemd-nspawn. Provides support for pacman."
@@ -22,25 +25,27 @@ usage() {
 	echo '    -C <file>     Location of a pacman config file'
 	echo '    -M <file>     Location of a makepkg config file'
 	echo '    -c <dir>      Set pacman cache'
+	echo '    -f <file>     Copy file from the host to the chroot'
+	echo '    -s            Do not run setarch'
 	echo '    -h            This message'
 	exit 1
 }
 
-orig_argv=("$@")
-
-while getopts 'hC:M:c:' arg; do
+while getopts 'hC:M:c:f:s' arg; do
 	case "$arg" in
 		C) pac_conf="$OPTARG" ;;
 		M) makepkg_conf="$OPTARG" ;;
 		c) cache_dir="$OPTARG" ;;
+		f) files+=("$OPTARG") ;;
+		s) nosetarch=1 ;;
 		h|?) usage ;;
-		*) error "invalid argument '$arg'"; usage ;;
+		*) error "invalid argument '%s'" "$arg"; usage ;;
 	esac
 done
-shift $(($OPTIND - 1))
+shift $((OPTIND - 1))
 
 (( $# < 1 )) && die 'You must specify a directory.'
-check_root "$0" "${orig_argv[@]}"
+check_root
 
 working_dir=$(readlink -f "$1")
 shift 1
@@ -53,7 +58,10 @@ else
 	cache_dirs=("$cache_dir")
 fi
 
-host_mirror=$(pacman -Sddp extra/devtools 2>/dev/null | sed -r 's#(.*/)extra/os/.*#\1$repo/os/$arch#')
+pacconf_cmd=$(command -v pacman-conf || command -v pacconf)
+# shellcheck disable=2016
+host_mirror=$($pacconf_cmd --repo extra Server 2> /dev/null | head -1 | sed -r 's#(.*/)extra/os/.*#\1$repo/os/$arch#')
+# shellcheck disable=2016
 [[ $host_mirror == *file://* ]] && host_mirror_path=$(echo "$host_mirror" | sed -r 's#file://(/.*)/\$repo/os/\$arch#\1#g')
 
 # {{{ functions
@@ -61,13 +69,13 @@ build_mount_args() {
 	declare -g mount_args=()
 
 	if [[ -n $host_mirror_path ]]; then
-		mount_args+=(--bind-ro="$host_mirror_path")
+		mount_args+=("--bind-ro=$host_mirror_path")
 	fi
 
-	mount_args+=(--bind="${cache_dirs[0]}")
+	mount_args+=("--bind=${cache_dirs[0]}")
 
-	for cache_dir in ${cache_dirs[@]:1}; do
-		mount_args+=(--bind-ro="$cache_dir")
+	for cache_dir in "${cache_dirs[@]:1}"; do
+		mount_args+=("--bind-ro=$cache_dir")
 	done
 }
 
@@ -75,10 +83,16 @@ copy_hostconf () {
 	cp -a /etc/pacman.d/gnupg "$working_dir/etc/pacman.d"
 	echo "Server = $host_mirror" >"$working_dir/etc/pacman.d/mirrorlist"
 
-	[[ -n $pac_conf ]] && cp $pac_conf "$working_dir/etc/pacman.conf"
-	[[ -n $makepkg_conf ]] && cp $makepkg_conf "$working_dir/etc/makepkg.conf"
+	[[ -n $pac_conf ]] && cp "$pac_conf" "$working_dir/etc/pacman.conf"
+	[[ -n $makepkg_conf ]] && cp "$makepkg_conf" "$working_dir/etc/makepkg.conf"
 
-	sed -r "s|^#?\\s*CacheDir.+|CacheDir = $(echo -n ${cache_dirs[@]})|g" -i "$working_dir/etc/pacman.conf"
+	local file
+	for file in "${files[@]}"; do
+		mkdir -p "$(dirname "$working_dir$file")"
+		cp -T "$file" "$working_dir$file"
+	done
+
+	sed -r "s|^#?\\s*CacheDir.+|CacheDir = ${cache_dirs[*]}|g" -i "$working_dir/etc/pacman.conf"
 }
 # }}}
 
@@ -87,17 +101,20 @@ umask 0022
 # Sanity check
 if [[ ! -f "$working_dir/.arch-chroot" ]]; then
 	die "'%s' does not appear to be an Arch chroot." "$working_dir"
-elif [[ $(cat "$working_dir/.arch-chroot") != $CHROOT_VERSION ]]; then
+elif [[ $(cat "$working_dir/.arch-chroot") != "$CHROOT_VERSION" ]]; then
 	die "chroot '%s' is not at version %s. Please rebuild." "$working_dir" "$CHROOT_VERSION"
 fi
 
 build_mount_args
 copy_hostconf
 
-eval $(grep '^CARCH=' "$working_dir/etc/makepkg.conf")
+eval "$(grep -a '^CARCH=' "$working_dir/etc/makepkg.conf")"
 
-exec ${CARCH:+setarch "$CARCH"} systemd-nspawn 2>/dev/null \
+[[ -z $nosetarch ]] || unset CARCH
+
+exec ${CARCH:+setarch "$CARCH"} systemd-nspawn -q \
 	-D "$working_dir" \
-	--register=no \
+	-E "PATH=/usr/local/sbin:/usr/local/bin:/usr/bin" \
+	--register=no --keep-unit --as-pid2 \
 	"${mount_args[@]}" \
 	"$@"

archbuild.in

@@ -1,6 +1,8 @@
 #!/bin/bash
+# License: Unspecified
 
 m4_include(lib/common.sh)
+m4_include(lib/archroot.sh)
 
 base_packages=(base-devel)
 makechrootpkg_args=(-c -n)
@@ -29,8 +31,6 @@ usage() {
 	exit 1
 }
 
-orig_argv=("$@")
-
 while getopts 'hcr:' arg; do
 	case "${arg}" in
 		c) clean_first=true ;;
@@ -39,26 +39,24 @@ while getopts 'hcr:' arg; do
 	esac
 done
 
-check_root "$0" "${orig_argv[@]}"
+check_root SOURCE_DATE_EPOCH
 
 # Pass all arguments after -- right to makepkg
 makechrootpkg_args+=("${@:$OPTIND}")
 
 if ${clean_first} || [[ ! -d "${chroots}/${repo}-${arch}" ]]; then
-	msg "Creating chroot for [${repo}] (${arch})..."
+	msg "Creating chroot for [%s] (%s)..." "${repo}" "${arch}"
 
 	for copy in "${chroots}/${repo}-${arch}"/*; do
 		[[ -d $copy ]] || continue
-		msg2 "Deleting chroot copy '$(basename "${copy}")'..."
+		msg2 "Deleting chroot copy '%s'..." "$(basename "${copy}")"
 
-		lock 9 "$copy.lock" "Locking chroot copy '$copy'"
+		lock 9 "$copy.lock" "Locking chroot copy '%s'" "$copy"
 
-		if [[ "$(stat -f -c %T "${copy}")" == btrfs ]]; then
-			{ type -P btrfs && btrfs subvolume delete "${copy}"; } &>/dev/null
-		fi
+		subvolume_delete_recursive "${copy}"
 		rm -rf --one-file-system "${copy}"
 	done
-	exec 9>&-
+	lock_close 9
 
 	rm -rf --one-file-system "${chroots}/${repo}-${arch}"
 	mkdir -p "${chroots}/${repo}-${arch}"
@@ -76,5 +74,10 @@ else
                 pacman -Syu --noconfirm || abort
 fi
 
-msg "Building in chroot for [${repo}] (${arch})..."
+# Always build official packages reproducibly
+if [[ ! -v SOURCE_DATE_EPOCH ]]; then
+	export SOURCE_DATE_EPOCH=$(date +%s)
+fi
+
+msg "Building in chroot for [%s] (%s)..." "${repo}" "${arch}"
 exec makechrootpkg -r "${chroots}/${repo}-${arch}" "${makechrootpkg_args[@]}"

archco.in

@@ -1,19 +1,20 @@
 #!/bin/bash
+# License: Unspecified
 
 m4_include(lib/common.sh)
 
 scriptname=${0##*/}
 
 if [[ -z $1 ]]; then
-	echo 'Usage: '$scriptname' <package name>...'
+	printf 'Usage: %s <package name>...\n' "$scriptname"
 	exit 1
 fi
 
 case $scriptname in
 	archco)
-		SVNURL="svn+ssh://svn-packages@nymeria.archlinux.org/srv/repos/svn-packages/svn";;
+		SVNURL="svn+ssh://svn-packages@repos.archlinux.org/srv/repos/svn-packages/svn";;
 	communityco)
-		SVNURL="svn+ssh://svn-community@nymeria.archlinux.org/srv/repos/svn-community/svn";;
+		SVNURL="svn+ssh://svn-community@repos.archlinux.org/srv/repos/svn-community/svn";;
 	*)
 		die "Couldn't find svn url for %s" "$scriptname"
 		;;

archrelease.in

@@ -1,4 +1,5 @@
 #!/bin/bash
+# License: Unspecified
 
 m4_include(lib/common.sh)
 m4_include(lib/valid-tags.sh)
@@ -37,7 +38,7 @@ trunk=${PWD##*/}
 # Normally this should be trunk, but it may be something
 # such as 'gnome-unstable'
 IFS='/' read -r -d '' -a parts <<< "$PWD"
-if [[ "${parts[@]:(-2):1}" == "repos" ]]; then
+if [[ "${parts[*]:(-2):1}" == "repos" ]]; then
 	die 'archrelease: Should not be in repos dir (try from trunk/)'
 fi
 unset parts
@@ -57,8 +58,11 @@ done
 # gracefully handle files containing an "@" character
 known_files=("${known_files[@]/%/@}")
 
+# update repo directory first to avoid a commit failure
+svn up repos
+
 for tag in "$@"; do
-	stat_busy "Copying ${trunk} to ${tag}"
+	stat_busy "Copying %s to %s" "${trunk}" "${tag}"
 
 	if [[ -d repos/$tag ]]; then
 		declare -a trash
@@ -66,14 +70,14 @@ for tag in "$@"; do
 		while read -r file; do
 			trash+=("repos/$tag/$file")
 		done < <(svn ls "repos/$tag")
-		[[ $trash ]] && svn rm -q "${trash[@]/%/@}"
+		[[ ${#trash[@]} == 0 ]] || svn rm -q "${trash[@]/%/@}"
 	else
 		mkdir -p "repos/$tag"
 		svn add --parents -q "repos/$tag"
 	fi
 
 	# copy all files at once from trunk to the subdirectory in repos/
-	svn copy -q -r HEAD ${known_files[@]/#/$trunk/} "repos/$tag/"
+	svn copy -q -r HEAD "${known_files[@]/#/$trunk/}" "repos/$tag/"
 
 	stat_done
 done

archrm.in

@@ -1,4 +1,5 @@
 #!/bin/bash
+# License: Unspecified
 
 m4_include(lib/common.sh)
 
@@ -12,4 +13,4 @@ fi
 #
 #popd
 
-rm -rf $1
+rm -rf "$1"

bash_completion.in

@@ -1,9 +1,12 @@
+#!/hint/bash
+# License: Unspecified
+
 _devtools_compgen() {
   local i r
   COMPREPLY=($(compgen -W '$*' -- "$cur"))
   for ((i=1; i < ${#COMP_WORDS[@]}-1; i++)); do
-    for r in ${!COMPREPLY[@]}; do
-      if [[ ${COMP_WORDS[i]} = ${COMPREPLY[r]} ]]; then
+    for r in "${!COMPREPLY[@]}"; do
+      if [[ ${COMP_WORDS[i]} = "${COMPREPLY[r]}" ]]; then
         unset 'COMPREPLY[r]'; break
       fi
     done
@@ -12,7 +15,7 @@ _devtools_compgen() {
 
 _archco_pkg() {
   _devtools_compgen "$(
-      \pacman -$1
+      command pacman "-$1"
   )"
 }
 

checkpkg.in

@@ -1,4 +1,5 @@
 #!/bin/bash
+# License: Unspecified
 
 shopt -s extglob
 
@@ -6,22 +7,28 @@ m4_include(lib/common.sh)
 
 # Source makepkg.conf; fail if it is not found
 if [[ -r '/etc/makepkg.conf' ]]; then
+	# shellcheck source=makepkg-x86_64.conf
 	source '/etc/makepkg.conf'
 else
 	die '/etc/makepkg.conf not found!'
 fi
 
 # Source user-specific makepkg.conf overrides
-if [[ -r ~/.makepkg.conf ]]; then
-	source ~/.makepkg.conf
+if [[ -r "${XDG_CONFIG_HOME:-$HOME/.config}/pacman/makepkg.conf" ]]; then
+	# shellcheck source=/dev/null
+	source "${XDG_CONFIG_HOME:-$HOME/.config}/pacman/makepkg.conf"
+elif [[ -r "$HOME/.makepkg.conf" ]]; then
+	# shellcheck source=/dev/null
+	source "$HOME/.makepkg.conf"
 fi
 
 if [[ ! -f PKGBUILD ]]; then
 	die 'This must be run in the directory of a built package.'
 fi
 
+# shellcheck source=PKGBUILD.proto
 . ./PKGBUILD
-if [[ $arch == 'any' ]]; then
+if [[ ${arch[0]} == 'any' ]]; then
 	CARCH='any'
 fi
 
@@ -36,15 +43,12 @@ for _pkgname in "${pkgname[@]}"; do
 
 	ln -s "$pkgfile" "$TEMPDIR"
 
-	pkgurl=$(pacman -Spdd --print-format '%l' --noconfirm "$_pkgname")
-
-	if [[ $? -ne 0 ]]; then
+	pkgurl=$(pacman -Spdd --print-format '%l' --noconfirm "$_pkgname") ||
 		die "Couldn't download previous package for %s." "$_pkgname"
-	fi
 
 	oldpkg=${pkgurl##*://*/}
 
-	if [[ ${oldpkg##*/} = ${pkgfile##*/} ]]; then
+	if [[ ${oldpkg##*/} = "${pkgfile##*/}" ]]; then
 		die "The built package (%s) is the one in the repo right now!" "$_pkgname"
 	fi
 
@@ -69,8 +73,8 @@ for _pkgname in "${pkgname[@]}"; do
 		msg "Sonames differ in $_pkgname!"
 		echo "$diff_output"
 	else
-		msg "No soname differences for $_pkgname."
+		msg "No soname differences for %s." "$_pkgname"
 	fi
 done
 
-msg "Files saved to $TEMPDIR"
+msg "Files saved to %s" "$TEMPDIR"

commitpkg.in

@@ -1,17 +1,23 @@
 #!/bin/bash
+# License: Unspecified
 
 m4_include(lib/common.sh)
 
 # Source makepkg.conf; fail if it is not found
 if [[ -r '/etc/makepkg.conf' ]]; then
+	# shellcheck source=makepkg-x86_64.conf
 	source '/etc/makepkg.conf'
 else
 	die '/etc/makepkg.conf not found!'
 fi
 
 # Source user-specific makepkg.conf overrides
-if [[ -r ~/.makepkg.conf ]]; then
-	. ~/.makepkg.conf
+if [[ -r "${XDG_CONFIG_HOME:-$HOME/.config}/pacman/makepkg.conf" ]]; then
+	# shellcheck source=/dev/null
+	source "${XDG_CONFIG_HOME:-$HOME/.config}/pacman/makepkg.conf"
+elif [[ -r "$HOME/.makepkg.conf" ]]; then
+	# shellcheck source=/dev/null
+	source "$HOME/.makepkg.conf"
 fi
 
 cmd=${0##*/}
@@ -20,6 +26,8 @@ if [[ ! -f PKGBUILD ]]; then
 	die 'No PKGBUILD file'
 fi
 
+source=()
+# shellcheck source=PKGBUILD.proto
 . ./PKGBUILD
 pkgbase=${pkgbase:-$pkgname}
 
@@ -47,7 +55,7 @@ done
 for i in 'changelog' 'install'; do
 	while read -r file; do
 		# evaluate any bash variables used
-		eval file=\"$(sed 's/^\(['\''"]\)\(.*\)\1$/\2/' <<< "$file")\"
+		eval "file=\"$(sed "s/^\(['\"]\)\(.*\)\1\$/\2/" <<< "$file")\""
 		needsversioning+=("$file")
 	done < <(sed -n "s/^[[:space:]]*$i=//p" PKGBUILD)
 done
@@ -61,7 +69,7 @@ if (( ${#needsversioning[*]} )); then
 	(( ${#unversioned[*]} )) && die "%s is not under version control" "${unversioned[@]}"
 fi
 
-rsyncopts=(-e ssh -p --chmod=ug=rw,o=r -c -h -L --progress --partial -y)
+rsyncopts=(-e ssh -p '--chmod=ug=rw,o=r' -c -h -L --progress --partial -y)
 archreleaseopts=()
 while getopts ':l:a:s:f' flag; do
 	case $flag in
@@ -76,12 +84,12 @@ done
 shift $(( OPTIND - 1 ))
 
 # check packages have the packager field set
-for _arch in ${arch[@]}; do
+for _arch in "${arch[@]}"; do
 	if [[ -n $commit_arch && ${_arch} != "$commit_arch" ]]; then
 		continue
 	fi
-	for _pkgname in ${pkgname[@]}; do
-		fullver=$(get_full_version $_pkgname)
+	for _pkgname in "${pkgname[@]}"; do
+		fullver=$(get_full_version "$_pkgname")
 
 		if pkgfile=$(find_cached_package "$_pkgname" "$_arch" "$fullver"); then
 			if grep -q "packager = Unknown Packager" <(bsdtar -xOqf "$pkgfile" .PKGINFO); then
@@ -92,7 +100,7 @@ for _arch in ${arch[@]}; do
 done
 
 if [[ -z $server ]]; then
-	server='nymeria.archlinux.org'
+	server='repos.archlinux.org'
 fi
 
 if [[ -n $(svn status -q) ]]; then
@@ -125,29 +133,29 @@ declare -a uploads
 declare -a commit_arches
 declare -a skip_arches
 
-for _arch in ${arch[@]}; do
+for _arch in "${arch[@]}"; do
 	if [[ -n $commit_arch && ${_arch} != "$commit_arch" ]]; then
-		skip_arches+=($_arch)
+		skip_arches+=("$_arch")
 		continue
 	fi
 
-	for _pkgname in ${pkgname[@]}; do
-		fullver=$(get_full_version $_pkgname)
+	for _pkgname in "${pkgname[@]}"; do
+		fullver=$(get_full_version "$_pkgname")
 
 		if ! pkgfile=$(find_cached_package "$_pkgname" "$fullver" "${_arch}"); then
-			warning "Skipping $_pkgname-$fullver-$_arch: failed to locate package file"
-			skip_arches+=($_arch)
+			warning "Skipping %s: failed to locate package file" "$_pkgname-$fullver-$_arch"
+			skip_arches+=("$_arch")
 			continue 2
 		fi
 		uploads+=("$pkgfile")
 
 		sigfile="${pkgfile}.sig"
 		if [[ ! -f $sigfile ]]; then
-			msg "Signing package ${pkgfile}..."
+			msg "Signing package %s..." "${pkgfile}"
 			if [[ -n $GPGKEY ]]; then
-				SIGNWITHKEY="-u ${GPGKEY}"
+				SIGNWITHKEY=(-u "${GPGKEY}")
 			fi
-			gpg --detach-sign --use-agent --no-armor ${SIGNWITHKEY} "${pkgfile}" || die
+			gpg --detach-sign --use-agent --no-armor "${SIGNWITHKEY[@]}" "${pkgfile}" || die
 		fi
 		if ! gpg --verify "$sigfile" >/dev/null 2>&1; then
 			die "Signature %s.sig is incorrect!" "$pkgfile"
@@ -156,9 +164,9 @@ for _arch in ${arch[@]}; do
 	done
 done
 
-for _arch in ${arch[@]}; do
-	if ! in_array $_arch ${skip_arches[@]}; then
-		commit_arches+=($_arch)
+for _arch in "${arch[@]}"; do
+	if ! in_array "$_arch" "${skip_arches[@]}"; then
+		commit_arches+=("$_arch")
 	fi
 done
 
@@ -181,20 +189,19 @@ if [[ ${#uploads[*]} -gt 0 ]]; then
 fi
 
 if [[ "${arch[*]}" == 'any' ]]; then
-	if [[ -d ../repos/$repo-i686 && -d ../repos/$repo-x86_64 ]]; then
+	if [[ -d ../repos/$repo-x86_64 ]]; then
 		pushd ../repos/ >/dev/null
-		stat_busy "Removing $repo-i686 and $repo-x86_64"
-		svn rm -q $repo-i686
-		svn rm -q $repo-x86_64
-		svn commit -q -m "Removed $repo-i686 and $repo-x86_64 for $pkgname"
+		stat_busy "Removing %s" "$repo-x86_64"
+		svn rm -q "$repo-x86_64"
+		svn commit -q -m "Removed $repo-x86_64 for $pkgname"
 		stat_done
 		popd >/dev/null
 	fi
 else
 	if [[ -d ../repos/$repo-any ]]; then
 		pushd ../repos/ >/dev/null
-		stat_busy "Removing $repo-any"
-		svn rm -q $repo-any
+		stat_busy "Removing %s" "$repo-any"
+		svn rm -q "$repo-any"
 		svn commit -q -m "Removed $repo-any for $pkgname"
 		stat_done
 		popd >/dev/null

crossrepomove.in

@@ -1,11 +1,12 @@
 #!/bin/bash
+# License: Unspecified
 
 m4_include(lib/common.sh)
 
 scriptname=${0##*/}
 
 if [[ -z $1 ]]; then
-	echo 'Usage: '$scriptname' [pkgbase]'
+	printf 'Usage: %s [pkgbase]\n' "$scriptname"
 	exit 1
 fi
 
@@ -29,7 +30,7 @@ case $scriptname in
 		;;
 esac
 
-server='nymeria.archlinux.org'
+server='repos.archlinux.org'
 source_svn="svn+ssh://svn-${source_name}@${server}/srv/repos/svn-${source_name}/svn"
 target_svn="svn+ssh://svn-${target_name}@${server}/srv/repos/svn-${target_name}/svn"
 source_dbscripts="/srv/repos/svn-${source_name}/dbscripts"
@@ -37,29 +38,31 @@ target_dbscripts="/srv/repos/svn-${target_name}/dbscripts"
 
 setup_workdir
 
-pushd $WORKDIR >/dev/null
+pushd "$WORKDIR" >/dev/null
 
-msg "Downloading sources for ${pkgbase}"
+msg "Downloading sources for %s" "${pkgbase}"
 svn -q checkout -N "${target_svn}" target_checkout
 mkdir -p "target_checkout/${pkgbase}/repos"
 svn -q export "${source_svn}/${pkgbase}/trunk" "target_checkout/${pkgbase}/trunk" || die
+# shellcheck source=PKGBUILD.proto
 . "target_checkout/${pkgbase}/trunk/PKGBUILD"
 
-msg "Downloading packages for ${pkgbase}"
-for _arch in ${arch[@]}; do
+msg "Downloading packages for %s" "${pkgbase}"
+for _arch in "${arch[@]}"; do
 	if [[ "${_arch[*]}" == 'any' ]]; then
 		repo_arch='x86_64'
 	else
 		repo_arch=${_arch}
 	fi
-	for _pkgname in ${pkgname[@]}; do
-		fullver=$(get_full_version $_pkgname)
+	for _pkgname in "${pkgname[@]}"; do
+		fullver=$(get_full_version "$_pkgname")
 		pkgpath="/srv/ftp/$source_repo/os/$repo_arch/$_pkgname-$fullver-${_arch}.pkg.tar.*"
+		# shellcheck disable=2029
 		ssh "$server" "cp $pkgpath staging/$target_repo" || die
 	done
 done
 
-msg "Adding ${pkgbase} to ${target_repo}"
+msg "Adding %s to %s" "${pkgbase}" "${target_repo}"
 svn -q add "target_checkout/${pkgbase}"
 svn -q propset svn:keywords 'Id' "target_checkout/${pkgbase}/trunk/PKGBUILD"
 svn -q commit -m"${scriptname}: Moving ${pkgbase} from ${source_repo} to ${target_repo}" target_checkout
@@ -67,10 +70,12 @@ pushd "target_checkout/${pkgbase}/trunk" >/dev/null
 archrelease "${arch[@]/#/$target_repo-}" || die
 popd >/dev/null
 
+# shellcheck disable=2029
 ssh "${server}" "${target_dbscripts}/db-update" || die
 
-msg "Removing ${pkgbase} from ${source_repo}"
-for _arch in ${arch[@]}; do
+msg "Removing %s from %s" "${pkgbase}" "${source_repo}"
+for _arch in "${arch[@]}"; do
+	# shellcheck disable=2029
 	ssh "${server}" "${source_dbscripts}/db-remove ${source_repo} ${_arch} ${pkgbase}"
 done
 svn -q checkout -N "${source_svn}" source_checkout

find-libdeps.in

@@ -1,4 +1,5 @@
 #!/bin/bash
+# License: Unspecified
 
 m4_include(lib/common.sh)
 
@@ -27,7 +28,7 @@ if [[ -z $1 ]]; then
 fi
 
 if [[ -d $1 ]]; then
-	pushd $1 >/dev/null
+	pushd "$1" >/dev/null
 else
 	setup_workdir
 
@@ -44,10 +45,10 @@ process_sofile() {
 	soname="${sofile%.so?(+(.+([0-9])))}".so
 	# extract the major version: 1
 	soversion="${sofile##*\.so\.}"
-	if [[ "$soversion" = "$sofile" ]] && (($IGNORE_INTERNAL)); then
+	if [[ "$soversion" = "$sofile" ]] && ((IGNORE_INTERNAL)); then
 		continue
 	fi
-	if ! in_array "${soname}=${soversion}-${soarch}" ${soobjects[@]}; then
+	if ! in_array "${soname}=${soversion}-${soarch}" "${soobjects[@]}"; then
 		# libfoo.so=1-64
 		echo "${soname}=${soversion}-${soarch}"
 		soobjects+=("${soname}=${soversion}-${soarch}")
@@ -59,7 +60,7 @@ case $script_mode in
   provides) find_args=(-name '*.so*');;
 esac
 
-find . -type f "${find_args[@]}" | while read filename; do
+find . -type f "${find_args[@]}" | while read -r filename; do
 	if [[ $script_mode = "provides" ]]; then
 		# ignore if we don't have a shared object
 		if ! LC_ALL=C readelf -h "$filename" 2>/dev/null | grep -q '.*Type:.*DYN (Shared object file).*'; then

finddeps.in

@@ -2,6 +2,7 @@
 #
 # finddeps - find packages that depend on a given depname
 #
+# License: Unspecified
 
 m4_include(lib/common.sh)
 
@@ -16,24 +17,25 @@ if [[ -z $match ]]; then
 	exit 1
 fi
 
-find . -type d | while read d; do
+find . -type d | while read -r d; do
 	if [[ -f "$d/PKGBUILD" ]]; then
-		unset pkgname depends makedepends optdepends
+		pkgname=() depends=() makedepends=() optdepends=()
+		# shellcheck source=PKGBUILD.proto
 		. "$d/PKGBUILD"
 		for dep in "${depends[@]}"; do
 			# lose the version comparator, if any
 			depname=${dep%%[<>=]*}
-			[[ $depname = $match ]] && echo "$d (depends)"
+			[[ $depname = "$match" ]] && echo "$d (depends)"
 		done
 		for dep in "${makedepends[@]}"; do
 			# lose the version comparator, if any
 			depname=${dep%%[<>=]*}
-			[[ $depname = $match ]] && echo "$d (makedepends)"
+			[[ $depname = "$match" ]] && echo "$d (makedepends)"
 		done
 		for dep in "${optdepends[@]/:*}"; do
 			# lose the version comaparator, if any
 			depname=${dep%%[<>=]*}
-			[[ $depname = $match ]] && echo "$d (optdepends)"
+			[[ $depname = "$match" ]] && echo "$d (optdepends)"
 		done
 	fi
 done

lddd.in

@@ -2,6 +2,7 @@
 #
 # lddd - find broken library links on your machine
 #
+# License: Unspecified
 
 m4_include(lib/common.sh)
 
@@ -16,10 +17,10 @@ TEMPDIR=$(mktemp -d --tmpdir lddd-script.XXXX)
 msg 'Go out and drink some tea, this will take a while :) ...'
 #  Check ELF binaries in the PATH and specified dir trees.
 for tree in $PATH $libdirs $extras; do
-	msg2 "DIR $tree"
+	msg2 "DIR %s" "$tree"
 
 	#  Get list of files in tree.
-	files=$(find $tree -type f ! -name '*.a' ! -name '*.la' ! -name '*.py*' ! -name '*.txt' ! -name '*.h' ! -name '*.ttf' ! \
+	files=$(find "$tree" -type f ! -name '*.a' ! -name '*.la' ! -name '*.py*' ! -name '*.txt' ! -name '*.h' ! -name '*.ttf' ! \
 	-name '*.rb' ! -name '*.ko' ! -name '*.pc' ! -name '*.enc' ! -name '*.cf' ! -name '*.def' ! -name '*.rules' ! -name \
 	'*.cmi' ! -name  '*.mli' ! -name '*.ml' ! -name '*.cma' ! -name '*.cmx' ! -name '*.cmxa' ! -name '*.pod' ! -name '*.pm' \
 	! -name '*.pl' ! -name '*.al' ! -name '*.tcl' ! -name '*.bs' ! -name '*.o' ! -name '*.png' ! -name '*.gif' ! -name '*.cmo' \
@@ -27,22 +28,22 @@ for tree in $PATH $libdirs $extras; do
 	-name '*.mcopclass' ! -name '*.mcoptype')
 	IFS=$ifs
 	for i in $files; do
-		if (( $(file $i | grep -c 'ELF') != 0 )); then
+		if (( $(file "$i" | grep -c 'ELF') != 0 )); then
 			#  Is an ELF binary.
-			if (( $(ldd $i 2>/dev/null | grep -c 'not found') != 0 )); then
+			if (( $(ldd "$i" 2>/dev/null | grep -c 'not found') != 0 )); then
 				#  Missing lib.
-				echo "$i:" >> $TEMPDIR/raw.txt
-				ldd $i 2>/dev/null | grep 'not found' >> $TEMPDIR/raw.txt
+				echo "$i:" >> "$TEMPDIR/raw.txt"
+				ldd "$i" 2>/dev/null | grep 'not found' >> "$TEMPDIR/raw.txt"
 			fi
 		fi
 	done
 done
-grep '^/' $TEMPDIR/raw.txt | sed -e 's/://g' >> $TEMPDIR/affected-files.txt
+grep '^/' "$TEMPDIR/raw.txt" | sed -e 's/://g' >> "$TEMPDIR/affected-files.txt"
 # invoke pacman
-for i in $(cat $TEMPDIR/affected-files.txt); do
-	pacman -Qo $i | awk '{print $4,$5}' >> $TEMPDIR/pacman.txt
-done
+while read -r i; do
+	pacman -Qo "$i" | awk '{print $4,$5}' >> "$TEMPDIR/pacman.txt"
+done < "$TEMPDIR/affected-files.txt"
 # clean list
-sort -u $TEMPDIR/pacman.txt >> $TEMPDIR/possible-rebuilds.txt
+sort -u "$TEMPDIR/pacman.txt" >> "$TEMPDIR/possible-rebuilds.txt"
 
-msg "Files saved to $TEMPDIR"
+msg "Files saved to %s" "$TEMPDIR"

lib/archroot.sh

@@ -0,0 +1,69 @@
+#!/hint/bash
+# License: Unspecified
+:
+
+# shellcheck disable=2034
+CHROOT_VERSION='v4'
+
+##
+#  usage : check_root $keepenv
+##
+orig_argv=("$0" "$@")
+check_root() {
+	local keepenv=$1
+
+	(( EUID == 0 )) && return
+	if type -P sudo >/dev/null; then
+		exec sudo --preserve-env=$keepenv -- "${orig_argv[@]}"
+	else
+		exec su root -c "$(printf ' %q' "${orig_argv[@]}")"
+	fi
+}
+
+##
+#  usage : is_btrfs( $path )
+# return : whether $path is on a btrfs
+##
+is_btrfs() {
+	[[ -e "$1" && "$(stat -f -c %T "$1")" == btrfs ]]
+}
+
+##
+#  usage : is_subvolume( $path )
+# return : whether $path is a the root of a btrfs subvolume (including
+#          the top-level subvolume).
+##
+is_subvolume() {
+	[[ -e "$1" && "$(stat -f -c %T "$1")" == btrfs && "$(stat -c %i "$1")" == 256 ]]
+}
+
+##
+#  usage : is_same_fs( $path_a, $path_b )
+# return : whether $path_a and $path_b are on the same filesystem
+##
+is_same_fs() {
+	[[ "$(stat -c %d "$1")" == "$(stat -c %d "$1")" ]]
+}
+
+##
+#  usage : subvolume_delete_recursive( $path )
+#
+#    Find all btrfs subvolumes under and including $path and delete them.
+##
+subvolume_delete_recursive() {
+	local subvol
+
+	is_subvolume "$1" || return 0
+
+	while IFS= read -d $'\0' -r subvol; do
+		if ! subvolume_delete_recursive "$subvol"; then
+			return 1
+		fi
+	done < <(find "$1" -mindepth 1 -xdev -depth -inum 256 -print0)
+	if ! btrfs subvolume delete "$1" &>/dev/null; then
+		error "Unable to delete subvolume %s" "$subvol"
+		return 1
+	fi
+
+	return 0
+}

lib/common.sh

@@ -1,71 +1,53 @@
+#!/hint/bash
+# This may be included with or without `set -euE`
+
+# License: Unspecified
+
+[[ -z ${_INCLUDE_COMMON_SH:-} ]] || return 0
+_INCLUDE_COMMON_SH="$(set +o|grep nounset)"
+
+set +u +o posix
+# shellcheck disable=1091
+. /usr/share/makepkg/util.sh
+$_INCLUDE_COMMON_SH
+
 # Avoid any encoding problems
 export LANG=C
 
 shopt -s extglob
 
 # check if messages are to be printed using color
-unset ALL_OFF BOLD BLUE GREEN RED YELLOW
 if [[ -t 2 ]]; then
-	# prefer terminal safe colored and bold text when tput is supported
-	if tput setaf 0 &>/dev/null; then
-		ALL_OFF="$(tput sgr0)"
-		BOLD="$(tput bold)"
-		BLUE="${BOLD}$(tput setaf 4)"
-		GREEN="${BOLD}$(tput setaf 2)"
-		RED="${BOLD}$(tput setaf 1)"
-		YELLOW="${BOLD}$(tput setaf 3)"
-	else
-		ALL_OFF="\e[1;0m"
-		BOLD="\e[1;1m"
-		BLUE="${BOLD}\e[1;34m"
-		GREEN="${BOLD}\e[1;32m"
-		RED="${BOLD}\e[1;31m"
-		YELLOW="${BOLD}\e[1;33m"
-	fi
+	colorize
+else
+	# shellcheck disable=2034
+	declare -gr ALL_OFF='' BOLD='' BLUE='' GREEN='' RED='' YELLOW=''
 fi
-readonly ALL_OFF BOLD BLUE GREEN RED YELLOW
-
-plain() {
-	local mesg=$1; shift
-	printf "${BOLD}    ${mesg}${ALL_OFF}\n" "$@" >&2
-}
-
-msg() {
-	local mesg=$1; shift
-	printf "${GREEN}==>${ALL_OFF}${BOLD} ${mesg}${ALL_OFF}\n" "$@" >&2
-}
-
-msg2() {
-	local mesg=$1; shift
-	printf "${BLUE}  ->${ALL_OFF}${BOLD} ${mesg}${ALL_OFF}\n" "$@" >&2
-}
-
-warning() {
-	local mesg=$1; shift
-	printf "${YELLOW}==> WARNING:${ALL_OFF}${BOLD} ${mesg}${ALL_OFF}\n" "$@" >&2
-}
-
-error() {
-	local mesg=$1; shift
-	printf "${RED}==> ERROR:${ALL_OFF}${BOLD} ${mesg}${ALL_OFF}\n" "$@" >&2
-}
 
 stat_busy() {
 	local mesg=$1; shift
-	printf "${GREEN}==>${ALL_OFF}${BOLD} ${mesg}...${ALL_OFF}" >&2
+	# shellcheck disable=2059
+	printf "${GREEN}==>${ALL_OFF}${BOLD} ${mesg}...${ALL_OFF}" "$@" >&2
 }
 
 stat_done() {
+	# shellcheck disable=2059
 	printf "${BOLD}done${ALL_OFF}\n" >&2
 }
 
+_setup_workdir=false
 setup_workdir() {
-	[[ -z $WORKDIR ]] && WORKDIR=$(mktemp -d --tmpdir "${0##*/}.XXXXXXXXXX")
+	[[ -z ${WORKDIR:-} ]] && WORKDIR=$(mktemp -d --tmpdir "${0##*/}.XXXXXXXXXX")
+	_setup_workdir=true
+	trap 'trap_abort' INT QUIT TERM HUP
+	trap 'trap_exit' EXIT
 }
 
 cleanup() {
-	[[ -n $WORKDIR ]] && rm -rf "$WORKDIR"
-	exit ${1:-0}
+	if [[ -n ${WORKDIR:-} ]] && $_setup_workdir; then
+		rm -rf "$WORKDIR"
+	fi
+	exit "${1:-0}"
 }
 
 abort() {
@@ -89,81 +71,54 @@ die() {
 	cleanup 255
 }
 
-trap 'trap_abort' INT QUIT TERM HUP
-trap 'trap_exit' EXIT
-
 ##
-#  usage : in_array( $needle, $haystack )
-# return : 0 - found
-#          1 - not found
-##
-in_array() {
-	local needle=$1; shift
-	local item
-	for item in "$@"; do
-		[[ $item = $needle ]] && return 0 # Found
-	done
-	return 1 # Not Found
-}
-
-##
-#  usage : get_full_version( [$pkgname] )
-# return : full version spec, including epoch (if necessary), pkgver, pkgrel
-##
-get_full_version() {
-	# set defaults if they weren't specified in buildfile
-	pkgbase=${pkgbase:-${pkgname[0]}}
-	epoch=${epoch:-0}
-	if [[ -z $1 ]]; then
-		if (( ! epoch )); then
-			echo $pkgver-$pkgrel
-		else
-			echo $epoch:$pkgver-$pkgrel
-		fi
-	else
-		for i in pkgver pkgrel epoch; do
-			local indirect="${i}_override"
-			eval $(declare -f package_$1 | sed -n "s/\(^[[:space:]]*$i=\)/${i}_override=/p")
-			[[ -z ${!indirect} ]] && eval ${indirect}=\"${!i}\"
-		done
-		if (( ! $epoch_override )); then
-			echo $pkgver_override-$pkgrel_override
-		else
-			echo $epoch_override:$pkgver_override-$pkgrel_override
-		fi
-	fi
-}
-
-##
-#  usage : lock( $fd, $file, $message )
+#  usage : lock( $fd, $file, $message, [ $message_arguments... ] )
 ##
 lock() {
-	eval "exec $1>"'"$2"'
-	if ! flock -n $1; then
-		stat_busy "$3"
-		flock $1
+	# Only reopen the FD if it wasn't handed to us
+	if ! [[ "/dev/fd/$1" -ef "$2" ]]; then
+		mkdir -p -- "$(dirname -- "$2")"
+		eval "exec $1>"'"$2"'
+	fi
+
+	if ! flock -n "$1"; then
+		stat_busy "${@:3}"
+		flock "$1"
 		stat_done
 	fi
 }
 
 ##
-#  usage : slock( $fd, $file, $message )
+#  usage : slock( $fd, $file, $message, [ $message_arguments... ] )
 ##
 slock() {
-	eval "exec $1>"'"$2"'
-	if ! flock -sn $1; then
-		stat_busy "$3"
-		flock -s $1
+	# Only reopen the FD if it wasn't handed to us
+	if ! [[ "/dev/fd/$1" -ef "$2" ]]; then
+		mkdir -p -- "$(dirname -- "$2")"
+		eval "exec $1>"'"$2"'
+	fi
+
+	if ! flock -sn "$1"; then
+		stat_busy "${@:3}"
+		flock -s "$1"
 		stat_done
 	fi
 }
 
+##
+#  usage : lock_close( $fd )
+##
+lock_close() {
+	local fd=$1
+	# https://github.com/koalaman/shellcheck/issues/862
+	# shellcheck disable=2034
+	exec {fd}>&-
+}
+
 ##
 # usage: pkgver_equal( $pkgver1, $pkgver2 )
 ##
 pkgver_equal() {
-	local left right
-
 	if [[ $1 = *-* && $2 = *-* ]]; then
 		# if both versions have a pkgrel, then they must be an exact match
 		[[ $1 = "$2" ]]
@@ -182,7 +137,7 @@ pkgver_equal() {
 find_cached_package() {
 	local searchdirs=("$PWD" "$PKGDEST") results=()
 	local targetname=$1 targetver=$2 targetarch=$3
-	local dir pkg pkgbasename pkgparts name ver rel arch size r results
+	local dir pkg pkgbasename name ver rel arch r results
 
 	for dir in "${searchdirs[@]}"; do
 		[[ -d $dir ]] || continue
@@ -220,7 +175,7 @@ find_cached_package() {
 			return 1
 			;;
 		1)
-			printf '%s\n' "$results"
+			printf '%s\n' "${results[0]}"
 			return 0
 			;;
 		*)
@@ -229,15 +184,3 @@ find_cached_package() {
 			return 1
 	esac
 }
-
-##
-#  usage : check_root ("$0" "$@")
-##
-check_root() {
-	(( EUID == 0 )) && return
-	if type -P sudo >/dev/null; then
-		exec sudo -- "$@"
-	else
-		exec su root -c "$(printf ' %q' "$@")"
-	fi
-}

lib/valid-tags.sh

@@ -1,20 +1,25 @@
+#!/hint/bash
+# License: Unspecified
+:
+
+# shellcheck disable=2034
 _arch=(
-	i686
 	x86_64
 	any
 )
 
+# shellcheck disable=2034
 _tags=(
-	core-i686 core-x86_64 core-any
-	extra-i686 extra-x86_64 extra-any
+	core-x86_64 core-any
+	extra-x86_64 extra-any
 	multilib-x86_64
-	staging-i686 staging-x86_64 staging-any
-	testing-i686 testing-x86_64 testing-any
+	staging-x86_64 staging-any
+	testing-x86_64 testing-any
 	multilib-testing-x86_64
 	multilib-staging-x86_64
-	community-i686 community-x86_64 community-any
-	community-staging-i686 community-staging-x86_64 community-staging-any
-	community-testing-i686 community-testing-x86_64 community-testing-any
-	kde-unstable-i686 kde-unstable-x86_64 kde-unstable-any
-	gnome-unstable-i686 gnome-unstable-x86_64 gnome-unstable-any
+	community-x86_64 community-any
+	community-staging-x86_64 community-staging-any
+	community-testing-x86_64 community-testing-any
+	kde-unstable-x86_64 kde-unstable-any
+	gnome-unstable-x86_64 gnome-unstable-any
 )

makechrootpkg.in

@@ -1,4 +1,6 @@
 #!/bin/bash
+# License: GNU GPLv2
+#
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; version 2 of the License.
@@ -9,29 +11,10 @@
 # GNU General Public License for more details.
 
 m4_include(lib/common.sh)
+m4_include(lib/archroot.sh)
 
 shopt -s nullglob
 
-makepkg_args=(-s --noconfirm -L --holdver)
-repack=false
-update_first=false
-clean_first=false
-install_pkg=
-run_namcap=false
-temp_chroot=false
-chrootdir=
-passeddir=
-declare -a install_pkgs
-declare -i ret=0
-
-bindmounts_ro=()
-bindmounts_rw=()
-
-copy=$USER
-[[ -n $SUDO_USER ]] && copy=$SUDO_USER
-[[ -z "$copy" || $copy = root ]] && copy=copy
-src_owner=${SUDO_USER:-$USER}
-
 usage() {
 	echo "Usage: ${0##*/} [options] -r <chrootdir> [--] [makepkg args]"
 	echo ' Run this script in a PKGBUILD dir to build a package inside a'
@@ -46,7 +29,11 @@ usage() {
 	echo 'command:'
 	echo '    mkarchroot <chrootdir>/root base-devel'
 	echo ''
-	echo "Default makepkg args: ${makepkg_args[*]}"
+	echo 'This script reads {SRC,SRCPKG,PKG,LOG}DEST, MAKEFLAGS and PACKAGER'
+	echo 'from makepkg.conf(5), if those variables are not part of the'
+	echo 'environment.'
+	echo ''
+	echo "Default makepkg args: ${default_makepkg_args[*]}"
 	echo ''
 	echo 'Flags:'
 	echo '-h         This help'
@@ -63,57 +50,80 @@ usage() {
 	echo "           Default: $copy"
 	echo '-n         Run namcap on the package'
 	echo '-T         Build in a temporary directory'
+	echo '-U         Run makepkg as a specified user'
 	exit 1
 }
 
 # {{{ functions
+# Usage: load_vars $makepkg_conf
+# Globals:
+#  - SRCDEST
+#  - SRCPKGDEST
+#  - PKGDEST
+#  - LOGDEST
+#  - MAKEFLAGS
+#  - PACKAGER
 load_vars() {
 	local makepkg_conf="$1" var
 
 	[[ -f $makepkg_conf ]] || return 1
 
 	for var in {SRC,SRCPKG,PKG,LOG}DEST MAKEFLAGS PACKAGER; do
-		[[ -z ${!var} ]] && eval $(grep "^${var}=" "$makepkg_conf")
+		[[ -z ${!var:-} ]] && eval "$(grep -a "^${var}=" "$makepkg_conf")"
 	done
 
 	return 0
 }
 
-create_chroot() {
-	# Lock the chroot we want to use. We'll keep this lock until we exit.
-	lock 9 "$copydir.lock" "Locking chroot copy [$copy]"
+# Usage: sync_chroot $rootdir $copydir [$copy]
+sync_chroot() {
+	local rootdir=$1
+	local copydir=$2
+	local copy=${3:-$2}
 
-	if [[ ! -d $copydir ]] || $clean_first; then
-		# Get a read lock on the root chroot to make
-		# sure we don't clone a half-updated chroot
-		slock 8 "$chrootdir/root.lock" "Locking clean chroot"
-
-		stat_busy "Creating clean working copy [$copy]"
-		if [[ "$chroottype" == btrfs ]] && ! mountpoint -q "$copydir"; then
-			if [[ -d $copydir ]]; then
-				btrfs subvolume delete "$copydir" >/dev/null ||
-					die "Unable to delete subvolume %s" "$copydir"
-			fi
-			btrfs subvolume snapshot "$chrootdir/root" "$copydir" >/dev/null ||
-				die "Unable to create subvolume %s" "$copydir"
-		else
-			mkdir -p "$copydir"
-			rsync -a --delete -q -W -x "$chrootdir/root/" "$copydir"
-		fi
-		stat_done
-
-		# Drop the read lock again
-		exec 8>&-
+	if [[ "$rootdir" -ef "$copydir" ]]; then
+		error 'Cannot sync copy with itself: %s' "$copydir"
+		return 1
 	fi
 
+	# Get a read lock on the root chroot to make
+	# sure we don't clone a half-updated chroot
+	slock 8 "$rootdir.lock" \
+		"Locking clean chroot [%s]" "$rootdir"
+
+	stat_busy "Synchronizing chroot copy [%s] -> [%s]" "$rootdir" "$copy"
+	if is_subvolume "$rootdir" && is_same_fs "$rootdir" "$(dirname -- "$copydir")" && ! mountpoint -q "$copydir"; then
+		if is_subvolume "$copydir"; then
+			subvolume_delete_recursive "$copydir" ||
+				die "Unable to delete subvolume %s" "$copydir"
+		else
+			# avoid change of filesystem in case of an umount failure
+			rm --recursive --force --one-file-system "$copydir" ||
+				die "Unable to delete %s" "$copydir"
+		fi
+		btrfs subvolume snapshot "$rootdir" "$copydir" >/dev/null ||
+			die "Unable to create subvolume %s" "$copydir"
+	else
+		mkdir -p "$copydir"
+		rsync -a --delete -q -W -x "$rootdir/" "$copydir"
+	fi
+	stat_done
+
+	# Drop the read lock again
+	lock_close 8
+
 	# Update mtime
 	touch "$copydir"
 }
 
-clean_temporary() {
-	stat_busy "Removing temporary copy [$copy]"
-	if [[ "$chroottype" == btrfs ]] && ! mountpoint -q "$copydir"; then
-		btrfs subvolume delete "$copydir" >/dev/null ||
+# Usage: delete_chroot $copydir [$copy]
+delete_chroot() {
+	local copydir=$1
+	local copy=${1:-$2}
+
+	stat_busy "Removing chroot copy [%s]" "$copy"
+	if is_subvolume "$copydir" && ! mountpoint -q "$copydir"; then
+		subvolume_delete_recursive "$copydir" ||
 			die "Unable to delete subvolume %s" "$copydir"
 	else
 		# avoid change of filesystem in case of an umount failure
@@ -126,178 +136,148 @@ clean_temporary() {
 	stat_done
 }
 
+# Usage: install_packages $copydir $pkgs...
 install_packages() {
-	local pkgname
+	local copydir=$1
+	local install_pkgs=("${@:2}")
 
-	for install_pkg in "${install_pkgs[@]}"; do
-		pkgname="${install_pkg##*/}"
-		cp "$install_pkg" "$copydir/$pkgname"
+	local -a pkgnames
+	local ret
 
-		arch-nspawn "$copydir" \
-			"${bindmounts_ro[@]}" "${bindmounts_rw[@]}" \
-			pacman -U /$pkgname --noconfirm
-		(( ret += !! $? ))
+	pkgnames=("${install_pkgs[@]##*/}")
 
-		rm "$copydir/$pkgname"
-	done
+	cp -- "${install_pkgs[@]}" "$copydir/root/"
+	arch-nspawn "$copydir" "${bindmounts_ro[@]}" "${bindmounts_rw[@]}" \
+		pacman -U --noconfirm -- "${pkgnames[@]/#//root/}"
+	ret=$?
+	rm -- "${pkgnames[@]/#/$copydir/root/}"
 
-	# If there is no PKGBUILD we are done
-	[[ -f PKGBUILD ]] || exit $ret
+	return $ret
 }
 
+# Usage: prepare_chroot $copydir $HOME $keepbuilddir $run_namcap
+# Globals:
+#  - MAKEFLAGS
+#  - PACKAGER
 prepare_chroot() {
-	$repack || rm -rf "$copydir/build"
+	local copydir=$1
+	local USER_HOME=$2
+	local keepbuilddir=$3
+	local run_namcap=$4
 
-	mkdir -p "$copydir/build"
-	if ! grep -q 'BUILDDIR="/build"' "$copydir/etc/makepkg.conf"; then
-		echo 'BUILDDIR="/build"' >> "$copydir/etc/makepkg.conf"
-	fi
+	[[ $keepbuilddir = true ]] || rm -rf "$copydir/build"
 
-	# Read .makepkg.conf and gnupg pubring
-	if [[ -r $USER_HOME/.gnupg/pubring.kbx ]]; then
-		install -D "$USER_HOME/.gnupg/pubring.kbx" "$copydir/build/.gnupg/pubring.kbx"
-	fi
-	if [[ -r $USER_HOME/.gnupg/pubring.gpg ]]; then
-		install -D "$USER_HOME/.gnupg/pubring.gpg" "$copydir/build/.gnupg/pubring.gpg"
-	fi
-
-	mkdir -p "$copydir/pkgdest"
-	if ! grep -q 'PKGDEST="/pkgdest"' "$copydir/etc/makepkg.conf"; then
-		echo 'PKGDEST="/pkgdest"' >> "$copydir/etc/makepkg.conf"
-	fi
-
-	mkdir -p "$copydir/srcpkgdest"
-	if ! grep -q 'SRCPKGDEST="/srcpkgdest"' "$copydir/etc/makepkg.conf"; then
-		echo 'SRCPKGDEST="/srcpkgdest"' >> "$copydir/etc/makepkg.conf"
-	fi
-
-	mkdir -p "$copydir/logdest"
-	if ! grep -q 'LOGDEST="/logdest"' "$copydir/etc/makepkg.conf"; then
-		echo 'LOGDEST="/logdest"' >> "$copydir/etc/makepkg.conf"
-	fi
-
-	# These two get bind-mounted read-only
-	# XXX: makepkg dislikes having these dirs read-only, so separate them
-	mkdir -p "$copydir/startdir" "$copydir/startdir_host"
-	mkdir -p "$copydir/srcdest" "$copydir/srcdest_host"
-	if ! grep -q 'SRCDEST="/srcdest"' "$copydir/etc/makepkg.conf"; then
-		echo 'SRCDEST="/srcdest"' >> "$copydir/etc/makepkg.conf"
-	fi
-
-	builduser_uid=${SUDO_UID:-$UID}
+	local builduser_uid builduser_gid
+	builduser_uid="${SUDO_UID:-$UID}"
+	builduser_gid="$(id -g "$builduser_uid")"
+	local install="install -o $builduser_uid -g $builduser_gid"
+	local x
 
 	# We can't use useradd without chrooting, otherwise it invokes PAM modules
 	# which we might not be able to load (i.e. when building i686 packages on
 	# an x86_64 host).
-	printf 'builduser:x:%d:100:builduser:/:/usr/bin/nologin\n' "$builduser_uid" >>"$copydir/etc/passwd"
-	chown -R "$builduser_uid" "$copydir"/{build,pkgdest,srcpkgdest,logdest,srcdest,startdir}
+	sed -e '/^builduser:/d' -i "$copydir"/etc/{passwd,shadow,group}
+	printf >>"$copydir/etc/group"  'builduser:x:%d:\n' "$builduser_gid"
+	printf >>"$copydir/etc/passwd" 'builduser:x:%d:%d:builduser:/build:/bin/bash\n' "$builduser_uid" "$builduser_gid"
+	printf >>"$copydir/etc/shadow" 'builduser:!!:%d::::::\n' "$(( $(date -u +%s) / 86400 ))"
 
-	if [[ -n $MAKEFLAGS ]]; then
-		sed -i '/^MAKEFLAGS=/d' "$copydir/etc/makepkg.conf"
-		echo "MAKEFLAGS='${MAKEFLAGS}'" >> "$copydir/etc/makepkg.conf"
-	fi
+	$install -d "$copydir"/{build,startdir,{pkg,srcpkg,src,log}dest}
 
-	if [[ -n $PACKAGER ]]; then
-		sed -i '/^PACKAGER=/d' "$copydir/etc/makepkg.conf"
-		echo "PACKAGER='${PACKAGER}'" >> "$copydir/etc/makepkg.conf"
-	fi
+	sed -e '/^MAKEFLAGS=/d' -e '/^PACKAGER=/d' -i "$copydir/etc/makepkg.conf"
+	for x in BUILDDIR=/build PKGDEST=/pkgdest SRCPKGDEST=/srcpkgdest SRCDEST=/srcdest LOGDEST=/logdest \
+		"MAKEFLAGS='${MAKEFLAGS:-}'" "PACKAGER='${PACKAGER:-}'"
+	do
+		grep -q "^$x" "$copydir/etc/makepkg.conf" && continue
+		echo "$x" >>"$copydir/etc/makepkg.conf"
+	done
 
-	if [[ ! -f $copydir/etc/sudoers.d/builduser-pacman ]]; then
-		cat > "$copydir/etc/sudoers.d/builduser-pacman" <<EOF
-Defaults env_keep += "HOME"
+	cat > "$copydir/etc/sudoers.d/builduser-pacman" <<EOF
 builduser ALL = NOPASSWD: /usr/bin/pacman
 EOF
-		chmod 440 "$copydir/etc/sudoers.d/builduser-pacman"
-	fi
+	chmod 440 "$copydir/etc/sudoers.d/builduser-pacman"
 
 	# This is a little gross, but this way the script is recreated every time in the
 	# working copy
 	{
 		printf '#!/bin/bash\n'
 		declare -f _chrootbuild
-		printf '_chrootbuild'
-		printf ' %q' "${makepkg_args[@]}"
-		printf ' || exit\n'
+		declare -p SOURCE_DATE_EPOCH 2>/dev/null || true
+		printf '_chrootbuild "$@" || exit\n'
 
-		if $run_namcap; then
-			cat <<'EOF'
-pacman -S --needed --noconfirm namcap
-for pkgfile in /startdir/PKGBUILD /pkgdest/*; do
-	echo "Checking ${pkgfile##*/}"
-	sudo -u builduser namcap "$pkgfile" 2>&1 | tee "/logdest/${pkgfile##*/}-namcap.log"
-done
-EOF
+		if [[ $run_namcap = true ]]; then
+			declare -f _chrootnamcap
+			printf '_chrootnamcap || exit\n'
 		fi
 	} >"$copydir/chrootbuild"
 	chmod +x "$copydir/chrootbuild"
 }
 
+# These functions aren't run in makechrootpkg,
+# so no global variables
+_chrootbuild() {
+	# No coredumps
+	ulimit -c 0
+
+	# shellcheck source=/dev/null
+	. /etc/profile
+
+	# Beware, there are some stupid arbitrary rules on how you can
+	# use "$" in arguments to commands with "sudo -i".  ${foo} or
+	# ${1} is OK, but $foo or $1 isn't.
+	# https://bugzilla.sudo.ws/show_bug.cgi?id=765
+	sudo --preserve-env=SOURCE_DATE_EPOCH -iu builduser bash -c 'cd /startdir; makepkg "$@"' -bash "$@"
+}
+
+_chrootnamcap() {
+	pacman -S --needed --noconfirm namcap
+	for pkgfile in /startdir/PKGBUILD /pkgdest/*; do
+		echo "Checking ${pkgfile##*/}"
+		sudo -u builduser namcap "$pkgfile" 2>&1 | tee "/logdest/${pkgfile##*/}-namcap.log"
+	done
+}
+
+# Usage: download_sources $copydir $makepkg_user
+# Globals:
+#  - SRCDEST
 download_sources() {
-	local builddir="$(mktemp -d)"
-	chmod 1777 "$builddir"
+	local copydir=$1
+	local makepkg_user=$2
+
+	local builddir
+	builddir="$(mktemp -d)"
+	chown "$makepkg_user:" "$builddir"
 
 	# Ensure sources are downloaded
-	if [[ -n $SUDO_USER ]]; then
-		sudo -u $SUDO_USER env SRCDEST="$SRCDEST" BUILDDIR="$builddir" \
-			makepkg --config="$copydir/etc/makepkg.conf" --verifysource -o
-	else
-		( export SRCDEST BUILDDIR="$builddir"
-			makepkg --asroot --config="$copydir/etc/makepkg.conf" --verifysource -o
-		)
-	fi
-	(( $? != 0 )) && die "Could not download sources."
+	sudo -u "$makepkg_user" --preserve-env=GNUPGHOME \
+		env SRCDEST="$SRCDEST" BUILDDIR="$builddir" \
+		makepkg --config="$copydir/etc/makepkg.conf" --verifysource -o ||
+		die "Could not download sources."
 
 	# Clean up garbage from verifysource
-	rm -rf $builddir
-}
-
-_chrootbuild() {
-	# This function isn't run in makechrootpkg,
-	# so no global variables
-
-	. /etc/profile
-	export HOME=/build
-	shopt -s nullglob
-
-	# XXX: Workaround makepkg disliking read-only dirs
-	ln -sft /srcdest /srcdest_host/*
-	ln -sft /startdir /startdir_host/*
-
-	# XXX: Keep bzr and svn sources writable
-	# Since makepkg 4.1.1 they get checked out via cp -a, copying the symlink
-	for dir in /srcdest /startdir; do
-		for vcs in bzr svn; do
-			cd "$dir"
-			for vcsdir in */.$vcs; do
-				rm "${vcsdir%/.$vcs}"
-				cp -a "${dir}_host/${vcsdir%/.$vcs}" .
-				chown -R builduser "${vcsdir%/.$vcs}"
-			done
-		done
-	done
-
-	cd /startdir
-
-	# XXX: Keep PKGBUILD writable for pkgver()
-	rm PKGBUILD*
-	cp /startdir_host/PKGBUILD* .
-	chown builduser PKGBUILD*
-
-	# Safety check
-	if [[ ! -w PKGBUILD ]]; then
-		echo "Can't write to PKGBUILD!"
-		exit 1
-	fi
-
-	sudo -u builduser makepkg "$@"
+	rm -rf "$builddir"
 }
 
+# Usage: move_products $copydir $owner
+# Globals:
+#  - PKGDEST
+#  - LOGDEST
+#  - SRCPKGDEST
 move_products() {
+	local copydir=$1
+	local src_owner=$2
+
+	local pkgfile
 	for pkgfile in "$copydir"/pkgdest/*; do
 		chown "$src_owner" "$pkgfile"
 		mv "$pkgfile" "$PKGDEST"
+
+		# Fix broken symlink because of temporary chroot PKGDEST /pkgdest
+		if [[ "$PWD" != "$PKGDEST" && -L "$PWD/${pkgfile##*/}" ]]; then
+			ln -sf "$PKGDEST/${pkgfile##*/}"
+		fi
 	done
 
+	local l
 	for l in "$copydir"/logdest/*; do
 		[[ $l == */logpipe.* ]] && continue
 		chown "$src_owner" "$l"
@@ -307,106 +287,149 @@ move_products() {
 	for s in "$copydir"/srcpkgdest/*; do
 		chown "$src_owner" "$s"
 		mv "$s" "$SRCPKGDEST"
+
+		# Fix broken symlink because of temporary chroot SRCPKGDEST /srcpkgdest
+		if [[ "$PWD" != "$SRCPKGDEST" && -L "$PWD/${s##*/}" ]]; then
+			ln -sf "$SRCPKGDEST/${s##*/}"
+		fi
 	done
 }
 # }}}
 
-orig_argv=("$@")
+main() {
+	default_makepkg_args=(--syncdeps --noconfirm --log --holdver --skipinteg)
+	makepkg_args=("${default_makepkg_args[@]}")
+	keepbuilddir=false
+	update_first=false
+	clean_first=false
+	run_namcap=false
+	temp_chroot=false
+	chrootdir=
+	passeddir=
+	makepkg_user=
+	declare -a install_pkgs
+	declare -i ret=0
 
-while getopts 'hcur:I:l:nTD:d:' arg; do
-	case "$arg" in
-		c) clean_first=true ;;
-		D) bindmounts_ro+=(--bind-ro="$OPTARG") ;;
-		d) bindmounts_rw+=(--bind="$OPTARG") ;;
-		u) update_first=true ;;
-		r) passeddir="$OPTARG" ;;
-		I) install_pkgs+=("$OPTARG") ;;
-		l) copy="$OPTARG" ;;
-		n) run_namcap=true; makepkg_args+=(-i) ;;
-		T) temp_chroot=true; copy+="-$$" ;;
-		h|*) usage ;;
-	esac
-done
+	bindmounts_ro=()
+	bindmounts_rw=()
 
-[[ ! -f PKGBUILD && -z "${install_pkgs[*]}" ]] && die 'This must be run in a directory containing a PKGBUILD.'
+	copy=$USER
+	[[ -n ${SUDO_USER:-} ]] && copy=$SUDO_USER
+	[[ -z "$copy" || $copy = root ]] && copy=copy
+	src_owner=${SUDO_USER:-$USER}
 
-check_root "$0" "${orig_argv[@]}"
+	while getopts 'hcur:I:l:nTD:d:U:' arg; do
+		case "$arg" in
+			c) clean_first=true ;;
+			D) bindmounts_ro+=("--bind-ro=$OPTARG") ;;
+			d) bindmounts_rw+=("--bind=$OPTARG") ;;
+			u) update_first=true ;;
+			r) passeddir="$OPTARG" ;;
+			I) install_pkgs+=("$OPTARG") ;;
+			l) copy="$OPTARG" ;;
+			n) run_namcap=true; makepkg_args+=(--install) ;;
+			T) temp_chroot=true; copy+="-$$" ;;
+			U) makepkg_user="$OPTARG" ;;
+			h|*) usage ;;
+		esac
+	done
 
-# Canonicalize chrootdir, getting rid of trailing /
-chrootdir=$(readlink -e "$passeddir")
-[[ ! -d $chrootdir ]] && die "No chroot dir defined, or invalid path '%s'" "$passeddir"
-[[ ! -d $chrootdir/root ]] && die "Missing chroot dir root directory. Try using: mkarchroot %s/root base-devel" "$chrootdir"
+	[[ ! -f PKGBUILD && -z "${install_pkgs[*]}" ]] && die 'This must be run in a directory containing a PKGBUILD.'
+	[[ -n $makepkg_user && -z $(id -u "$makepkg_user") ]] && die 'Invalid makepkg user.'
+	makepkg_user=${makepkg_user:-${SUDO_USER:-$USER}}
 
-# Detect chrootdir filesystem type
-chroottype=$(stat -f -c %T "$chrootdir")
+	check_root SOURCE_DATE_EPOCH,GNUPGHOME
 
-if [[ ${copy:0:1} = / ]]; then
-	copydir=$copy
-else
-	copydir="$chrootdir/$copy"
-fi
+	# Canonicalize chrootdir, getting rid of trailing /
+	chrootdir=$(readlink -e "$passeddir")
+	[[ ! -d $chrootdir ]] && die "No chroot dir defined, or invalid path '%s'" "$passeddir"
+	[[ ! -d $chrootdir/root ]] && die "Missing chroot dir root directory. Try using: mkarchroot %s/root base-devel" "$chrootdir"
 
-# Pass all arguments after -- right to makepkg
-makepkg_args+=("${@:$OPTIND}")
-
-# See if -R was passed to makepkg
-for arg in "${@:OPTIND}"; do
-	case ${arg%%=*} in
-		-*R*|--repackage)
-			repack=true
-			break 2
-			;;
-	esac
-done
-
-if [[ -n $SUDO_USER ]]; then
-	eval "USER_HOME=~$SUDO_USER"
-else
-	USER_HOME=$HOME
-fi
-
-umask 0022
-
-load_vars "$USER_HOME/.makepkg.conf"
-load_vars /etc/makepkg.conf
-
-# Use PKGBUILD directory if these don't exist
-[[ -d $PKGDEST ]]    || PKGDEST=$PWD
-[[ -d $SRCDEST ]]    || SRCDEST=$PWD
-[[ -d $SRCPKGDEST ]] || SRCPKGDEST=$PWD
-[[ -d $LOGDEST ]]    || LOGDEST=$PWD
-
-create_chroot
-
-$update_first && arch-nspawn "$copydir" \
-		"${bindmounts_ro[@]}" "${bindmounts_rw[@]}" \
-		pacman -Syu --noconfirm
-
-[[ -n ${install_pkgs[*]} ]] && install_packages
-
-download_sources
-
-prepare_chroot
-
-if arch-nspawn "$copydir" \
-	--bind-ro="$PWD:/startdir_host" \
-	--bind-ro="$SRCDEST:/srcdest_host" \
-	"${bindmounts_ro[@]}" "${bindmounts_rw[@]}" \
-	/chrootbuild
-then
-	move_products
-else
-	(( ret += 1 ))
-fi
-
-$temp_chroot && clean_temporary
-
-if (( ret != 0 )); then
-	if $temp_chroot; then
-		die "Build failed"
+	if [[ ${copy:0:1} = / ]]; then
+		copydir=$copy
 	else
-		die "Build failed, check %s/build" "$copydir"
+		copydir="$chrootdir/$copy"
 	fi
-else
-	true
-fi
+
+	# Pass all arguments after -- right to makepkg
+	makepkg_args+=("${@:$OPTIND}")
+
+	# See if -R or -e was passed to makepkg
+	for arg in "${makepkg_args[@]}"; do
+		case ${arg%%=*} in
+			--repackage|--noextract) keepbuilddir=true; break ;;
+			--repackage|--noextract) keepbuilddir=true; break ;;
+			--*) ;;
+			-*R*|-*e*) keepbuilddir=true; break ;;
+		esac
+	done
+
+	if [[ -n $SUDO_USER ]]; then
+		eval "USER_HOME=~$SUDO_USER"
+	else
+		USER_HOME=$HOME
+	fi
+
+	umask 0022
+
+	load_vars "${XDG_CONFIG_HOME:-$USER_HOME/.config}/pacman/makepkg.conf" || load_vars "$USER_HOME/.makepkg.conf"
+	load_vars /etc/makepkg.conf
+
+	# Use PKGBUILD directory if these don't exist
+	[[ -d $PKGDEST ]]    || PKGDEST=$PWD
+	[[ -d $SRCDEST ]]    || SRCDEST=$PWD
+	[[ -d $SRCPKGDEST ]] || SRCPKGDEST=$PWD
+	[[ -d $LOGDEST ]]    || LOGDEST=$PWD
+
+	# Lock the chroot we want to use. We'll keep this lock until we exit.
+	lock 9 "$copydir.lock" "Locking chroot copy [%s]" "$copy"
+
+	if [[ ! -d $copydir ]] || $clean_first; then
+		sync_chroot "$chrootdir/root" "$copydir" "$copy"
+	fi
+
+	$update_first && arch-nspawn "$copydir" \
+			"${bindmounts_ro[@]}" "${bindmounts_rw[@]}" \
+			pacman -Syu --noconfirm
+
+	if [[ -n ${install_pkgs[*]:-} ]]; then
+		install_packages "$copydir" "${install_pkgs[@]}"
+		ret=$?
+		# If there is no PKGBUILD we have done
+		[[ -f PKGBUILD ]] || return $ret
+	fi
+
+	if [[ "$(id -u "$makepkg_user")" == 0 ]]; then
+		error "Running makepkg as root is not allowed."
+		exit 1
+	fi
+
+	download_sources "$copydir" "$makepkg_user"
+
+	prepare_chroot "$copydir" "$USER_HOME" "$keepbuilddir" "$run_namcap"
+
+	if arch-nspawn "$copydir" \
+		--bind="$PWD:/startdir" \
+		--bind="$SRCDEST:/srcdest" \
+		"${bindmounts_ro[@]}" "${bindmounts_rw[@]}" \
+		/chrootbuild "${makepkg_args[@]}"
+	then
+		move_products "$copydir" "$src_owner"
+	else
+		(( ret += 1 ))
+	fi
+
+	$temp_chroot && delete_chroot "$copydir" "$copy"
+
+	if (( ret != 0 )); then
+		if $temp_chroot; then
+			die "Build failed"
+		else
+			die "Build failed, check %s/build" "$copydir"
+		fi
+	else
+		true
+	fi
+}
+
+main "$@"

makepkg-i686.conf

@@ -1,146 +0,0 @@
-#
-# /etc/makepkg.conf
-#
-
-#########################################################################
-# SOURCE ACQUISITION
-#########################################################################
-#
-#-- The download utilities that makepkg should use to acquire sources
-#  Format: 'protocol::agent'
-DLAGENTS=('ftp::/usr/bin/curl -fC - --ftp-pasv --retry 3 --retry-delay 3 -o %o %u'
-          'http::/usr/bin/curl -fLC - --retry 3 --retry-delay 3 -o %o %u'
-          'https::/usr/bin/curl -fLC - --retry 3 --retry-delay 3 -o %o %u'
-          'rsync::/usr/bin/rsync --no-motd -z %u %o'
-          'scp::/usr/bin/scp -C %u %o')
-
-# Other common tools:
-# /usr/bin/snarf
-# /usr/bin/lftpget -c
-# /usr/bin/wget
-
-#-- The package required by makepkg to download VCS sources
-#  Format: 'protocol::package'
-VCSCLIENTS=('bzr::bzr'
-            'git::git'
-            'hg::mercurial'
-            'svn::subversion')
-
-#########################################################################
-# ARCHITECTURE, COMPILE FLAGS
-#########################################################################
-#
-CARCH="i686"
-CHOST="i686-pc-linux-gnu"
-
-#-- Compiler and Linker Flags
-# -march (or -mcpu) builds exclusively for an architecture
-# -mtune optimizes for an architecture, but builds for whole processor family
-CPPFLAGS="-D_FORTIFY_SOURCE=2"
-CFLAGS="-march=i686 -mtune=generic -O2 -pipe -fstack-protector-strong"
-CXXFLAGS="-march=i686 -mtune=generic -O2 -pipe -fstack-protector-strong"
-LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro"
-#-- Make Flags: change this for DistCC/SMP systems
-#MAKEFLAGS="-j2"
-#-- Debugging flags
-DEBUG_CFLAGS="-g -fvar-tracking-assignments"
-DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
-
-#########################################################################
-# BUILD ENVIRONMENT
-#########################################################################
-#
-# Defaults: BUILDENV=(!distcc color !ccache check !sign)
-#  A negated environment option will do the opposite of the comments below.
-#
-#-- distcc:   Use the Distributed C/C++/ObjC compiler
-#-- color:    Colorize output messages
-#-- ccache:   Use ccache to cache compilation
-#-- check:    Run the check() function if present in the PKGBUILD
-#-- sign:     Generate PGP signature file
-#
-BUILDENV=(!distcc color !ccache check !sign)
-#
-#-- If using DistCC, your MAKEFLAGS will also need modification. In addition,
-#-- specify a space-delimited list of hosts running in the DistCC cluster.
-#DISTCC_HOSTS=""
-#
-#-- Specify a directory for package building.
-#BUILDDIR=/tmp/makepkg
-
-#########################################################################
-# GLOBAL PACKAGE OPTIONS
-#   These are default values for the options=() settings
-#########################################################################
-#
-# Default: OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !upx !debug)
-#  A negated option will do the opposite of the comments below.
-#
-#-- strip:      Strip symbols from binaries/libraries
-#-- docs:       Save doc directories specified by DOC_DIRS
-#-- libtool:    Leave libtool (.la) files in packages
-#-- staticlibs: Leave static library (.a) files in packages
-#-- emptydirs:  Leave empty directories in packages
-#-- zipman:     Compress manual (man and info) pages in MAN_DIRS with gzip
-#-- purge:      Remove files specified by PURGE_TARGETS
-#-- upx:        Compress binary executable files using UPX
-#-- debug:      Add debugging flags as specified in DEBUG_* variables
-#
-OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !upx !debug)
-
-#-- File integrity checks to use. Valid: md5, sha1, sha256, sha384, sha512
-INTEGRITY_CHECK=(md5)
-#-- Options to be used when stripping binaries. See `man strip' for details.
-STRIP_BINARIES="--strip-all"
-#-- Options to be used when stripping shared libraries. See `man strip' for details.
-STRIP_SHARED="--strip-unneeded"
-#-- Options to be used when stripping static libraries. See `man strip' for details.
-STRIP_STATIC="--strip-debug"
-#-- Manual (man and info) directories to compress (if zipman is specified)
-MAN_DIRS=({usr{,/local}{,/share},opt/*}/{man,info})
-#-- Doc directories to remove (if !docs is specified)
-DOC_DIRS=(usr/{,local/}{,share/}{doc,gtk-doc} opt/*/{doc,gtk-doc})
-#-- Files to be removed from all packages (if purge is specified)
-PURGE_TARGETS=(usr/{,share}/info/dir .packlist *.pod)
-
-#########################################################################
-# PACKAGE OUTPUT
-#########################################################################
-#
-# Default: put built package and cached source in build directory
-#
-#-- Destination: specify a fixed directory where all packages will be placed
-#PKGDEST=/home/packages
-#-- Source cache: specify a fixed directory where source files will be cached
-#SRCDEST=/home/sources
-#-- Source packages: specify a fixed directory where all src packages will be placed
-#SRCPKGDEST=/home/srcpackages
-#-- Log files: specify a fixed directory where all log files will be placed
-#LOGDEST=/home/makepkglogs
-#-- Packager: name/email of the person or organization building packages
-#PACKAGER="John Doe <john@doe.com>"
-#-- Specify a key to use for package signing
-#GPGKEY=""
-
-#########################################################################
-# COMPRESSION DEFAULTS
-#########################################################################
-#
-COMPRESSGZ=(gzip -c -f -n)
-COMPRESSBZ2=(bzip2 -c -f)
-COMPRESSXZ=(xz -c -z -)
-COMPRESSLRZ=(lrzip -q)
-COMPRESSLZO=(lzop -q)
-COMPRESSZ=(compress -c -f)
-
-#########################################################################
-# EXTENSION DEFAULTS
-#########################################################################
-#
-# WARNING: Do NOT modify these variables unless you know what you are
-#          doing.
-#
-PKGEXT='.pkg.tar.xz'
-SRCEXT='.src.tar.gz'
-
-# vim: set ft=sh ts=2 sw=2 et:

makepkg-x86_64.conf

@@ -1,3 +1,6 @@
+#!/hint/bash
+# shellcheck disable=2034
+
 #
 # /etc/makepkg.conf
 #
@@ -31,15 +34,15 @@ VCSCLIENTS=('bzr::bzr'
 #########################################################################
 #
 CARCH="x86_64"
-CHOST="x86_64-unknown-linux-gnu"
+CHOST="x86_64-pc-linux-gnu"
 
 #-- Compiler and Linker Flags
 # -march (or -mcpu) builds exclusively for an architecture
 # -mtune optimizes for an architecture, but builds for whole processor family
 CPPFLAGS="-D_FORTIFY_SOURCE=2"
-CFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fstack-protector-strong"
-CXXFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fstack-protector-strong"
-LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro"
+CFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fstack-protector-strong -fno-plt"
+CXXFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fstack-protector-strong -fno-plt"
+LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
 #-- Make Flags: change this for DistCC/SMP systems
 #MAKEFLAGS="-j2"
 #-- Debugging flags
@@ -73,7 +76,7 @@ BUILDENV=(!distcc color !ccache check !sign)
 #   These are default values for the options=() settings
 #########################################################################
 #
-# Default: OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !upx !debug)
+# Default: OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !optipng !upx !debug)
 #  A negated option will do the opposite of the comments below.
 #
 #-- strip:      Strip symbols from binaries/libraries
@@ -84,9 +87,10 @@ BUILDENV=(!distcc color !ccache check !sign)
 #-- zipman:     Compress manual (man and info) pages in MAN_DIRS with gzip
 #-- purge:      Remove files specified by PURGE_TARGETS
 #-- upx:        Compress binary executable files using UPX
+#-- optipng:    Optimize PNG images with optipng
 #-- debug:      Add debugging flags as specified in DEBUG_* variables
 #
-OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !upx !debug)
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !optipng !upx !debug)
 
 #-- File integrity checks to use. Valid: md5, sha1, sha256, sha384, sha512
 INTEGRITY_CHECK=(md5)

mkarchroot.in

@@ -1,4 +1,6 @@
 #!/bin/bash
+# License: GNU GPLv2
+#
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; version 2 of the License.
@@ -9,45 +11,48 @@
 # GNU General Public License for more details.
 
 m4_include(lib/common.sh)
-
-CHROOT_VERSION='v3'
+m4_include(lib/archroot.sh)
 
 working_dir=''
 
+files=()
+
 usage() {
 	echo "Usage: ${0##*/} [options] working-dir package-list..."
 	echo ' options:'
 	echo '    -C <file>     Location of a pacman config file'
 	echo '    -M <file>     Location of a makepkg config file'
 	echo '    -c <dir>      Set pacman cache'
+	echo '    -f <file>     Copy file from the host to the chroot'
+	echo '    -s            Do not run setarch'
 	echo '    -h            This message'
 	exit 1
 }
 
-orig_argv=("$@")
-
-while getopts 'hC:M:c:' arg; do
+while getopts 'hC:M:c:f:s' arg; do
 	case "$arg" in
 		C) pac_conf="$OPTARG" ;;
 		M) makepkg_conf="$OPTARG" ;;
 		c) cache_dir="$OPTARG" ;;
+		f) files+=("$OPTARG") ;;
+		s) nosetarch=1 ;;
 		h|?) usage ;;
-		*) error "invalid argument '$arg'"; usage ;;
+		*) error "invalid argument '%s'" "$arg"; usage ;;
 	esac
 done
-shift $(($OPTIND - 1))
+shift $((OPTIND - 1))
 
 (( $# < 2 )) && die 'You must specify a directory and one or more packages.'
 
-check_root "$0" "${orig_argv[@]}"
+check_root
 
-working_dir="$(readlink -f $1)"
+working_dir="$(readlink -f "$1")"
 shift 1
 
 [[ -z $working_dir ]] && die 'Please specify a working directory.'
 
 if [[ -z $cache_dir ]]; then
-	cache_dirs=($(pacman -v $cache_conf 2>&1 | grep '^Cache Dirs:' | sed 's/Cache Dirs:\s*//g'))
+	cache_dirs=($(pacman -v "$cache_conf" 2>&1 | grep '^Cache Dirs:' | sed 's/Cache Dirs:\s*//g'))
 else
 	cache_dirs=(${cache_dir})
 fi
@@ -60,7 +65,7 @@ mkdir -p "$working_dir"
 
 lock 9 "${working_dir}.lock" "Locking chroot"
 
-if [[ $(stat -f -c %T "$working_dir") == btrfs ]]; then
+if is_btrfs "$working_dir"; then
 	rmdir "$working_dir"
 	if ! btrfs subvolume create "$working_dir"; then
 		die "Couldn't create subvolume for '%s'" "$working_dir"
@@ -68,14 +73,27 @@ if [[ $(stat -f -c %T "$working_dir") == btrfs ]]; then
 	chmod 0755 "$working_dir"
 fi
 
+for file in "${files[@]}"; do
+	mkdir -p "$(dirname "$working_dir$file")"
+	cp "$file" "$working_dir$file"
+done
+
+_env=()
+while read -r varname; do
+	_env+=("$varname=${!varname}")
+done < <(declare -x | sed -r 's/^declare -x ([^=]*)=.*/\1/' | grep -i '_proxy$')
+env -i "${_env[@]}" \
 pacstrap -GMcd ${pac_conf:+-C "$pac_conf"} "$working_dir" \
   "${cache_dirs[@]/#/--cachedir=}" "$@" || die 'Failed to install all packages'
 
 printf '%s.UTF-8 UTF-8\n' en_US de_DE > "$working_dir/etc/locale.gen"
-echo 'LANG=C' > "$working_dir/etc/locale.conf"
+echo 'LANG=en_US.UTF-8' > "$working_dir/etc/locale.conf"
 echo "$CHROOT_VERSION" > "$working_dir/.arch-chroot"
 
+systemd-machine-id-setup --root="$working_dir"
+
 exec arch-nspawn \
+	${nosetarch:+-s} \
 	${pac_conf:+-C "$pac_conf"} \
 	${makepkg_conf:+-M "$makepkg_conf"} \
 	${cache_dir:+-c "$cache_dir"} \

pacman-extra.conf

@@ -14,6 +14,7 @@
 #CacheDir    = /var/cache/pacman/pkg/
 #LogFile     = /var/log/pacman.log
 #GPGDir      = /etc/pacman.d/gnupg/
+#HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc
 #XferCommand = /usr/bin/curl -C - -f %u > %o
 #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u

pacman-gnome-unstable.conf

@@ -14,6 +14,7 @@
 #CacheDir    = /var/cache/pacman/pkg/
 #LogFile     = /var/log/pacman.log
 #GPGDir      = /etc/pacman.d/gnupg/
+#HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc
 #XferCommand = /usr/bin/curl -C - -f %u > %o
 #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u

pacman-kde-unstable.conf

@@ -14,6 +14,7 @@
 #CacheDir    = /var/cache/pacman/pkg/
 #LogFile     = /var/log/pacman.log
 #GPGDir      = /etc/pacman.d/gnupg/
+#HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc
 #XferCommand = /usr/bin/curl -C - -f %u > %o
 #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u

pacman-multilib-staging.conf

@@ -14,6 +14,7 @@
 #CacheDir    = /var/cache/pacman/pkg/
 #LogFile     = /var/log/pacman.log
 #GPGDir      = /etc/pacman.d/gnupg/
+#HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc
 #XferCommand = /usr/bin/curl -C - -f %u > %o
 #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u

pacman-multilib-testing.conf

@@ -14,6 +14,7 @@
 #CacheDir    = /var/cache/pacman/pkg/
 #LogFile     = /var/log/pacman.log
 #GPGDir      = /etc/pacman.d/gnupg/
+#HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc
 #XferCommand = /usr/bin/curl -C - -f %u > %o
 #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u

pacman-multilib.conf

@@ -14,6 +14,7 @@
 #CacheDir    = /var/cache/pacman/pkg/
 #LogFile     = /var/log/pacman.log
 #GPGDir      = /etc/pacman.d/gnupg/
+#HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc
 #XferCommand = /usr/bin/curl -C - -f %u > %o
 #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u

pacman-staging.conf

@@ -14,6 +14,7 @@
 #CacheDir    = /var/cache/pacman/pkg/
 #LogFile     = /var/log/pacman.log
 #GPGDir      = /etc/pacman.d/gnupg/
+#HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc
 #XferCommand = /usr/bin/curl -C - -f %u > %o
 #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u

pacman-testing.conf

@@ -14,6 +14,7 @@
 #CacheDir    = /var/cache/pacman/pkg/
 #LogFile     = /var/log/pacman.log
 #GPGDir      = /etc/pacman.d/gnupg/
+#HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc
 #XferCommand = /usr/bin/curl -C - -f %u > %o
 #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u

rebuildpkgs.in

@@ -1,4 +1,6 @@
 #!/bin/bash
+# License: Unspecified
+#
 # This script rebuilds a list of packages in order
 # and reports anything that fails
 # 
@@ -12,18 +14,28 @@
 m4_include(lib/common.sh)
 
 if (( $# < 1 )); then
-	echo "Usage: $(basename $0) <chrootdir> <packages to rebuild>"
-	echo "  example: $(basename $0) ~/chroot readline bash foo bar baz"
+	printf 'Usage: %s <chrootdir> <packages to rebuild>\n' "$(basename "$0")"
+	printf '  example: %s ~/chroot readline bash foo bar baz\n' "$(basename "$0")"
 	exit 1
 fi
 
 # Source makepkg.conf; fail if it is not found
 if [[ -r '/etc/makepkg.conf' ]]; then
+	# shellcheck source=makepkg-x86_64.conf
 	source '/etc/makepkg.conf'
 else
 	die '/etc/makepkg.conf not found!'
 fi
 
+# Source user-specific makepkg.conf overrides
+if [[ -r "${XDG_CONFIG_HOME:-$HOME/.config}/pacman/makepkg.conf" ]]; then
+	# shellcheck source=/dev/null
+	source "${XDG_CONFIG_HOME:-$HOME/.config}/pacman/makepkg.conf"
+elif [[ -r "$HOME/.makepkg.conf" ]]; then
+	# shellcheck source=/dev/null
+	source "$HOME/.makepkg.conf"
+fi
+
 bump_pkgrel() {
 	# Get the current pkgrel from SVN and update the working copy with it
 	# This prevents us from incrementing out of control :)
@@ -31,9 +43,9 @@ bump_pkgrel() {
 	oldrel=$(grep 'pkgrel=' $pbuild | cut -d= -f2)
 
 	#remove decimals
-	rel=$(echo $oldrel | cut -d. -f1)
+	rel=${oldrel%%.*}
 
-	newrel=$(($rel + 1))
+	newrel=$((rel + 1))
 
 	sed -i "s/pkgrel=$oldrel/pkgrel=$newrel/" PKGBUILD
 }
@@ -41,15 +53,16 @@ bump_pkgrel() {
 pkg_from_pkgbuild() {
 	# we want the sourcing to be done in a subshell so we don't pollute our current namespace
 	export CARCH PKGEXT
+	# shellcheck source=PKGBUILD.proto
 	(source PKGBUILD; echo "$pkgname-$pkgver-$pkgrel-$CARCH$PKGEXT")
 }
 
 chrootdir="$1"; shift
-pkgs="$@"
+pkgs=("$@")
 
-SVNPATH='svn+ssh://nymeria.archlinux.org/srv/repos/svn-packages/svn'
+SVNPATH='svn+ssh://repos.archlinux.org/srv/repos/svn-packages/svn'
 
-msg "Work will be done in $(pwd)/rebuilds"
+msg "Work will be done in %s" "$(pwd)/rebuilds"
 
 REBUILD_ROOT="$(pwd)/rebuilds"
 mkdir -p "$REBUILD_ROOT"
@@ -58,14 +71,14 @@ cd "$REBUILD_ROOT"
 /usr/bin/svn co -N $SVNPATH
 
 FAILED=""
-for pkg in $pkgs; do
+for pkg in "${pkgs[@]}"; do
 	cd "$REBUILD_ROOT/svn-packages"
 
-	msg2 "Building '$pkg'"
+	msg2 "Building '%s'" "$pkg"
 	/usr/bin/svn update "$pkg"
 	if [[ ! -d "$pkg/trunk" ]]; then
 		FAILED="$FAILED $pkg"
-		warning "$pkg does not exist in SVN"
+		warning "%s does not exist in SVN" "$pkg"
 		continue
 	fi
 	cd "$pkg/trunk/"
@@ -74,14 +87,14 @@ for pkg in $pkgs; do
 
 	if ! sudo makechrootpkg -u -d -r "$chrootdir" -- --noconfirm; then
 		FAILED="$FAILED $pkg"
-		error "$pkg Failed!"
+		error "%s Failed!" "$pkg"
 	else
 		pkgfile=$(pkg_from_pkgbuild)
 		if [[ -e $pkgfile ]]; then
-			msg2 "$pkg Complete"
+			msg2 "%s Complete" "$pkg"
 		else
 			FAILED="$FAILED $pkg"
-			error "$pkg Failed, no package built!"
+			error "%s Failed, no package built!" "$pkg"
 		fi
 	fi
 done
@@ -90,7 +103,7 @@ cd "$REBUILD_ROOT"
 if [[ -n $FAILED ]]; then
 	msg 'Packages failed:'
 	for pkg in $FAILED; do
-		msg2 "$pkg"
+		msg2 "%s" "$pkg"
 	done
 fi
 

zsh_completion.in

@@ -1,4 +1,5 @@
-#compdef archbuild archco arch-nspawn archrelease archrm commitpkg finddeps makechrootpkg mkarchroot rebuildpkgs extrapkg=commitpkg corepkg=commitpkg testingpkg=commitpkg stagingpkg=commitpkg communitypkg=commitpkg community-testingpkg=commitpkg community-stagingpkg=commitpkg multilibpkg=commitpkg multilib-testingpkg=commitpkg extra-i686-build=archbuild extra-x86_64-build=archbuild testing-i686-build=archbuild testing-x86_64-build=archbuild staging-i686-build=archbuild staging-x86_64-build=archbuild multilib-build=archbuild multilib-testing-build=archbuild multilib-staging-build=archbuild kde-unstable-i686-build=archbuild kde-unstable-x86_64-build=archbuild gnome-unstable-i686-build=archbuild gnome-unstable-x86_64-build=archbuild communityco=archco
+#compdef archbuild archco arch-nspawn archrelease archrm commitpkg finddeps makechrootpkg mkarchroot rebuildpkgs extrapkg=commitpkg corepkg=commitpkg testingpkg=commitpkg stagingpkg=commitpkg communitypkg=commitpkg community-testingpkg=commitpkg community-stagingpkg=commitpkg multilibpkg=commitpkg multilib-testingpkg=commitpkg extra-x86_64-build=archbuild testing-x86_64-build=archbuild staging-x86_64-build=archbuild multilib-build=archbuild multilib-testing-build=archbuild multilib-staging-build=archbuild kde-unstable-x86_64-build=archbuild gnome-unstable-x86_64-build=archbuild communityco=archco
+# License: Unspecified
 
 m4_include(lib/valid-tags.sh)