Version 20200213

This ensures we take user specific config values for PKGDEST into
account when printing the package list. This is required as devtools
archbuild_cmd puts packages potentially into the user defined PKGDEST
which the package list would otherwise miss.

.gitignore

@@ -3,16 +3,19 @@ devtools-*.tar.gz*
 archbuild
 archco
 archrelease
-archrm
 bash_completion
 checkpkg
 commitpkg
 finddeps
 lddd
 makechrootpkg
+makerepropkg
 mkarchroot
+offload-build
 rebuildpkgs
 zsh_completion
 find-libdeps
 crossrepomove
 arch-nspawn
+sogrep
+doc/*.1

.travis.yml

@@ -0,0 +1,28 @@
+language: shell
+sudo: required
+
+services:
+- docker
+
+archlinux:
+  packages:
+    - openssh
+    - subversion
+    - rsync
+    - arch-install-scripts
+    - git
+    - bzr
+    - mercurial
+    - diffutils
+    - asciidoc
+    - shellcheck
+  script:
+    - sudo pacman -Syu --noconfirm --needed "${CONFIG_PACKAGES[@]}"
+    - make PREFIX=/usr
+    - make PREFIX=/usr DESTDIR="$(mktemp -d)" install
+    - make check || true
+    - SHELLCHECK_OPTS="-S error" make check
+
+script: 'curl -s https://raw.githubusercontent.com/mikkeloscar/arch-travis/master/arch-travis.sh | bash'
+
+# vim: ft=yaml ts=2 sw=2 et:

Makefile

@@ -1,25 +1,30 @@
-V=20170813
+V=20200213
 
 PREFIX = /usr/local
+MANDIR = $(PREFIX)/share/man
 
-BINPROGS = \
+IN_PROGS = \
+	archco \
+	arch-nspawn \
+	archrelease \
+	archbuild \
 	checkpkg \
 	commitpkg \
-	archco \
-	archrelease \
-	archrm \
-	archbuild \
-	lddd \
-	finddeps \
-	rebuildpkgs \
-	find-libdeps \
 	crossrepomove\
-	arch-nspawn \
+	finddeps \
+	find-libdeps \
+	lddd \
+	makerepropkg \
 	mkarchroot \
-	makechrootpkg
+	makechrootpkg \
+	offload-build \
+	rebuildpkgs \
+	sogrep
+
+BINPROGS = \
+	$(IN_PROGS)
 
 CONFIGFILES = \
-	makepkg-i686.conf \
 	makepkg-x86_64.conf \
 	pacman-extra.conf \
 	pacman-testing.conf \
@@ -32,7 +37,6 @@ CONFIGFILES = \
 
 COMMITPKG_LINKS = \
 	extrapkg \
-	corepkg \
 	testingpkg \
 	stagingpkg \
 	communitypkg \
@@ -45,18 +49,13 @@ COMMITPKG_LINKS = \
 	gnome-unstablepkg
 
 ARCHBUILD_LINKS = \
-	extra-i686-build \
 	extra-x86_64-build \
-	testing-i686-build \
 	testing-x86_64-build \
-	staging-i686-build \
 	staging-x86_64-build \
 	multilib-build \
 	multilib-testing-build \
 	multilib-staging-build \
-	kde-unstable-i686-build \
 	kde-unstable-x86_64-build \
-	gnome-unstable-i686-build \
 	gnome-unstable-x86_64-build
 
 CROSSREPOMOVE_LINKS = \
@@ -67,9 +66,22 @@ BASHCOMPLETION_LINKS = \
 	archco \
 	communityco
 
-all: $(BINPROGS) bash_completion zsh_completion
 
-edit = sed -e "s|@pkgdatadir[@]|$(DESTDIR)$(PREFIX)/share/devtools|g"
+MANS = \
+	doc/lddd.1 \
+	doc/checkpkg.1 \
+	doc/offload-build.1 \
+	doc/sogrep.1 \
+	doc/makerepropkg.1 \
+	doc/mkarchroot.1 \
+	doc/find-libdeps.1 \
+	doc/find-libprovides.1
+
+
+all: $(BINPROGS) bash_completion zsh_completion man
+man: $(MANS)
+
+edit = sed -e "s|@pkgdatadir[@]|$(PREFIX)/share/devtools|g"
 
 %: %.in Makefile lib/common.sh
 	@echo "GEN $@"
@@ -79,8 +91,13 @@ edit = sed -e "s|@pkgdatadir[@]|$(DESTDIR)$(PREFIX)/share/devtools|g"
 	@chmod +x "$@"
 	@bash -O extglob -n "$@"
 
+$(MANS): doc/asciidoc.conf doc/footer.asciidoc
+
+doc/%: doc/%.asciidoc
+	a2x --no-xmllint --asciidoc-opts="-f doc/asciidoc.conf" -d manpage -f manpage -D doc $<
+
 clean:
-	rm -f $(BINPROGS) bash_completion zsh_completion
+	rm -f $(IN_PROGS) bash_completion zsh_completion $(MANS)
 
 install:
 	install -dm0755 $(DESTDIR)$(PREFIX)/bin
@@ -95,6 +112,9 @@ install:
 	for l in ${BASHCOMPLETION_LINKS}; do ln -sf devtools $(DESTDIR)/usr/share/bash-completion/completions/$$l; done
 	install -Dm0644 zsh_completion $(DESTDIR)$(PREFIX)/share/zsh/site-functions/_devtools
 	ln -sf archco $(DESTDIR)$(PREFIX)/bin/communityco
+	for manfile in $(MANS); do \
+		install -Dm644 $$manfile -t $(DESTDIR)$(MANDIR)/man$${manfile##*.}; \
+	done;
 
 uninstall:
 	for f in ${BINPROGS}; do rm -f $(DESTDIR)$(PREFIX)/bin/$$f; done
@@ -106,6 +126,15 @@ uninstall:
 	rm $(DESTDIR)$(PREFIX)/share/zsh/site-functions/_devtools
 	rm -f $(DESTDIR)$(PREFIX)/bin/communityco
 	rm -f $(DESTDIR)$(PREFIX)/bin/find-libprovides
+	for manfile in $(MANS); do \
+		rm -f $(DESTDIR)$(MANDIR)/man$${manfile##*.}/$${manfile#doc/}; \
+	done;
+
+TODAY=$(shell date +"%Y%m%d")
+tag:
+	@sed -E "s|^V=[0-9]{8}|V=$(TODAY)|" -i Makefile
+	@git commit --gpg-sign --message "Version $(TODAY)" Makefile
+	@git tag --sign --message "Version $(TODAY)" $(TODAY)
 
 dist:
 	git archive --format=tar --prefix=devtools-$(V)/ $(V) | gzip -9 > devtools-$(V).tar.gz
@@ -117,5 +146,5 @@ upload:
 check: $(BINPROGS) bash_completion makepkg-x86_64.conf PKGBUILD.proto
 	shellcheck $^
 
-.PHONY: all clean install uninstall dist upload check
+.PHONY: all clean install uninstall dist upload check tag
 .DELETE_ON_ERROR:

README.md

@@ -0,0 +1,24 @@
+# Devtools - development tools for Arch Linux
+
+This repository contains tools for the Arch Linux distribution for building
+and maintaining official repository packages.
+
+## Patches
+
+Patches can be send to arch-projects@archlinux.org or via a pull request on
+Github. When sending patches to the mailing list make sure to set a valid
+subjectprefix otherwise the email is denied by mailman. Git can be configured
+as following.
+
+```
+git config format.subjectprefix 'devtools] [PATCH'
+```
+
+## Releasing
+
+1. bump the version in the Makefile
+2. Commit everything as  ```Version $(date +"%Y%m%d")```
+3. Create a new tag ```git tag -s $(date +"%Y%m%d")```
+4. Push changes
+5. Upload the source tarball with ```make dist upload```
+6. Update the package

arch-nspawn.in

@@ -13,9 +13,14 @@
 m4_include(lib/common.sh)
 m4_include(lib/archroot.sh)
 
+# umask might have been changed in /etc/profile
+# ensure that sane default is set again
+umask 0022
+
 working_dir=''
 
 files=()
+mount_args=()
 
 usage() {
 	echo "Usage: ${0##*/} [options] working-dir [systemd-nspawn arguments]"
@@ -35,7 +40,7 @@ while getopts 'hC:M:c:f:s' arg; do
 	case "$arg" in
 		C) pac_conf="$OPTARG" ;;
 		M) makepkg_conf="$OPTARG" ;;
-		c) cache_dir="$OPTARG" ;;
+		c) cache_dirs+=("$OPTARG") ;;
 		f) files+=("$OPTARG") ;;
 		s) nosetarch=1 ;;
 		h|?) usage ;;
@@ -52,35 +57,45 @@ shift 1
 
 [[ -z $working_dir ]] && die 'Please specify a working directory.'
 
-if [[ -z $cache_dir ]]; then
-	cache_dirs=($(pacman -v 2>&1 | grep '^Cache Dirs:' | sed 's/Cache Dirs:\s*//g'))
-else
-	cache_dirs=("$cache_dir")
+pacconf_cmd=$(command -v pacman-conf || command -v pacconf)
+
+if (( ${#cache_dirs[@]} == 0 )); then
+	mapfile -t cache_dirs < <($pacconf_cmd --config "${pac_conf:-$working_dir/etc/pacman.conf}" CacheDir)
 fi
 
 # shellcheck disable=2016
-host_mirror=$(pacman --cachedir /doesnt/exist -Sddp extra/devtools 2>/dev/null | sed -r 's#(.*/)extra/os/.*#\1$repo/os/$arch#')
-# shellcheck disable=2016
-[[ $host_mirror == *file://* ]] && host_mirror_path=$(echo "$host_mirror" | sed -r 's#file://(/.*)/\$repo/os/\$arch#\1#g')
+host_mirrors=($($pacconf_cmd --repo extra Server 2> /dev/null | sed -r 's#(.*/)extra/os/.*#\1$repo/os/$arch#'))
+
+for host_mirror in "${host_mirrors[@]}"; do
+	if [[ $host_mirror == *file://* ]]; then
+		host_mirror=$(echo "$host_mirror" | sed -r 's#file://(/.*)/\$repo/os/\$arch#\1#g')
+		in_array "$host_mirror" "${cache_dirs[@]}" || cache_dirs+=("$host_mirror")
+	fi
+done
+
+while read -r line; do
+	mapfile -t lines < <($pacconf_cmd --config "${pac_conf:-$working_dir/etc/pacman.conf}" \
+		--repo $line Server | sed -r 's#(.*/)[^/]+/os/.+#\1#')
+	for line in "${lines[@]}"; do
+		if [[ $line = file://* ]]; then
+			line=${line#file://}
+			in_array "$line" "${cache_dirs[@]}" || cache_dirs+=("$line")
+		fi
+	done
+done < <($pacconf_cmd --config "${pac_conf:-$working_dir/etc/pacman.conf}" --repo-list)
+
+mount_args+=("--bind=${cache_dirs[0]//:/\\:}")
+
+for cache_dir in "${cache_dirs[@]:1}"; do
+	mount_args+=("--bind-ro=${cache_dir//:/\\:}")
+done
 
 # {{{ functions
-build_mount_args() {
-	declare -g mount_args=()
-
-	if [[ -n $host_mirror_path ]]; then
-		mount_args+=("--bind-ro=$host_mirror_path")
-	fi
-
-	mount_args+=("--bind=${cache_dirs[0]}")
-
-	for cache_dir in "${cache_dirs[@]:1}"; do
-		mount_args+=("--bind-ro=$cache_dir")
-	done
-}
-
 copy_hostconf () {
-	cp -a /etc/pacman.d/gnupg "$working_dir/etc/pacman.d"
-	echo "Server = $host_mirror" >"$working_dir/etc/pacman.d/mirrorlist"
+	unshare --fork --pid gpg --homedir "$working_dir"/etc/pacman.d/gnupg/ --no-permission-warning --quiet --batch --import --import-options import-local-sigs "$(pacman-conf GpgDir)"/pubring.gpg >/dev/null 2>&1
+	pacman-key --gpgdir "$working_dir"/etc/pacman.d/gnupg/ --import-trustdb "$(pacman-conf GpgDir)" >/dev/null 2>&1
+
+	printf 'Server = %s\n' "${host_mirrors[@]}" >"$working_dir/etc/pacman.d/mirrorlist"
 
 	[[ -n $pac_conf ]] && cp "$pac_conf" "$working_dir/etc/pacman.conf"
 	[[ -n $makepkg_conf ]] && cp "$makepkg_conf" "$working_dir/etc/makepkg.conf"
@@ -91,7 +106,7 @@ copy_hostconf () {
 		cp -T "$file" "$working_dir$file"
 	done
 
-	sed -r "s|^#?\\s*CacheDir.+|CacheDir = $(echo -n "${cache_dirs[@]}")|g" -i "$working_dir/etc/pacman.conf"
+	sed -r "s|^#?\\s*CacheDir.+|CacheDir = ${cache_dirs[*]}|g" -i "$working_dir/etc/pacman.conf"
 }
 # }}}
 
@@ -104,15 +119,15 @@ elif [[ $(cat "$working_dir/.arch-chroot") != "$CHROOT_VERSION" ]]; then
 	die "chroot '%s' is not at version %s. Please rebuild." "$working_dir" "$CHROOT_VERSION"
 fi
 
-build_mount_args
 copy_hostconf
 
-eval "$(grep '^CARCH=' "$working_dir/etc/makepkg.conf")"
+eval "$(grep -a '^CARCH=' "$working_dir/etc/makepkg.conf")"
 
 [[ -z $nosetarch ]] || unset CARCH
 
 exec ${CARCH:+setarch "$CARCH"} systemd-nspawn -q \
 	-D "$working_dir" \
-	--register=no --keep-unit \
+	-E "PATH=/usr/local/sbin:/usr/local/bin:/usr/bin" \
+	--register=no --keep-unit --as-pid2 \
 	"${mount_args[@]}" \
 	"$@"

archbuild.in

@@ -5,7 +5,7 @@ m4_include(lib/common.sh)
 m4_include(lib/archroot.sh)
 
 base_packages=(base-devel)
-makechrootpkg_args=(-c -n)
+makechrootpkg_args=(-c -n -C)
 
 cmd="${0##*/}"
 if [[ "${cmd%%-*}" == 'multilib' ]]; then
@@ -20,6 +20,15 @@ fi
 chroots='/var/lib/archbuild'
 clean_first=false
 
+pacman_config="@pkgdatadir@/pacman-${repo}.conf"
+if [[ -f @pkgdatadir@/pacman-${repo}-${arch}.conf ]]; then
+    pacman_config="@pkgdatadir@/pacman-${repo}-${arch}.conf"
+fi
+makepkg_config="@pkgdatadir@/makepkg-${arch}.conf"
+if [[ -f @pkgdatadir@/makepkg-${repo}-${arch}.conf ]]; then
+    makepkg_config="@pkgdatadir@/makepkg-${repo}-${arch}.conf"
+fi
+
 usage() {
 	echo "Usage: $cmd [options] -- [makechrootpkg args]"
 	echo '    -h         This help'
@@ -39,7 +48,7 @@ while getopts 'hcr:' arg; do
 	esac
 done
 
-check_root
+check_root SOURCE_DATE_EPOCH,SRCDEST,SRCPKGDEST,PKGDEST,LOGDEST,MAKEFLAGS,PACKAGER,GNUPGHOME
 
 # Pass all arguments after -- right to makepkg
 makechrootpkg_args+=("${@:$OPTIND}")
@@ -59,19 +68,24 @@ if ${clean_first} || [[ ! -d "${chroots}/${repo}-${arch}" ]]; then
 	lock_close 9
 
 	rm -rf --one-file-system "${chroots}/${repo}-${arch}"
-	mkdir -p "${chroots}/${repo}-${arch}"
+	(umask 0022; mkdir -p "${chroots}/${repo}-${arch}")
 	setarch "${arch}" mkarchroot \
-		-C "@pkgdatadir@/pacman-${repo}.conf" \
-		-M "@pkgdatadir@/makepkg-${arch}.conf" \
+		-C "${pacman_config}" \
+		-M "${makepkg_config}" \
 		"${chroots}/${repo}-${arch}/root" \
 		"${base_packages[@]}" || abort
 else
 	lock 9 "${chroots}/${repo}-${arch}/root.lock" "Locking clean chroot"
 	arch-nspawn \
-		-C "@pkgdatadir@/pacman-${repo}.conf" \
-		-M "@pkgdatadir@/makepkg-${arch}.conf" \
+		-C "${pacman_config}" \
+		-M "${makepkg_config}" \
 		"${chroots}/${repo}-${arch}/root" \
-                pacman -Syu --noconfirm || abort
+		pacman -Syuu --noconfirm || abort
+fi
+
+# Always build official packages reproducibly
+if [[ ! -v SOURCE_DATE_EPOCH ]]; then
+	export SOURCE_DATE_EPOCH=$(date +%s)
 fi
 
 msg "Building in chroot for [%s] (%s)..." "${repo}" "${arch}"

archrelease.in

@@ -48,7 +48,8 @@ if [[ $(svn status -q) ]]; then
 fi
 
 pushd .. >/dev/null
-IFS=$'\n' read -r -d '' -a known_files < <(svn ls -r HEAD "$trunk")
+mapfile -t known_files < <(svn ls -r HEAD "$trunk")
+wait $! || die "failed to discover committed files"
 for file in "${known_files[@]}"; do
 	if [[ ${file:(-1)} = '/' ]]; then
 		die "archrelease: subdirectories are not supported in package directories!"
@@ -65,12 +66,12 @@ for tag in "$@"; do
 	stat_busy "Copying %s to %s" "${trunk}" "${tag}"
 
 	if [[ -d repos/$tag ]]; then
-		declare -a trash
-		trash=()
-		while read -r file; do
-			trash+=("repos/$tag/$file")
-		done < <(svn ls "repos/$tag")
-		[[ ${#trash[@]} == 0 ]] || svn rm -q "${trash[@]/%/@}"
+		mapfile -t trash < <(svn ls "repos/$tag")
+		wait $! || die "failed to discover existing files"
+		if (( ${#trash[@]} )); then
+			trash=("${trash[@]/#/repos/$tag/}")
+			svn rm -q "${trash[@]/%/@}"
+		fi
 	else
 		mkdir -p "repos/$tag"
 		svn add --parents -q "repos/$tag"

archrm.in

@@ -1,16 +0,0 @@
-#!/bin/bash
-# License: Unspecified
-
-m4_include(lib/common.sh)
-
-if [[ -z $1 ]]; then
-	echo 'Usage: archrm <path to checkout>'
-	exit 1
-fi
-
-# FIXME: Check if there are uncommited changes
-#pushd $1
-#
-#popd
-
-rm -rf "$1"

checkpkg.in

@@ -22,6 +22,53 @@ elif [[ -r "$HOME/.makepkg.conf" ]]; then
 	source "$HOME/.makepkg.conf"
 fi
 
+usage() {
+    cat <<- _EOF_
+		Usage: ${BASH_SOURCE[0]##*/} [OPTIONS]
+
+		Searches for a locally built package corresponding to the PKGBUILD, and
+		downloads the last version of that package from the Pacman repositories.
+		It then compares the list of .so files provided by each version of the
+		package and outputs if there are soname differences for the new package.
+		A directory is also created using mktemp with files containing a file
+		list for both packages and a library list for both packages.
+
+		OPTIONS
+		    -r, --rmdir     Remove the temporary directory
+		    -w, --warn      Print a warning in case of differences
+		    -h, --help      Show this help text
+_EOF_
+}
+
+RMDIR=0
+WARN=0
+
+OPT_SHORT='rwh'
+OPT_LONG=('rmdir' 'warn' 'help')
+if ! parseopts "$OPT_SHORT" "${OPT_LONG[@]}" -- "$@"; then
+    exit 1
+fi
+set  -- "${OPTRET[@]}"
+
+while :; do
+    case $1 in
+        -r|--rmdir)
+            RMDIR=1
+            ;;
+        -w|--warn)
+            WARN=1
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        --)
+            shift; break
+            ;;
+    esac
+    shift
+done
+
 if [[ ! -f PKGBUILD ]]; then
 	die 'This must be run in the directory of a built package.'
 fi
@@ -33,9 +80,12 @@ if [[ ${arch[0]} == 'any' ]]; then
 fi
 
 STARTDIR=$(pwd)
+(( RMDIR )) && trap 'rm -rf $TEMPDIR' EXIT INT TERM QUIT
 TEMPDIR=$(mktemp -d --tmpdir checkpkg-script.XXXX)
 
 for _pkgname in "${pkgname[@]}"; do
+	comparepkg=$_pkgname
+	pkgurl=
 	target_pkgver=$(get_full_version "$_pkgname")
 	if ! pkgfile=$(find_cached_package "$_pkgname" "$target_pkgver" "$CARCH"); then
 		die 'tarball not found for package: %s' "${_pkgname}-$target_pkgver"
@@ -43,16 +93,29 @@ for _pkgname in "${pkgname[@]}"; do
 
 	ln -s "$pkgfile" "$TEMPDIR"
 
-	pkgurl=$(pacman -Spdd --print-format '%l' --noconfirm "$_pkgname") ||
-		die "Couldn't download previous package for %s." "$_pkgname"
+	if (( $# )); then
+		case $1 in
+			/*|*/*)
+				pkgurl=file://$(readlink -m "$1") ;;
+			*.pkg.tar*)
+				pkgurl=$1 ;;
+			'')
+				;;
+			*)
+				comparepkg=$1 ;;
+		esac
+		shift
+	fi
+	[[ -n $pkgurl ]] || pkgurl=$(pacman -Spdd --print-format '%l' --noconfirm "$comparepkg") ||
+		die "Couldn't download previous package for %s." "$comparepkg"
 
-	oldpkg=${pkgurl##*://*/}
+	oldpkg=${pkgurl##*/}
 
-	if [[ ${oldpkg##*/} = "${pkgfile##*/}" ]]; then
+	if [[ ${oldpkg} = "${pkgfile##*/}" ]]; then
 		die "The built package (%s) is the one in the repo right now!" "$_pkgname"
 	fi
 
-	if [[ $pkgurl = file://* ]]; then
+	if [[ $pkgurl = file://* || ( $pkgurl = /* && -f $pkgurl ) ]]; then
 		ln -s "${pkgurl#file://}" "$TEMPDIR/$oldpkg"
 	elif [[ -f "$PKGDEST/$oldpkg" ]]; then
 		ln -s "$PKGDEST/$oldpkg" "$TEMPDIR/$oldpkg"
@@ -70,11 +133,12 @@ for _pkgname in "${pkgname[@]}"; do
 	find-libprovides "$TEMPDIR/$oldpkg" 2>/dev/null | sort > "$TEMPDIR/libraries-$_pkgname-old"
 	find-libprovides "$pkgfile" 2>/dev/null | sort > "$TEMPDIR/libraries-$_pkgname"
 	if ! diff_output="$(sdiff -s "$TEMPDIR/libraries-$_pkgname-old" "$TEMPDIR/libraries-$_pkgname")"; then
-		msg "Sonames differ in $_pkgname!"
+		message="Sonames differ in $_pkgname!"
+		(( WARN )) && warning "$message" || msg "$message"
 		echo "$diff_output"
 	else
 		msg "No soname differences for %s." "$_pkgname"
 	fi
 done
 
-msg "Files saved to %s" "$TEMPDIR"
+(( RMDIR )) || msg "Files saved to %s" "$TEMPDIR"

commitpkg.in

@@ -83,7 +83,7 @@ while getopts ':l:a:s:f' flag; do
 done
 shift $(( OPTIND - 1 ))
 
-# check packages have the packager field set
+# check packages for validity
 for _arch in "${arch[@]}"; do
 	if [[ -n $commit_arch && ${_arch} != "$commit_arch" ]]; then
 		continue
@@ -91,10 +91,15 @@ for _arch in "${arch[@]}"; do
 	for _pkgname in "${pkgname[@]}"; do
 		fullver=$(get_full_version "$_pkgname")
 
-		if pkgfile=$(find_cached_package "$_pkgname" "$_arch" "$fullver"); then
+		if pkgfile=$(find_cached_package "$_pkgname" "$fullver" "$_arch"); then
 			if grep -q "packager = Unknown Packager" <(bsdtar -xOqf "$pkgfile" .PKGINFO); then
 				die "PACKAGER was not set when building package"
 			fi
+			hashsum=sha256sum
+			pkgbuild_hash=$(awk -v"hashsum=$hashsum" -F' = ' '$1 == "pkgbuild_"hashsum {print $2}' <(bsdtar -xOqf "$pkgfile" .BUILDINFO))
+			if [[ "$pkgbuild_hash" != "$($hashsum PKGBUILD|cut -d' ' -f1)" ]]; then
+				die "PKGBUILD $hashsum mismatch: expected $pkgbuild_hash"
+			fi
 		fi
 	done
 done
@@ -104,10 +109,10 @@ if [[ -z $server ]]; then
 fi
 
 if [[ -n $(svn status -q) ]]; then
-	msgtemplate="upgpkg: $pkgbase $(get_full_version)"$'\n\n'
+	msgtemplate="upgpkg: $pkgbase $(get_full_version)"
 	if [[ -n $1 ]]; then
 		stat_busy 'Committing changes to trunk'
-		svn commit -q -m "${msgtemplate}${1}" || die
+		svn commit -q -m "${msgtemplate}: ${1}" || die
 		stat_done
 	else
 		msgfile="$(mktemp)"
@@ -157,8 +162,8 @@ for _arch in "${arch[@]}"; do
 			fi
 			gpg --detach-sign --use-agent --no-armor "${SIGNWITHKEY[@]}" "${pkgfile}" || die
 		fi
-		if ! gpg --verify "$sigfile" >/dev/null 2>&1; then
-			die "Signature %s.sig is incorrect!" "$pkgfile"
+		if ! gpg --verify "$sigfile" "$pkgfile" >/dev/null 2>&1; then
+			die "Signature %s is incorrect!" "$sigfile"
 		fi
 		uploads+=("$sigfile")
 	done
@@ -189,12 +194,11 @@ if [[ ${#uploads[*]} -gt 0 ]]; then
 fi
 
 if [[ "${arch[*]}" == 'any' ]]; then
-	if [[ -d ../repos/$repo-i686 && -d ../repos/$repo-x86_64 ]]; then
+	if [[ -d ../repos/$repo-x86_64 ]]; then
 		pushd ../repos/ >/dev/null
-		stat_busy "Removing %s and %s" "$repo-i686" "$repo-x86_64"
-		svn rm -q "$repo-i686"
+		stat_busy "Removing %s" "$repo-x86_64"
 		svn rm -q "$repo-x86_64"
-		svn commit -q -m "Removed $repo-i686 and $repo-x86_64 for $pkgname"
+		svn commit -q -m "Removed $repo-x86_64 for $pkgname"
 		stat_done
 		popd >/dev/null
 	fi

crossrepomove.in

@@ -64,7 +64,6 @@ done
 
 msg "Adding %s to %s" "${pkgbase}" "${target_repo}"
 svn -q add "target_checkout/${pkgbase}"
-svn -q propset svn:keywords 'Id' "target_checkout/${pkgbase}/trunk/PKGBUILD"
 svn -q commit -m"${scriptname}: Moving ${pkgbase} from ${source_repo} to ${target_repo}" target_checkout
 pushd "target_checkout/${pkgbase}/trunk" >/dev/null
 archrelease "${arch[@]/#/$target_repo-}" || die

doc/asciidoc.conf

@@ -0,0 +1,37 @@
+## linkman: macro
+# Inspired by/borrowed from the GIT source tree at Documentation/asciidoc.conf
+#
+# Usage: linkman:command[manpage-section]
+#
+# Note, {0} is the manpage section, while {target} is the command.
+#
+# Show man link as: <command>(<section>); if section is defined, else just show
+# the command.
+
+[macros]
+(?su)[\\]?(?P<name>linkman):(?P<target>\S*?)\[(?P<attrlist>.*?)\]=
+
+[attributes]
+asterisk=&#42;
+plus=&#43;
+caret=&#94;
+startsb=&#91;
+endsb=&#93;
+backslash=&#92;
+tilde=&#126;
+apostrophe=&#39;
+backtick=&#96;
+litdd=&#45;&#45;
+
+ifdef::backend-docbook[]
+[linkman-inlinemacro]
+{0%{target}}
+{0#<citerefentry>}
+{0#<refentrytitle>{target}</refentrytitle><manvolnum>{0}</manvolnum>}
+{0#</citerefentry>}
+endif::backend-docbook[]
+
+ifdef::backend-xhtml11[]
+[linkman-inlinemacro]
+<a href="{target}.{0}.html">{target}{0?({0})}</a>
+endif::backend-xhtml11[]

doc/checkpkg.1.asciidoc

@@ -0,0 +1,40 @@
+checkpkg(1)
+===========
+
+Name
+----
+checkpkg - Compare the current build package with the repository version
+
+Synopsis
+--------
+checkpkg
+
+Description
+-----------
+
+Searches for a locally built package corresponding to the PKGBUILD, and
+downloads the last version of that package from the Pacman repositories. It
+then compares the list of .so files provided by each version of the package and
+outputs if there are soname differences for the new package. A directory is
+also created using mktemp with files containing a file list for both packages
+and a library list for both packages.
+
+Options
+-------
+
+*-r, --rmdir*::
+	Remove the temporary directory created to contain the file and library list
+	of both packages.
+
+*-w, --warn*::
+	Print a warning instead of a regular message in case of soname differences.
+
+*-h, --help*::
+	Show a help text
+
+See Also
+--------
+
+linkman:find-libprovides[1]
+
+include::footer.asciidoc[]

doc/find-libdeps.1.asciidoc

@@ -0,0 +1,24 @@
+find-libdeps(1)
+===============
+
+Name
+----
+find-libdeps - Find soname dependencies for a package
+
+Synopsis
+--------
+find-libdeps [options]
+
+Description
+-----------
+Finds soname dependencies of a package and prints out a list in the following
+format '<soname>=<soversion>-<soarch>'.
+
+Options
+-------
+
+*--ignore-internal*::
+	Ignore internal libraries.
+
+
+include::footer.asciidoc[]

doc/find-libprovides.1.asciidoc

@@ -0,0 +1,24 @@
+find-libprovides(1)
+===================
+
+Name
+----
+find-libprovides - Find soname's which are provided by a package
+
+Synopsis
+--------
+find-libprovides [options]
+
+Description
+-----------
+
+Finds soname's provided by a package and prints out a list in the following
+format '<soname>=<soversion>-<soarch>'.
+
+Options
+-------
+
+*--ignore-internal*::
+	Ignore internal libraries.
+
+include::footer.asciidoc[]

doc/footer.asciidoc

@@ -0,0 +1,29 @@
+
+Bugs
+----
+Bugs can be reported on the bug tracker 'https://bugs.archlinux.org' in the Arch
+Linux category and title prefixed with [devtools] or via
+mailto:arch-projects@archlinux.org[].
+
+
+Authors
+-------
+
+Maintainers:
+
+* Aaron Griffin <aaronmgriffin@gmail.com>
+* Allan McRae <allan@archlinux.org>
+* Bartłomiej Piotrowski <bpiotrowski@archlinux.org>
+* Dan McGee <dan@archlinux.org>
+* Dave Reisner <dreisner@archlinux.org>
+* Evangelos Foutras <evangelos@foutrelis.com>
+* Jan Alexander Steffens (heftig) <jan.steffens@gmail.com>
+* Jelle van der Waa <jelle@archlinux.org>
+* Levente Polyak <anthraxx@archlinux.org>
+* Pierre Schmitz <pierre@archlinux.de>
+* Sébastien Luttringer <seblu@seblu.net>
+* Sven-Hendrik Haase <svenstaro@gmail.com>
+* Thomas Bächler <thomas@archlinux.org>
+
+For additional contributors, use `git shortlog -s` on the devtools.git
+repository.

doc/lddd.1.asciidoc

@@ -0,0 +1,25 @@
+lddd(1)
+=======
+
+Name
+----
+lddd - Find broken library links on your system
+
+Synopsis
+--------
+lddd
+
+Description
+-----------
+
+Scans '$PATH', '/lib', '/usr/lib', '/usr/local/lib' and
+'/etc/ld.so.conf.d/*.conf' directories for ELF files with references to missing
+shared libraries, and suggests which packages might need to be rebuilt. The
+collected data is written to a temporary directory created by mktemp.
+
+See Also
+--------
+
+linkman:ldd[1]
+
+include::footer.asciidoc[]

doc/makerepropkg.1.asciidoc

@@ -0,0 +1,38 @@
+makerepropkg(1)
+================
+
+Name
+----
+makerepropkg - Rebuild a package to see if it is reproducible
+
+Synopsis
+--------
+makerepropkg [OPTIONS] <package_file>
+
+Description
+-----------
+
+Given the path to a built pacman package, attempt to rebuild it using the
+PKGBUILD in the current directory. The package will be built in an environment
+as closely matching the environment of the initial package as possible, by
+building up a chroot to match the information exposed in the package's
+linkman:BUILDINFO[5] manifest. On success, the resulting package will be
+compared to the input package, and makerepropkg will report whether the
+artifacts are identical.
+
+This implements a verifier for pacman/libalpm packages in accordance with the
+link:https://reproducible-builds.org/[Reproducible Builds] project.
+
+Options
+-------
+
+*-c*::
+	Set the pacman cache directory.
+
+*-M* <file>::
+	Location of a makepkg config file.
+
+*-h*::
+	Show this usage message
+
+include::footer.asciidoc[]

doc/mkarchroot.1.asciidoc

@@ -0,0 +1,49 @@
+mkarchroot(1)
+==============
+
+Name
+----
+mkarchroot - Creates an arch chroot in a specified location with a specified set of packages
+
+Synopsis
+--------
+mkarchroot [options] [location] [packages]
+
+Description
+-----------
+
+'mkarchroot' is a script to create an Arch Linux chroot at a specified location
+with specified packages. Typically used by 'makechrootpkg' to create build
+chroots. Apart from installing specified packages the chroot is created with an
+en_US.UTF-8 and de_DE.UTF-8 locale and a generated machine-id.
+
+Options
+-------
+
+*-U*::
+	Use 'pacman -U' to install packages.
+
+*-C* <file>::
+	Location of a pacman config file.
+
+*-M* <file>::
+	Location of a makepkg config file.
+
+*-c* <dir>::
+	Set pacman cache.
+
+*-f* <file>::
+	Copy file from the host to the chroot.
+
+*-s*::
+	Do not run setarch.
+
+*-h*::
+	Output command line options.
+
+See Also
+--------
+
+linkman:pacman[1]
+
+include::footer.asciidoc[]

doc/offload-build.1.asciidoc

@@ -0,0 +1,52 @@
+offload-build(1)
+================
+
+Name
+----
+offload-build - Build a PKGBUILD on a remote server using makechrootpkg
+
+Synopsis
+--------
+offload-build [OPTIONS] -- [ARCHBUILD_OPTIONS]
+
+Description
+-----------
+
+Build a PKGBUILD on a remote server using makechrootpkg. Requires a remote user
+that can run archbuild in a non-interactive manner, e.g. must be able to
+elevate permissions using passwordless sudo.
+
+Options
+-------
+
+*-r, --repo* <reponame>::
+	Build against a specific repository. The default is `extra`, to build packages using
+	the stable repositories via extra-x86_64-build.
+
+*-a, --arch* <architecture>::
+	Build against a specific architecture. The default is `x86_64`, the only
+	architecture officially supported by Arch Linux.
+
+*-s, --server* <hostname>::
+	Offload to a specific build server. The default is dragon.archlinux.org
+	which is used as part of the build toolchain for the official Arch Linux
+	repos.
+
+*-h, --help*::
+	Show a help text.
+
+Passing options to archbuild
+----------------------------
+
+Options after a delimiting -- are passed on to archbuild on the remote.
+archbuild in turn supports passing arguments on to makechrootpkg, which in turn
+supports passing options to makepkg. Since each uses -- to delimit options that
+are forwarded, make sure to escape them properly:
+
+	`offload-build offload-args -- archbuild-args -- makechrootpkg-args -- makepkg-args`
+
+Example: To use a second `testing-x86_64-build` instance with another copydir:
+
+	`offload-build -r testing -- -- -l <chroot_copy>`
+
+include::footer.asciidoc[]

doc/sogrep.1.asciidoc

@@ -0,0 +1,48 @@
+sogrep(1)
+=========
+
+Name
+----
+sogrep - Find shared library links in an Arch Linux repository
+
+Synopsis
+--------
+sogrep [options] repo libname
+
+Description
+-----------
+
+Check the soname links database for Arch Linux repositories containing packages
+linked to a given shared library. If the repository specified is "all", then
+all repositories will be searched, otherwise only the named repository will be
+searched.
+
+If the links database does not exist, it will be downloaded first.
+
+Options
+-------
+
+*-v, --verbose*::
+    Provide detailed output containing the matched links for each package, the
+    repository it came from (in the event that all repositories are being
+    searched), and, in combination with `-r`, a progress bar for the links
+    database download.
+
+*-r, --refresh*::
+	Refresh the links databases
+
+*-h, --help*::
+	Show a help text
+
+
+Environment Variables
+---------------------
+**SOLINKS_MIRROR**="https://mirror.foo.com"
+	Alternative mirror to use for downloading soname links database.
+
+**SOCACHE_DIR**="/path/to/directory"::
+	Directory where soname links database is stored, overrides the default
+	directory set by the **XDG_CACHE_HOME** environment variable or the
+	**HOME** environment variable if **XDG_CACHE_HOME** is not set.
+
+include::footer.asciidoc[]

find-libdeps.in

@@ -13,7 +13,7 @@ if [[ $1 = "--ignore-internal" ]]; then
 	shift
 fi
 
-script_mode=${0##*/find-lib}
+script_mode=${BASH_SOURCE[0]##*/find-lib}
 
 case $script_mode in
 	deps|provides) true;;
@@ -46,7 +46,7 @@ process_sofile() {
 	# extract the major version: 1
 	soversion="${sofile##*\.so\.}"
 	if [[ "$soversion" = "$sofile" ]] && ((IGNORE_INTERNAL)); then
-		continue
+		return
 	fi
 	if ! in_array "${soname}=${soversion}-${soarch}" "${soobjects[@]}"; then
 		# libfoo.so=1-64
@@ -57,7 +57,7 @@ process_sofile() {
 
 case $script_mode in
 	deps) find_args=(-perm -u+x);;
-  provides) find_args=(-name '*.so*');;
+	provides) find_args=(-name '*.so*');;
 esac
 
 find . -type f "${find_args[@]}" | while read -r filename; do

finddeps.in

@@ -17,7 +17,7 @@ if [[ -z $match ]]; then
 	exit 1
 fi
 
-find . -type d | while read -r d; do
+find . -type d -print0 2>/dev/null| while read -r -d '' d; do
 	if [[ -f "$d/PKGBUILD" ]]; then
 		pkgname=() depends=() makedepends=() optdepends=()
 		# shellcheck source=PKGBUILD.proto

lib/archroot.sh

@@ -6,13 +6,15 @@
 CHROOT_VERSION='v4'
 
 ##
-#  usage : check_root
+#  usage : check_root $keepenv
 ##
-orig_argv=("$0" "$@")
+orig_argv=("${BASH_SOURCE[0]}" "$@")
 check_root() {
+	local keepenv=$1
+
 	(( EUID == 0 )) && return
 	if type -P sudo >/dev/null; then
-		exec sudo -- "${orig_argv[@]}"
+		exec sudo --preserve-env=$keepenv -- "${orig_argv[@]}"
 	else
 		exec su root -c "$(printf ' %q' "${orig_argv[@]}")"
 	fi
@@ -35,14 +37,6 @@ is_subvolume() {
 	[[ -e "$1" && "$(stat -f -c %T "$1")" == btrfs && "$(stat -c %i "$1")" == 256 ]]
 }
 
-##
-#  usage : is_same_fs( $path_a, $path_b )
-# return : whether $path_a and $path_b are on the same filesystem
-##
-is_same_fs() {
-	[[ "$(stat -c %d "$1")" == "$(stat -c %d "$1")" ]]
-}
-
 ##
 #  usage : subvolume_delete_recursive( $path )
 #

lib/common.sh

@@ -4,7 +4,12 @@
 # License: Unspecified
 
 [[ -z ${_INCLUDE_COMMON_SH:-} ]] || return 0
-_INCLUDE_COMMON_SH=true
+_INCLUDE_COMMON_SH="$(set +o|grep nounset)"
+
+set +u +o posix
+# shellcheck disable=1091
+. /usr/share/makepkg/util.sh
+$_INCLUDE_COMMON_SH
 
 # Avoid any encoding problems
 export LANG=C
@@ -12,56 +17,12 @@ export LANG=C
 shopt -s extglob
 
 # check if messages are to be printed using color
-declare ALL_OFF='' BOLD='' BLUE='' GREEN='' RED='' YELLOW=''
-if [[ -t 2 ]]; then
-	# prefer terminal safe colored and bold text when tput is supported
-	if tput setaf 0 &>/dev/null; then
-		ALL_OFF="$(tput sgr0)"
-		BOLD="$(tput bold)"
-		BLUE="${BOLD}$(tput setaf 4)"
-		GREEN="${BOLD}$(tput setaf 2)"
-		RED="${BOLD}$(tput setaf 1)"
-		YELLOW="${BOLD}$(tput setaf 3)"
-	else
-		ALL_OFF="\e[1;0m"
-		BOLD="\e[1;1m"
-		BLUE="${BOLD}\e[1;34m"
-		GREEN="${BOLD}\e[1;32m"
-		RED="${BOLD}\e[1;31m"
-		YELLOW="${BOLD}\e[1;33m"
-	fi
+if [[ -t 2 && "$TERM" != dumb ]]; then
+	colorize
+else
+	# shellcheck disable=2034
+	declare -gr ALL_OFF='' BOLD='' BLUE='' GREEN='' RED='' YELLOW=''
 fi
-readonly ALL_OFF BOLD BLUE GREEN RED YELLOW
-
-plain() {
-	local mesg=$1; shift
-	# shellcheck disable=2059
-	printf "${BOLD}    ${mesg}${ALL_OFF}\n" "$@" >&2
-}
-
-msg() {
-	local mesg=$1; shift
-	# shellcheck disable=2059
-	printf "${GREEN}==>${ALL_OFF}${BOLD} ${mesg}${ALL_OFF}\n" "$@" >&2
-}
-
-msg2() {
-	local mesg=$1; shift
-	# shellcheck disable=2059
-	printf "${BLUE}  ->${ALL_OFF}${BOLD} ${mesg}${ALL_OFF}\n" "$@" >&2
-}
-
-warning() {
-	local mesg=$1; shift
-	# shellcheck disable=2059
-	printf "${YELLOW}==> WARNING:${ALL_OFF}${BOLD} ${mesg}${ALL_OFF}\n" "$@" >&2
-}
-
-error() {
-	local mesg=$1; shift
-	# shellcheck disable=2059
-	printf "${RED}==> ERROR:${ALL_OFF}${BOLD} ${mesg}${ALL_OFF}\n" "$@" >&2
-}
 
 stat_busy() {
 	local mesg=$1; shift
@@ -110,51 +71,6 @@ die() {
 	cleanup 255
 }
 
-##
-#  usage : in_array( $needle, $haystack )
-# return : 0 - found
-#          1 - not found
-##
-in_array() {
-	local needle=$1; shift
-	local item
-	for item in "$@"; do
-		[[ $item = "$needle" ]] && return 0 # Found
-	done
-	return 1 # Not Found
-}
-
-##
-#  usage : get_full_version( [$pkgname] )
-# return : full version spec, including epoch (if necessary), pkgver, pkgrel
-##
-get_full_version() {
-	# set defaults if they weren't specified in buildfile
-	local pkgbase=${pkgbase:-${pkgname[0]}}
-	local epoch=${epoch:-0}
-	local pkgver=${pkgver}
-	local pkgrel=${pkgrel}
-	if [[ -z $1 ]]; then
-		if (( ! epoch )); then
-			printf '%s\n' "$pkgver-$pkgrel"
-		else
-			printf '%s\n' "$epoch:$pkgver-$pkgrel"
-		fi
-	else
-		local pkgver_override='' pkgrel_override='' epoch_override=''
-		for i in pkgver pkgrel epoch; do
-			local indirect="${i}_override"
-			eval "$(declare -f "package_$1" | sed -n "s/\(^[[:space:]]*$i=\)/${i}_override=/p")"
-			[[ -z ${!indirect} ]] && eval ${indirect}=\"${!i}\"
-		done
-		if (( ! epoch_override )); then
-			printf '%s\n' "$pkgver_override-$pkgrel_override"
-		else
-			printf '%s\n' "$epoch_override:$pkgver_override-$pkgrel_override"
-		fi
-	fi
-}
-
 ##
 #  usage : lock( $fd, $file, $message, [ $message_arguments... ] )
 ##
@@ -226,7 +142,7 @@ find_cached_package() {
 	for dir in "${searchdirs[@]}"; do
 		[[ -d $dir ]] || continue
 
-		for pkg in "$dir"/*.pkg.tar?(.?z); do
+		for pkg in "$dir"/*.pkg.tar?(.!(sig|*.*)); do
 			[[ -f $pkg ]] || continue
 
 			# avoid adding duplicates of the same inode
@@ -236,7 +152,7 @@ find_cached_package() {
 
 			# split apart package filename into parts
 			pkgbasename=${pkg##*/}
-			pkgbasename=${pkgbasename%.pkg.tar?(.?z)}
+			pkgbasename=${pkgbasename%.pkg.tar*}
 
 			arch=${pkgbasename##*-}
 			pkgbasename=${pkgbasename%-"$arch"}

lib/valid-repos.sh

@@ -0,0 +1,31 @@
+#!/hint/bash
+# License: Unspecified
+:
+
+# shellcheck disable=2034
+_repos=(
+	staging
+	testing
+	core
+	extra
+	community-staging
+	community-testing
+	community
+	multilib-staging
+	multilib-testing
+	multilib
+	gnome-unstable
+	kde-unstable
+)
+
+# shellcheck disable=2034
+_build_repos=(
+	staging
+	testing
+	extra
+	multilib-staging
+	multilib-testing
+	multilib
+	gnome-unstable
+	kde-unstable
+)

lib/valid-tags.sh

@@ -4,23 +4,22 @@
 
 # shellcheck disable=2034
 _arch=(
-	i686
 	x86_64
 	any
 )
 
 # shellcheck disable=2034
 _tags=(
-	core-i686 core-x86_64 core-any
-	extra-i686 extra-x86_64 extra-any
+	core-x86_64 core-any
+	extra-x86_64 extra-any
 	multilib-x86_64
-	staging-i686 staging-x86_64 staging-any
-	testing-i686 testing-x86_64 testing-any
+	staging-x86_64 staging-any
+	testing-x86_64 testing-any
 	multilib-testing-x86_64
 	multilib-staging-x86_64
-	community-i686 community-x86_64 community-any
-	community-staging-i686 community-staging-x86_64 community-staging-any
-	community-testing-i686 community-testing-x86_64 community-testing-any
-	kde-unstable-i686 kde-unstable-x86_64 kde-unstable-any
-	gnome-unstable-i686 gnome-unstable-x86_64 gnome-unstable-any
+	community-x86_64 community-any
+	community-staging-x86_64 community-staging-any
+	community-testing-x86_64 community-testing-any
+	kde-unstable-x86_64 kde-unstable-any
+	gnome-unstable-x86_64 gnome-unstable-any
 )

makechrootpkg.in

@@ -13,30 +13,33 @@
 m4_include(lib/common.sh)
 m4_include(lib/archroot.sh)
 
+source /usr/share/makepkg/util/config.sh
+
 shopt -s nullglob
 
-init_variables() {
-	default_makepkg_args=(--syncdeps --noconfirm --log --holdver --skipinteg)
-	makepkg_args=("${default_makepkg_args[@]}")
-	keepbuilddir=false
-	update_first=false
-	clean_first=false
-	run_namcap=false
-	temp_chroot=false
-	chrootdir=
-	passeddir=
-	makepkg_user=
-	declare -ga install_pkgs
-	declare -gi ret=0
+default_makepkg_args=(--syncdeps --noconfirm --log --holdver --skipinteg)
+makepkg_args=("${default_makepkg_args[@]}")
+verifysource_args=()
+chrootdir=
+passeddir=
+makepkg_user=
+declare -a install_pkgs
+declare -i ret=0
 
-	bindmounts_ro=()
-	bindmounts_rw=()
+keepbuilddir=0
+update_first=0
+clean_first=0
+run_namcap=0
+run_checkpkg=0
+temp_chroot=0
 
-	copy=$USER
-	[[ -n ${SUDO_USER:-} ]] && copy=$SUDO_USER
-	[[ -z "$copy" || $copy = root ]] && copy=copy
-	src_owner=${SUDO_USER:-$USER}
-}
+bindmounts_ro=()
+bindmounts_rw=()
+
+copy=$USER
+[[ -n ${SUDO_USER:-} ]] && copy=$SUDO_USER
+[[ -z "$copy" || $copy = root ]] && copy=copy
+src_owner=${SUDO_USER:-$USER}
 
 usage() {
 	echo "Usage: ${0##*/} [options] -r <chrootdir> [--] [makepkg args]"
@@ -72,63 +75,38 @@ usage() {
 	echo '           Useful for maintaining multiple copies'
 	echo "           Default: $copy"
 	echo '-n         Run namcap on the package'
+	echo '-C         Run checkpkg on the package'
 	echo '-T         Build in a temporary directory'
 	echo '-U         Run makepkg as a specified user'
 	exit 1
 }
 
 # {{{ functions
-# Usage: load_vars $makepkg_conf
-# Globals:
-#  - SRCDEST
-#  - SRCPKGDEST
-#  - PKGDEST
-#  - LOGDEST
-#  - MAKEFLAGS
-#  - PACKAGER
-load_vars() {
-	local makepkg_conf="$1" var
-
-	[[ -f $makepkg_conf ]] || return 1
-
-	for var in {SRC,SRCPKG,PKG,LOG}DEST MAKEFLAGS PACKAGER; do
-		[[ -z ${!var:-} ]] && eval "$(grep "^${var}=" "$makepkg_conf")"
-	done
-
-	return 0
-}
-
-# Usage: sync_chroot $rootdir $copydir [$copy]
+# Usage: sync_chroot $chrootdir $copydir [$copy]
 sync_chroot() {
-	local rootdir=$1
+	local chrootdir=$1
 	local copydir=$2
 	local copy=${3:-$2}
 
-	if [[ "$rootdir" -ef "$copydir" ]]; then
+	if [[ "$chrootdir/root" -ef "$copydir" ]]; then
 		error 'Cannot sync copy with itself: %s' "$copydir"
 		return 1
 	fi
 
 	# Get a read lock on the root chroot to make
 	# sure we don't clone a half-updated chroot
-	slock 8 "$rootdir.lock" \
-		"Locking clean chroot [%s]" "$rootdir"
+	slock 8 "$chrootdir/root.lock" \
+		"Locking clean chroot [%s]" "$chrootdir/root"
 
-	stat_busy "Synchronizing chroot copy [%s] -> [%s]" "$rootdir" "$copy"
-	if is_subvolume "$rootdir" && is_same_fs "$rootdir" "$(dirname -- "$copydir")" && ! mountpoint -q "$copydir"; then
-		if is_subvolume "$copydir"; then
-			subvolume_delete_recursive "$copydir" ||
-				die "Unable to delete subvolume %s" "$copydir"
-		else
-			# avoid change of filesystem in case of an umount failure
-			rm --recursive --force --one-file-system "$copydir" ||
-				die "Unable to delete %s" "$copydir"
-		fi
-		btrfs subvolume snapshot "$rootdir" "$copydir" >/dev/null ||
+	stat_busy "Synchronizing chroot copy [%s] -> [%s]" "$chrootdir/root" "$copy"
+	if is_btrfs "$chrootdir" && ! mountpoint -q "$copydir"; then
+		subvolume_delete_recursive "$copydir" ||
+			die "Unable to delete subvolume %s" "$copydir"
+		btrfs subvolume snapshot "$chrootdir/root" "$copydir" >/dev/null ||
 			die "Unable to create subvolume %s" "$copydir"
 	else
 		mkdir -p "$copydir"
-		rsync -a --delete -q -W -x "$rootdir/" "$copydir"
+		rsync -a --delete -q -W -x "$chrootdir/root/" "$copydir"
 	fi
 	stat_done
 
@@ -159,11 +137,7 @@ delete_chroot() {
 	stat_done
 }
 
-# Usage: install_packages $copydir $pkgs...
 install_packages() {
-	local copydir=$1
-	local install_pkgs=("${@:2}")
-
 	local -a pkgnames
 	local ret
 
@@ -171,44 +145,31 @@ install_packages() {
 
 	cp -- "${install_pkgs[@]}" "$copydir/root/"
 	arch-nspawn "$copydir" "${bindmounts_ro[@]}" "${bindmounts_rw[@]}" \
-		pacman -U --noconfirm -- "${pkgnames[@]/#//root/}"
+		bash -c 'yes y | pacman -U -- "$@"' -bash "${pkgnames[@]/#//root/}"
 	ret=$?
 	rm -- "${pkgnames[@]/#/$copydir/root/}"
 
 	return $ret
 }
 
-# Usage: prepare_chroot $copydir $HOME $keepbuilddir $run_namcap
-# Globals:
-#  - MAKEFLAGS
-#  - PACKAGER
 prepare_chroot() {
-	local copydir=$1
-	local USER_HOME=$2
-	local keepbuilddir=$3
-	local run_namcap=$4
-
-	$keepbuilddir || rm -rf "$copydir/build"
+	(( keepbuilddir )) || rm -rf "$copydir/build"
 
 	local builduser_uid builduser_gid
-	builduser_uid="${SUDO_UID:-$UID}"
-	builduser_gid="$(id -g "$builduser_uid")"
+	builduser_uid="$(id -u "$makepkg_user")"
+	builduser_gid="$(id -g "$makepkg_user")"
 	local install="install -o $builduser_uid -g $builduser_gid"
 	local x
 
 	# We can't use useradd without chrooting, otherwise it invokes PAM modules
 	# which we might not be able to load (i.e. when building i686 packages on
 	# an x86_64 host).
-	sed -e '/^builduser:/d' -i "$copydir"/etc/{passwd,group}
+	sed -e '/^builduser:/d' -i "$copydir"/etc/{passwd,shadow,group}
 	printf >>"$copydir/etc/group"  'builduser:x:%d:\n' "$builduser_gid"
 	printf >>"$copydir/etc/passwd" 'builduser:x:%d:%d:builduser:/build:/bin/bash\n' "$builduser_uid" "$builduser_gid"
+	printf >>"$copydir/etc/shadow" 'builduser:!!:%d::::::\n' "$(( $(date -u +%s) / 86400 ))"
 
-	$install -d "$copydir"/{build,build/.gnupg,startdir,{pkg,srcpkg,src,log}dest}
-
-	for x in .gnupg/pubring.{kbx,gpg}; do
-		[[ -r $USER_HOME/$x ]] || continue
-		$install -m 644 "$USER_HOME/$x" "$copydir/build/$x"
-	done
+	$install -d "$copydir"/{build,startdir,{pkg,srcpkg,src,log}dest}
 
 	sed -e '/^MAKEFLAGS=/d' -e '/^PACKAGER=/d' -i "$copydir/etc/makepkg.conf"
 	for x in BUILDDIR=/build PKGDEST=/pkgdest SRCPKGDEST=/srcpkgdest SRCDEST=/srcdest LOGDEST=/logdest \
@@ -228,9 +189,10 @@ EOF
 	{
 		printf '#!/bin/bash\n'
 		declare -f _chrootbuild
+		declare -p SOURCE_DATE_EPOCH 2>/dev/null || true
 		printf '_chrootbuild "$@" || exit\n'
 
-		if $run_namcap; then
+		if (( run_namcap )); then
 			declare -f _chrootnamcap
 			printf '_chrootnamcap || exit\n'
 		fi
@@ -241,13 +203,24 @@ EOF
 # These functions aren't run in makechrootpkg,
 # so no global variables
 _chrootbuild() {
+	# No coredumps
+	ulimit -c 0
+
 	# shellcheck source=/dev/null
 	. /etc/profile
+
 	# Beware, there are some stupid arbitrary rules on how you can
 	# use "$" in arguments to commands with "sudo -i".  ${foo} or
 	# ${1} is OK, but $foo or $1 isn't.
 	# https://bugzilla.sudo.ws/show_bug.cgi?id=765
-	sudo -iu builduser bash -c 'cd /startdir; makepkg "$@"' -bash "$@"
+	sudo --preserve-env=SOURCE_DATE_EPOCH -iu builduser bash -c 'cd /startdir; makepkg "$@"' -bash "$@"
+	ret=$?
+	case $ret in
+		0|14)
+			return 0;;
+		*)
+			return $ret;;
+	esac
 }
 
 _chrootnamcap() {
@@ -258,35 +231,18 @@ _chrootnamcap() {
 	done
 }
 
-# Usage: download_sources $copydir $makepkg_user
-# Globals:
-#  - SRCDEST
-#  - USER
 download_sources() {
-	local copydir=$1
-	local makepkg_user=$2
-
-	local builddir
-	builddir="$(mktemp -d)"
-	chmod 1777 "$builddir"
+	setup_workdir
+	chown "$makepkg_user:" "$WORKDIR"
 
 	# Ensure sources are downloaded
-	sudo -u "$makepkg_user" env SRCDEST="$SRCDEST" BUILDDIR="$builddir" \
-		makepkg --config="$copydir/etc/makepkg.conf" --verifysource -o ||
+	sudo -u "$makepkg_user" --preserve-env=GNUPGHOME \
+		env SRCDEST="$SRCDEST" BUILDDIR="$WORKDIR" \
+		makepkg --config="$copydir/etc/makepkg.conf" --verifysource -o "${verifysource_args[@]}" ||
 		die "Could not download sources."
-
-	# Clean up garbage from verifysource
-	rm -rf "$builddir"
 }
 
-# Usage: move_products $copydir $owner
-# Globals:
-#  - PKGDEST
-#  - LOGDEST
 move_products() {
-	local copydir=$1
-	local src_owner=$2
-
 	local pkgfile
 	for pkgfile in "$copydir"/pkgdest/*; do
 		chown "$src_owner" "$pkgfile"
@@ -317,121 +273,144 @@ move_products() {
 }
 # }}}
 
-main() {
-	init_variables
+while getopts 'hcur:I:l:nCTD:d:U:' arg; do
+	case "$arg" in
+		c) clean_first=1 ;;
+		D) bindmounts_ro+=("--bind-ro=$OPTARG") ;;
+		d) bindmounts_rw+=("--bind=$OPTARG") ;;
+		u) update_first=1 ;;
+		r) passeddir="$OPTARG" ;;
+		I) install_pkgs+=("$OPTARG") ;;
+		l) copy="$OPTARG" ;;
+		n) run_namcap=1; makepkg_args+=(--install) ;;
+		C) run_checkpkg=1 ;;
+		T) temp_chroot=1; copy+="-$$" ;;
+		U) makepkg_user="$OPTARG" ;;
+		h|*) usage ;;
+	esac
+done
 
-	while getopts 'hcur:I:l:nTD:d:U:' arg; do
-		case "$arg" in
-			c) clean_first=true ;;
-			D) bindmounts_ro+=("--bind-ro=$OPTARG") ;;
-			d) bindmounts_rw+=("--bind=$OPTARG") ;;
-			u) update_first=true ;;
-			r) passeddir="$OPTARG" ;;
-			I) install_pkgs+=("$OPTARG") ;;
-			l) copy="$OPTARG" ;;
-			n) run_namcap=true; makepkg_args+=(--install) ;;
-			T) temp_chroot=true; copy+="-$$" ;;
-			U) makepkg_user="$OPTARG" ;;
-			h|*) usage ;;
-		esac
-	done
+[[ ! -f PKGBUILD && -z "${install_pkgs[*]}" ]] && die 'This must be run in a directory containing a PKGBUILD.'
+[[ -n $makepkg_user && -z $(id -u "$makepkg_user") ]] && die 'Invalid makepkg user.'
+makepkg_user=${makepkg_user:-${SUDO_USER:-$USER}}
 
-	[[ ! -f PKGBUILD && -z "${install_pkgs[*]}" ]] && die 'This must be run in a directory containing a PKGBUILD.'
-	[[ -n $makepkg_user && -z $(id -u "$makepkg_user") ]] && die 'Invalid makepkg user.'
-	makepkg_user=${makepkg_user:-${SUDO_USER:-$USER}}
+check_root SOURCE_DATE_EPOCH,GNUPGHOME,SRCDEST,SRCPKGDEST,PKGDEST,LOGDEST,MAKEFLAGS,PACKAGER
 
-	check_root
+# Canonicalize chrootdir, getting rid of trailing /
+chrootdir=$(readlink -e "$passeddir")
+[[ ! -d $chrootdir ]] && die "No chroot dir defined, or invalid path '%s'" "$passeddir"
+[[ ! -d $chrootdir/root ]] && die "Missing chroot dir root directory. Try using: mkarchroot %s/root base-devel" "$chrootdir"
 
-	# Canonicalize chrootdir, getting rid of trailing /
-	chrootdir=$(readlink -e "$passeddir")
-	[[ ! -d $chrootdir ]] && die "No chroot dir defined, or invalid path '%s'" "$passeddir"
-	[[ ! -d $chrootdir/root ]] && die "Missing chroot dir root directory. Try using: mkarchroot %s/root base-devel" "$chrootdir"
+if [[ ${copy:0:1} = / ]]; then
+	copydir=$copy
+else
+	copydir="$chrootdir/$copy"
+fi
 
-	if [[ ${copy:0:1} = / ]]; then
-		copydir=$copy
-	else
-		copydir="$chrootdir/$copy"
-	fi
+# Pass all arguments after -- right to makepkg
+makepkg_args+=("${@:$OPTIND}")
 
-	# Pass all arguments after -- right to makepkg
-	makepkg_args+=("${@:$OPTIND}")
+# See if -R or -e was passed to makepkg
+for arg in "${@:$OPTIND}"; do
+	case ${arg%%=*} in
+		--skip*|--holdver) verifysource_args+=("$arg") ;;
+		--repackage|--noextract) keepbuilddir=1 ;;
+		--*) ;;
+		-*R*|-*e*) keepbuilddir=1 ;;
+	esac
+done
 
-	# See if -R or -e was passed to makepkg
-	for arg in "${makepkg_args[@]}"; do
-		case ${arg%%=*} in
-			--repackage|--noextract) keepbuilddir=true; break ;;
-			--repackage|--noextract) keepbuilddir=true; break ;;
-			--*) ;;
-			-*R*|-*e*) keepbuilddir=true; break ;;
-		esac
-	done
+umask 0022
 
-	if [[ -n $SUDO_USER ]]; then
-		eval "USER_HOME=~$SUDO_USER"
-	else
-		USER_HOME=$HOME
-	fi
+ORIG_HOME=$HOME
+IFS=: read -r _ _ _ _ _ HOME _ < <(getent passwd "${SUDO_USER:-$USER}")
+load_makepkg_config
+HOME=$ORIG_HOME
 
-	umask 0022
+# Use PKGBUILD directory if these don't exist
+[[ -d $PKGDEST ]]    || PKGDEST=$PWD
+[[ -d $SRCDEST ]]    || SRCDEST=$PWD
+[[ -d $SRCPKGDEST ]] || SRCPKGDEST=$PWD
+[[ -d $LOGDEST ]]    || LOGDEST=$PWD
 
-	load_vars "${XDG_CONFIG_HOME:-$USER_HOME/.config}/pacman/makepkg.conf" || load_vars "$USER_HOME/.makepkg.conf"
-	load_vars /etc/makepkg.conf
+# Lock the chroot we want to use. We'll keep this lock until we exit.
+lock 9 "$copydir.lock" "Locking chroot copy [%s]" "$copy"
 
-	# Use PKGBUILD directory if these don't exist
-	[[ -d $PKGDEST ]]    || PKGDEST=$PWD
-	[[ -d $SRCDEST ]]    || SRCDEST=$PWD
-	[[ -d $SRCPKGDEST ]] || SRCPKGDEST=$PWD
-	[[ -d $LOGDEST ]]    || LOGDEST=$PWD
+if [[ ! -d $copydir ]] || (( clean_first )); then
+	sync_chroot "$chrootdir" "$copydir" "$copy"
+fi
 
-	# Lock the chroot we want to use. We'll keep this lock until we exit.
-	lock 9 "$copydir.lock" "Locking chroot copy [%s]" "$copy"
-
-	if [[ ! -d $copydir ]] || $clean_first; then
-		sync_chroot "$chrootdir/root" "$copydir" "$copy"
-	fi
-
-	$update_first && arch-nspawn "$copydir" \
-			"${bindmounts_ro[@]}" "${bindmounts_rw[@]}" \
-			pacman -Syu --noconfirm
-
-	if [[ -n ${install_pkgs[*]:-} ]]; then
-		install_packages "$copydir" "${install_pkgs[@]}"
-		ret=$?
-		# If there is no PKGBUILD we have done
-		[[ -f PKGBUILD ]] || return $ret
-	fi
-
-	if [[ "$(id -u "$makepkg_user")" == 0 ]]; then
-		error "Running makepkg as root is not allowed."
-		exit 1
-	fi
-
-	download_sources "$copydir" "$makepkg_user"
-
-	prepare_chroot "$copydir" "$USER_HOME" "$keepbuilddir"
-
-	if arch-nspawn "$copydir" \
-		--bind="$PWD:/startdir" \
-		--bind="$SRCDEST:/srcdest" \
+(( update_first )) && arch-nspawn "$copydir" \
 		"${bindmounts_ro[@]}" "${bindmounts_rw[@]}" \
-		/chrootbuild "${makepkg_args[@]}"
-	then
-		move_products "$copydir" "$src_owner"
+		pacman -Syuu --noconfirm
+
+if [[ -n ${install_pkgs[*]:-} ]]; then
+	install_packages
+	ret=$?
+	# If there is no PKGBUILD we are done
+	[[ -f PKGBUILD ]] || exit $ret
+fi
+
+if [[ "$(id -u "$makepkg_user")" == 0 ]]; then
+	error "Running makepkg as root is not allowed."
+	exit 1
+fi
+
+download_sources
+
+prepare_chroot
+
+if arch-nspawn "$copydir" \
+	--bind="${PWD//:/\\:}:/startdir" \
+	--bind="${SRCDEST//:/\\:}:/srcdest" \
+	"${bindmounts_ro[@]}" "${bindmounts_rw[@]}" \
+	/chrootbuild "${makepkg_args[@]}"
+then
+	pkgnames=()
+	for pkgfile in "$copydir"/pkgdest/*; do
+		pkgfile=${pkgfile##*/};
+		pkgnames+=("${pkgfile%-*-*-*}");
+	done
+	move_products
+else
+	(( ret += 1 ))
+fi
+
+(( temp_chroot )) && delete_chroot "$copydir" "$copy"
+
+if (( ret != 0 )); then
+	if (( temp_chroot )); then
+		die "Build failed"
 	else
-		(( ret += 1 ))
+		die "Build failed, check %s/build" "$copydir"
 	fi
+else
+	if (( run_checkpkg )); then
+		msg "Running checkpkg"
 
-	$temp_chroot && delete_chroot "$copydir" "$copy"
+		# sync off-site databases for up-to-date queries
+		trap 'rm -rf $dbpath; cleanup' EXIT INT TERM QUIT
+		dbpath=$(mktemp -d --tmpdir makechrootpkg-database.XXXXXXXXXX)
+		mkdir -p "$dbpath"
+		pacman -Sy --dbpath "$dbpath" --logfile /dev/null
 
-	if (( ret != 0 )); then
-		if $temp_chroot; then
-			die "Build failed"
-		else
-			die "Build failed, check %s/build" "$copydir"
+		# query current package locations
+		remotepkgs=($(pacman -Sddp --dbpath "$dbpath" --logfile /dev/null "${pkgnames[@]}"))
+		if (( $? )); then
+			warning "Skipped checkpkg due to missing repo packages"
+			exit 0
 		fi
-	else
-		true
-	fi
-}
 
-main "$@"
+		# download package files if any non-local location exists
+		for remotepkg in "${remotepkgs[@]}"; do
+			[[ $remotepkg == file://* ]] && continue
+			msg2 "Downloading current versions"
+			pacman --noconfirm -Swdd --dbpath "$dbpath" --logfile /dev/null "${pkgnames[@]}"
+			break
+		done
+
+		msg2 "Checking packages"
+		sudo -u "$makepkg_user" checkpkg --rmdir --warn
+	fi
+	true
+fi

makepkg-i686.conf

@@ -1,150 +0,0 @@
-#!/hint/bash
-# shellcheck disable=2034
-
-#
-# /etc/makepkg.conf
-#
-
-#########################################################################
-# SOURCE ACQUISITION
-#########################################################################
-#
-#-- The download utilities that makepkg should use to acquire sources
-#  Format: 'protocol::agent'
-DLAGENTS=('ftp::/usr/bin/curl -fC - --ftp-pasv --retry 3 --retry-delay 3 -o %o %u'
-          'http::/usr/bin/curl -fLC - --retry 3 --retry-delay 3 -o %o %u'
-          'https::/usr/bin/curl -fLC - --retry 3 --retry-delay 3 -o %o %u'
-          'rsync::/usr/bin/rsync --no-motd -z %u %o'
-          'scp::/usr/bin/scp -C %u %o')
-
-# Other common tools:
-# /usr/bin/snarf
-# /usr/bin/lftpget -c
-# /usr/bin/wget
-
-#-- The package required by makepkg to download VCS sources
-#  Format: 'protocol::package'
-VCSCLIENTS=('bzr::bzr'
-            'git::git'
-            'hg::mercurial'
-            'svn::subversion')
-
-#########################################################################
-# ARCHITECTURE, COMPILE FLAGS
-#########################################################################
-#
-CARCH="i686"
-CHOST="i686-pc-linux-gnu"
-
-#-- Compiler and Linker Flags
-# -march (or -mcpu) builds exclusively for an architecture
-# -mtune optimizes for an architecture, but builds for whole processor family
-CPPFLAGS="-D_FORTIFY_SOURCE=2"
-CFLAGS="-march=i686 -mtune=generic -O2 -pipe -fstack-protector-strong -fno-plt"
-CXXFLAGS="-march=i686 -mtune=generic -O2 -pipe -fstack-protector-strong -fno-plt"
-LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
-#-- Make Flags: change this for DistCC/SMP systems
-#MAKEFLAGS="-j2"
-#-- Debugging flags
-DEBUG_CFLAGS="-g -fvar-tracking-assignments"
-DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
-
-#########################################################################
-# BUILD ENVIRONMENT
-#########################################################################
-#
-# Defaults: BUILDENV=(!distcc color !ccache check !sign)
-#  A negated environment option will do the opposite of the comments below.
-#
-#-- distcc:   Use the Distributed C/C++/ObjC compiler
-#-- color:    Colorize output messages
-#-- ccache:   Use ccache to cache compilation
-#-- check:    Run the check() function if present in the PKGBUILD
-#-- sign:     Generate PGP signature file
-#
-BUILDENV=(!distcc color !ccache check !sign)
-#
-#-- If using DistCC, your MAKEFLAGS will also need modification. In addition,
-#-- specify a space-delimited list of hosts running in the DistCC cluster.
-#DISTCC_HOSTS=""
-#
-#-- Specify a directory for package building.
-#BUILDDIR=/tmp/makepkg
-
-#########################################################################
-# GLOBAL PACKAGE OPTIONS
-#   These are default values for the options=() settings
-#########################################################################
-#
-# Default: OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !optipng !upx !debug)
-#  A negated option will do the opposite of the comments below.
-#
-#-- strip:      Strip symbols from binaries/libraries
-#-- docs:       Save doc directories specified by DOC_DIRS
-#-- libtool:    Leave libtool (.la) files in packages
-#-- staticlibs: Leave static library (.a) files in packages
-#-- emptydirs:  Leave empty directories in packages
-#-- zipman:     Compress manual (man and info) pages in MAN_DIRS with gzip
-#-- purge:      Remove files specified by PURGE_TARGETS
-#-- upx:        Compress binary executable files using UPX
-#-- optipng:    Optimize PNG images with optipng
-#-- debug:      Add debugging flags as specified in DEBUG_* variables
-#
-OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !optipng !upx !debug)
-
-#-- File integrity checks to use. Valid: md5, sha1, sha256, sha384, sha512
-INTEGRITY_CHECK=(md5)
-#-- Options to be used when stripping binaries. See `man strip' for details.
-STRIP_BINARIES="--strip-all"
-#-- Options to be used when stripping shared libraries. See `man strip' for details.
-STRIP_SHARED="--strip-unneeded"
-#-- Options to be used when stripping static libraries. See `man strip' for details.
-STRIP_STATIC="--strip-debug"
-#-- Manual (man and info) directories to compress (if zipman is specified)
-MAN_DIRS=({usr{,/local}{,/share},opt/*}/{man,info})
-#-- Doc directories to remove (if !docs is specified)
-DOC_DIRS=(usr/{,local/}{,share/}{doc,gtk-doc} opt/*/{doc,gtk-doc})
-#-- Files to be removed from all packages (if purge is specified)
-PURGE_TARGETS=(usr/{,share}/info/dir .packlist *.pod)
-
-#########################################################################
-# PACKAGE OUTPUT
-#########################################################################
-#
-# Default: put built package and cached source in build directory
-#
-#-- Destination: specify a fixed directory where all packages will be placed
-#PKGDEST=/home/packages
-#-- Source cache: specify a fixed directory where source files will be cached
-#SRCDEST=/home/sources
-#-- Source packages: specify a fixed directory where all src packages will be placed
-#SRCPKGDEST=/home/srcpackages
-#-- Log files: specify a fixed directory where all log files will be placed
-#LOGDEST=/home/makepkglogs
-#-- Packager: name/email of the person or organization building packages
-#PACKAGER="John Doe <john@doe.com>"
-#-- Specify a key to use for package signing
-#GPGKEY=""
-
-#########################################################################
-# COMPRESSION DEFAULTS
-#########################################################################
-#
-COMPRESSGZ=(gzip -c -f -n)
-COMPRESSBZ2=(bzip2 -c -f)
-COMPRESSXZ=(xz -c -z -)
-COMPRESSLRZ=(lrzip -q)
-COMPRESSLZO=(lzop -q)
-COMPRESSZ=(compress -c -f)
-
-#########################################################################
-# EXTENSION DEFAULTS
-#########################################################################
-#
-# WARNING: Do NOT modify these variables unless you know what you are
-#          doing.
-#
-PKGEXT='.pkg.tar.xz'
-SRCEXT='.src.tar.gz'
-
-# vim: set ft=sh ts=2 sw=2 et:

makepkg-x86_64.conf

@@ -11,9 +11,10 @@
 #
 #-- The download utilities that makepkg should use to acquire sources
 #  Format: 'protocol::agent'
-DLAGENTS=('ftp::/usr/bin/curl -fC - --ftp-pasv --retry 3 --retry-delay 3 -o %o %u'
-          'http::/usr/bin/curl -fLC - --retry 3 --retry-delay 3 -o %o %u'
-          'https::/usr/bin/curl -fLC - --retry 3 --retry-delay 3 -o %o %u'
+DLAGENTS=('file::/usr/bin/curl -gqC - -o %o %u'
+          'ftp::/usr/bin/curl -gqfC - --ftp-pasv --retry 3 --retry-delay 3 -o %o %u'
+          'http::/usr/bin/curl -gqb "" -fLC - --retry 3 --retry-delay 3 -o %o %u'
+          'https::/usr/bin/curl -gqb "" -fLC - --retry 3 --retry-delay 3 -o %o %u'
           'rsync::/usr/bin/rsync --no-motd -z %u %o'
           'scp::/usr/bin/scp -C %u %o')
 
@@ -37,11 +38,9 @@ CARCH="x86_64"
 CHOST="x86_64-pc-linux-gnu"
 
 #-- Compiler and Linker Flags
-# -march (or -mcpu) builds exclusively for an architecture
-# -mtune optimizes for an architecture, but builds for whole processor family
 CPPFLAGS="-D_FORTIFY_SOURCE=2"
-CFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fstack-protector-strong -fno-plt"
-CXXFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fstack-protector-strong -fno-plt"
+CFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fno-plt"
+CXXFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fno-plt"
 LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
 #-- Make Flags: change this for DistCC/SMP systems
 #MAKEFLAGS="-j2"
@@ -53,7 +52,7 @@ DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
 # BUILD ENVIRONMENT
 #########################################################################
 #
-# Defaults: BUILDENV=(!distcc color !ccache check !sign)
+# Defaults: BUILDENV=(!distcc !color !ccache check !sign)
 #  A negated environment option will do the opposite of the comments below.
 #
 #-- distcc:   Use the Distributed C/C++/ObjC compiler
@@ -76,7 +75,7 @@ BUILDENV=(!distcc color !ccache check !sign)
 #   These are default values for the options=() settings
 #########################################################################
 #
-# Default: OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !optipng !upx !debug)
+# Default: OPTIONS=(!strip docs libtool staticlibs emptydirs !zipman !purge !debug)
 #  A negated option will do the opposite of the comments below.
 #
 #-- strip:      Strip symbols from binaries/libraries
@@ -86,11 +85,9 @@ BUILDENV=(!distcc color !ccache check !sign)
 #-- emptydirs:  Leave empty directories in packages
 #-- zipman:     Compress manual (man and info) pages in MAN_DIRS with gzip
 #-- purge:      Remove files specified by PURGE_TARGETS
-#-- upx:        Compress binary executable files using UPX
-#-- optipng:    Optimize PNG images with optipng
 #-- debug:      Add debugging flags as specified in DEBUG_* variables
 #
-OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !optipng !upx !debug)
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug)
 
 #-- File integrity checks to use. Valid: md5, sha1, sha256, sha384, sha512
 INTEGRITY_CHECK=(md5)
@@ -106,6 +103,8 @@ MAN_DIRS=({usr{,/local}{,/share},opt/*}/{man,info})
 DOC_DIRS=(usr/{,local/}{,share/}{doc,gtk-doc} opt/*/{doc,gtk-doc})
 #-- Files to be removed from all packages (if purge is specified)
 PURGE_TARGETS=(usr/{,share}/info/dir .packlist *.pod)
+#-- Directory to store source code in for debug packages
+DBGSRCDIR="/usr/src/debug"
 
 #########################################################################
 # PACKAGE OUTPUT
@@ -133,18 +132,18 @@ PURGE_TARGETS=(usr/{,share}/info/dir .packlist *.pod)
 COMPRESSGZ=(gzip -c -f -n)
 COMPRESSBZ2=(bzip2 -c -f)
 COMPRESSXZ=(xz -c -z -)
+COMPRESSZST=(zstd -c -T0 --ultra -20 -)
 COMPRESSLRZ=(lrzip -q)
 COMPRESSLZO=(lzop -q)
 COMPRESSZ=(compress -c -f)
+COMPRESSLZ4=(lz4 -q)
+COMPRESSLZ=(lzip -c -f)
 
 #########################################################################
 # EXTENSION DEFAULTS
 #########################################################################
 #
-# WARNING: Do NOT modify these variables unless you know what you are
-#          doing.
-#
-PKGEXT='.pkg.tar.xz'
+PKGEXT='.pkg.tar.zst'
 SRCEXT='.src.tar.gz'
 
 # vim: set ft=sh ts=2 sw=2 et:

makerepropkg.in

@@ -0,0 +1,190 @@
+#!/bin/bash
+#   makerepropkg - rebuild a package to see if it is reproducible
+#
+#   Copyright (c) 2019 by Eli Schwartz <eschwartz@archlinux.org>
+#
+#   This program is free software; you can redistribute it and/or modify
+#   it under the terms of the GNU General Public License as published by
+#   the Free Software Foundation; either version 2 of the License, or
+#   (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+m4_include(lib/common.sh)
+m4_include(lib/archroot.sh)
+
+source /usr/share/makepkg/util/config.sh
+source /usr/share/makepkg/util/message.sh
+
+declare -A buildinfo
+declare -a buildenv buildopts installed installpkgs
+
+archiveurl='https://archive.archlinux.org/packages'
+buildroot=/var/lib/archbuild/reproducible
+chroot=testenv
+
+parse_buildinfo() {
+    local line var val
+
+    while read -r line; do
+        var="${line%% = *}"
+        val="${line#* = }"
+        case ${var} in
+            buildenv)
+                buildenv+=("${val}")
+                ;;
+            options)
+                buildopts+=("${val}")
+                ;;
+            installed)
+                installed+=("${val}")
+                ;;
+            *)
+                buildinfo["${var}"]="${val}"
+                ;;
+        esac
+    done
+}
+
+get_pkgfile() {
+    local cdir=${cache_dirs[0]}
+    local pkgfilebase=${1}
+    local pkgname=${pkgfilebase%-*-*-*}
+    local pkgfile ext
+
+    for ext in .xz .zst ''; do
+        pkgfile=${pkgfilebase}.pkg.tar${ext}
+
+        for c in "${cache_dirs[@]}"; do
+            if [[ -f ${c}/${pkgfile} ]]; then
+                cdir=${c}
+                break
+            fi
+        done
+
+        for f in "${pkgfile}" "${pkgfile}.sig"; do
+            if [[ ! -f "${cdir}/${f}" ]]; then
+                msg2 "retrieving '%s'..." "${f}" >&2
+                curl -Llf -# -o "${cdir}/${f}" "${archiveurl}/${pkgname:0:1}/${pkgname}/${f}" || continue 2
+            fi
+        done
+        printf '%s\n' "file://${cdir}/${pkgfile}"
+        return 0
+    done
+
+    return 1
+}
+
+usage() {
+    cat << __EOF__
+usage: ${BASH_SOURCE[0]##*/} [options] <package_file>
+
+Run this script in a PKGBUILD dir to build a package inside a
+clean chroot while attempting to reproduce it. The package file
+will be used to derive metadata needed for reproducing the
+package, including the .PKGINFO as well as the buildinfo.
+
+For more details see https://reproducible-builds.org/
+
+OPTIONS
+    -c <dir>      Set pacman cache
+    -M <file>     Location of a makepkg config file
+    -h            Show this usage message
+__EOF__
+}
+
+while getopts 'M:c:h' arg; do
+        case "$arg" in
+                M) archroot_args+=(-M "$OPTARG") ;;
+                c) cache_dirs+=("$OPTARG") ;;
+                h) usage; exit 0 ;;
+                *|?) usage; exit 1 ;;
+        esac
+done
+shift $((OPTIND - 1))
+
+check_root
+
+if [[ -n $1 ]]; then
+    pkgfile="$1"
+    if ! bsdtar -tqf "${pkgfile}" .BUILDINFO >/dev/null 2>&1; then
+        error "file is not a valid pacman package: '%s'" "${pkgfile}"
+        exit 1
+    fi
+else
+    error "no package file specified. Try '${BASH_SOURCE[0]##*/} -h' for more information. "
+    exit 1
+fi
+
+if (( ${#cache_dirs[@]} == 0 )); then
+	mapfile -t cache_dirs < <(pacman-conf CacheDir)
+fi
+
+ORIG_HOME=${HOME}
+IFS=: read -r _ _ _ _ _ HOME _ < <(getent passwd "${SUDO_USER:-$USER}")
+load_makepkg_config
+HOME=${ORIG_HOME}
+[[ -d ${SRCDEST} ]] || SRCDEST=${PWD}
+
+parse_buildinfo < <(bsdtar -xOqf "${pkgfile}" .BUILDINFO)
+export SOURCE_DATE_EPOCH="${buildinfo[builddate]}"
+PACKAGER="${buildinfo[packager]}"
+BUILDDIR="${buildinfo[builddir]}"
+PKGEXT=${pkgfile#${pkgfile%.pkg.tar*}}
+
+# nuke and restore reproducible testenv
+for copy in "${buildroot}"/*/; do
+    [[ -d ${copy} ]] || continue
+    subvolume_delete_recursive "${copy}"
+done
+rm -rf --one-file-system "${buildroot}"
+(umask 0022; mkdir -p "${buildroot}")
+
+for fname in "${installed[@]}"; do
+    if ! allpkgfiles+=("$(get_pkgfile "${fname}")"); then
+        error "failed to retrieve ${fname}"
+        exit 1
+    fi
+done
+printf '%s\n' "${allpkgfiles[@]}" | mkarchroot -M @pkgdatadir@/makepkg-x86_64.conf -U "${archroot_args[@]}" "${buildroot}"/root - || exit 1
+
+# use makechrootpkg to prep the build directory
+makechrootpkg -r "${buildroot}" -l "${chroot}" -- --packagelist || exit 1
+
+# set detected makepkg.conf options
+{
+    for var in PACKAGER BUILDDIR PKGEXT; do
+        printf '%s=%s\n' "${var}" "${!var@Q}"
+    done
+    printf 'OPTIONS=(%s)\n' "${buildopts[*]@Q}"
+    printf 'BUILDENV=(%s)\n' "${buildenv[*]@Q}"
+} >> "${buildroot}/${chroot}"/etc/makepkg.conf >> "${buildroot}/${chroot}"/etc/makepkg.conf
+install -d -o "${SUDO_UID:-$UID}" -g "$(id -g "${SUDO_UID:-$UID}")" "${buildroot}/${chroot}/${BUILDDIR}"
+
+# kick off the build
+arch-nspawn "${buildroot}/${chroot}" \
+    --bind="${PWD}:/startdir" \
+    --bind="${SRCDEST}:/srcdest" \
+    /chrootbuild -C --noconfirm --log --holdver --skipinteg
+
+if (( $? == 0 )); then
+    msg2 "built succeeded! built packages can be found in ${buildroot}/${chroot}/pkgdest"
+    msg "comparing artifacts..."
+    if cmp -s "${pkgfile}" "${buildroot}/${chroot}/pkgdest/${pkgfile##*/}"; then
+        msg2 "Package successfully reproduced!"
+        exit 0
+    else
+        warning "Package is not reproducible. :("
+        sha256sum "${pkgfile}" "${buildroot}/${chroot}/pkgdest/${pkgfile##*/}"
+    fi
+fi
+
+# the package either failed to build, or was unreproducible
+exit 1

mkarchroot.in

@@ -13,13 +13,20 @@
 m4_include(lib/common.sh)
 m4_include(lib/archroot.sh)
 
+# umask might have been changed in /etc/profile
+# ensure that sane default is set again
+umask 0022
+
 working_dir=''
+umode=''
 
 files=()
+nspawn_args=()
 
 usage() {
 	echo "Usage: ${0##*/} [options] working-dir package-list..."
 	echo ' options:'
+	echo '    -U            Use pacman -U to install packages'
 	echo '    -C <file>     Location of a pacman config file'
 	echo '    -M <file>     Location of a makepkg config file'
 	echo '    -c <dir>      Set pacman cache'
@@ -29,16 +36,21 @@ usage() {
 	exit 1
 }
 
-while getopts 'hC:M:c:f:s' arg; do
+while getopts 'hUC:M:c:f:s' arg; do
 	case "$arg" in
+		U) umode=U ;;
 		C) pac_conf="$OPTARG" ;;
 		M) makepkg_conf="$OPTARG" ;;
-		c) cache_dir="$OPTARG" ;;
+		c) cache_dirs+=("$OPTARG") ;;
 		f) files+=("$OPTARG") ;;
 		s) nosetarch=1 ;;
 		h|?) usage ;;
 		*) error "invalid argument '%s'" "$arg"; usage ;;
 	esac
+	if [[ $arg != U ]]; then
+		nspawn_args+=("-$arg")
+		[[ -v OPTARG ]] && nspawn_args+=("$OPTARG")
+	fi
 done
 shift $((OPTIND - 1))
 
@@ -51,10 +63,10 @@ shift 1
 
 [[ -z $working_dir ]] && die 'Please specify a working directory.'
 
-if [[ -z $cache_dir ]]; then
-	cache_dirs=($(pacman -v "$cache_conf" 2>&1 | grep '^Cache Dirs:' | sed 's/Cache Dirs:\s*//g'))
-else
-	cache_dirs=(${cache_dir})
+pacconf_cmd=$(command -v pacman-conf || command -v pacconf)
+
+if (( ${#cache_dirs[@]} == 0 )); then
+	mapfile -t cache_dirs < <($pacconf_cmd CacheDir)
 fi
 
 umask 0022
@@ -78,13 +90,8 @@ for file in "${files[@]}"; do
 	cp "$file" "$working_dir$file"
 done
 
-_env=()
-while read -r varname; do
-	_env+=("$varname=${!varname}")
-done < <(declare -x | sed -r 's/^declare -x ([^=]*)=.*/\1/' | grep -i '_proxy$')
-env -i "${_env[@]}" \
-pacstrap -GMcd ${pac_conf:+-C "$pac_conf"} "$working_dir" \
-  "${cache_dirs[@]/#/--cachedir=}" "$@" || die 'Failed to install all packages'
+pacstrap -${umode}Mcd ${pac_conf:+-C "$pac_conf"} "$working_dir" \
+	"${cache_dirs[@]/#/--cachedir=}" "$@" || die 'Failed to install all packages'
 
 printf '%s.UTF-8 UTF-8\n' en_US de_DE > "$working_dir/etc/locale.gen"
 echo 'LANG=en_US.UTF-8' > "$working_dir/etc/locale.conf"
@@ -93,8 +100,5 @@ echo "$CHROOT_VERSION" > "$working_dir/.arch-chroot"
 systemd-machine-id-setup --root="$working_dir"
 
 exec arch-nspawn \
-	${nosetarch:+-s} \
-	${pac_conf:+-C "$pac_conf"} \
-	${makepkg_conf:+-M "$makepkg_conf"} \
-	${cache_dir:+-c "$cache_dir"} \
+	"${nspawn_args[@]}" \
 	"$working_dir" locale-gen

offload-build.in

@@ -0,0 +1,127 @@
+#!/bin/bash
+#
+#   offload-build - build a PKGBUILD on a remote server using makechrootpkg.
+#
+#   Copyright (c) 2019 by Eli Schwartz <eschwartz@archlinux.org>
+#
+#   This program is free software; you can redistribute it and/or modify
+#   it under the terms of the GNU General Public License as published by
+#   the Free Software Foundation; either version 2 of the License, or
+#   (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+source /usr/share/makepkg/util/config.sh
+
+
+# global defaults suitable for use by Arch staff
+repo=extra
+arch=x86_64
+server=dragon.archlinux.org
+
+die() { printf "error: $1\n" "${@:2}"; exit 1; }
+
+usage() {
+    cat <<- _EOF_
+		Usage: ${BASH_SOURCE[0]##*/} [--repo REPO] [--arch ARCHITECTURE] [--server SERVER] -- [ARCHBUILD_ARGS]
+
+		Build a PKGBUILD on a remote server using makechrootpkg. Requires a remote user
+		that can run archbuild without password auth. Options passed after a -- are
+		passed on to archbuild, and eventually to makechrootpkg.
+
+		OPTIONS
+		    -r, --repo      Build against a specific repository (current: $repo)
+		    -a, --arch      Build against a specific architecture (current: $arch)
+		    -s, --server    Offload to a specific build server (current: $server)
+		    -h, --help      Show this help text
+_EOF_
+}
+
+# option checking
+while (( $# )); do
+    case $1 in
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        -r|--repo)
+            repo=$2
+            shift 2
+            ;;
+        -a|--arch)
+            arch=$2
+            shift 2
+            ;;
+        -s|--server)
+            server=$2
+            shift 2
+            ;;
+        --)
+            shift
+            break
+            ;;
+        *)
+            die "invalid argument: %s" "$1"
+            ;;
+    esac
+done
+
+# multilib must be handled specially
+archbuild_arch="${arch}"
+if [[ $repo = multilib* ]]; then
+    archbuild_arch=
+fi
+
+archbuild_cmd=("${repo}${archbuild_arch:+-$archbuild_arch}-build" "$@")
+
+trap 'rm -rf $SRCPKGDEST' EXIT INT TERM QUIT
+
+# Use a source-only tarball as an intermediate to transfer files. This
+# guarantees the checksums are okay, and guarantees that all needed files are
+# transferred, including local sources, install scripts, and changelogs.
+export SRCPKGDEST=$(mktemp -d)
+makepkg --source || die "unable to make source package"
+
+# Temporary cosmetic workaround makepkg if SRCDEST is set somewhere else
+# but an empty src dir is created in PWD. Remove once fixed in makepkg.
+rmdir --ignore-fail-on-non-empty src 2>/dev/null || true
+
+mapfile -t files < <(
+    # This is sort of bash golfing but it allows running a mildly complex
+    # command over ssh with a single connection.
+    # shellcheck disable=SC2145
+    cat "$SRCPKGDEST"/*.src.tar.gz |
+        ssh $server '
+            temp="${XDG_CACHE_HOME:-$HOME/.cache}/offload-build" &&
+            mkdir -p "$temp" &&
+            temp=$(mktemp -d -p "$temp") &&
+            cd "$temp" &&
+            {
+                bsdtar --strip-components 1 -xvf - &&
+                script -qefc "'"${archbuild_cmd[@]@Q}"'" /dev/null &&
+                printf "%s\n" "" "-> build complete" &&
+                printf "\t%s\n" "$temp"/*
+            } >&2 &&
+            makepkg_user_config="${XDG_CONFIG_HOME:-$HOME/.config}/pacman/makepkg.conf" &&
+            makepkg_config="/usr/share/devtools/makepkg-'"${arch}"'.conf" &&
+            if [[ -f /usr/share/devtools/makepkg-'"${repo}"'-'"${arch}"'.conf ]]; then
+                makepkg_config="/usr/share/devtools/makepkg-'"${repo}"'-'"${arch}"'.conf"
+            fi &&
+            makepkg --config <(cat "${makepkg_user_config}" "${makepkg_config}" 2>/dev/null) --packagelist
+')
+
+
+if (( ${#files[@]} )); then
+    printf '%s\n' '' '-> copying files...'
+    load_makepkg_config
+    scp "${files[@]/#/$server:}" "${PKGDEST:-${PWD}}/"
+else
+    exit 1
+fi

pacman-extra.conf

@@ -16,10 +16,9 @@
 #GPGDir      = /etc/pacman.d/gnupg/
 #HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc
-#XferCommand = /usr/bin/curl -C - -f %u > %o
+#XferCommand = /usr/bin/curl -L -C - -f -o %o %u
 #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u
 #CleanMethod = KeepInstalled
-#UseDelta    = 0.7
 Architecture = auto
 
 # Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup
@@ -90,4 +89,3 @@ Include = /etc/pacman.d/mirrorlist
 #[custom]
 #SigLevel = Optional TrustAll
 #Server = file:///home/custompkgs
-

pacman-gnome-unstable.conf

@@ -16,10 +16,9 @@
 #GPGDir      = /etc/pacman.d/gnupg/
 #HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc
-#XferCommand = /usr/bin/curl -C - -f %u > %o
+#XferCommand = /usr/bin/curl -L -C - -f -o %o %u
 #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u
 #CleanMethod = KeepInstalled
-#UseDelta    = 0.7
 Architecture = auto
 
 # Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup
@@ -99,4 +98,3 @@ Include = /etc/pacman.d/mirrorlist
 #[custom]
 #SigLevel = Optional TrustAll
 #Server = file:///home/custompkgs
-

pacman-kde-unstable.conf

@@ -16,10 +16,9 @@
 #GPGDir      = /etc/pacman.d/gnupg/
 #HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc
-#XferCommand = /usr/bin/curl -C - -f %u > %o
+#XferCommand = /usr/bin/curl -L -C - -f -o %o %u
 #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u
 #CleanMethod = KeepInstalled
-#UseDelta    = 0.7
 Architecture = auto
 
 # Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup
@@ -93,4 +92,3 @@ Include = /etc/pacman.d/mirrorlist
 #[custom]
 #SigLevel = Optional TrustAll
 #Server = file:///home/custompkgs
-

pacman-multilib-staging.conf

@@ -16,10 +16,9 @@
 #GPGDir      = /etc/pacman.d/gnupg/
 #HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc
-#XferCommand = /usr/bin/curl -C - -f %u > %o
+#XferCommand = /usr/bin/curl -L -C - -f -o %o %u
 #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u
 #CleanMethod = KeepInstalled
-#UseDelta    = 0.7
 Architecture = auto
 
 # Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup
@@ -107,4 +106,3 @@ Include = /etc/pacman.d/mirrorlist
 #[custom]
 #SigLevel = Optional TrustAll
 #Server = file:///home/custompkgs
-

pacman-multilib-testing.conf

@@ -16,10 +16,9 @@
 #GPGDir      = /etc/pacman.d/gnupg/
 #HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc
-#XferCommand = /usr/bin/curl -C - -f %u > %o
+#XferCommand = /usr/bin/curl -L -C - -f -o %o %u
 #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u
 #CleanMethod = KeepInstalled
-#UseDelta    = 0.7
 Architecture = auto
 
 # Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup
@@ -98,4 +97,3 @@ Include = /etc/pacman.d/mirrorlist
 #[custom]
 #SigLevel = Optional TrustAll
 #Server = file:///home/custompkgs
-

pacman-multilib.conf

@@ -16,10 +16,9 @@
 #GPGDir      = /etc/pacman.d/gnupg/
 #HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc
-#XferCommand = /usr/bin/curl -C - -f %u > %o
+#XferCommand = /usr/bin/curl -L -C - -f -o %o %u
 #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u
 #CleanMethod = KeepInstalled
-#UseDelta    = 0.7
 Architecture = auto
 
 # Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup
@@ -99,4 +98,3 @@ Include = /etc/pacman.d/mirrorlist
 #[custom]
 #SigLevel = Optional TrustAll
 #Server = file:///home/custompkgs
-

pacman-staging.conf

@@ -16,10 +16,9 @@
 #GPGDir      = /etc/pacman.d/gnupg/
 #HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc
-#XferCommand = /usr/bin/curl -C - -f %u > %o
+#XferCommand = /usr/bin/curl -L -C - -f -o %o %u
 #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u
 #CleanMethod = KeepInstalled
-#UseDelta    = 0.7
 Architecture = auto
 
 # Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup
@@ -96,4 +95,3 @@ Include = /etc/pacman.d/mirrorlist
 #[custom]
 #SigLevel = Optional TrustAll
 #Server = file:///home/custompkgs
-

pacman-testing.conf

@@ -16,10 +16,9 @@
 #GPGDir      = /etc/pacman.d/gnupg/
 #HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc
-#XferCommand = /usr/bin/curl -C - -f %u > %o
+#XferCommand = /usr/bin/curl -L -C - -f -o %o %u
 #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u
 #CleanMethod = KeepInstalled
-#UseDelta    = 0.7
 Architecture = auto
 
 # Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup
@@ -90,4 +89,3 @@ Include = /etc/pacman.d/mirrorlist
 #[custom]
 #SigLevel = Optional TrustAll
 #Server = file:///home/custompkgs
-

rebuildpkgs.in

@@ -3,7 +3,7 @@
 #
 # This script rebuilds a list of packages in order
 # and reports anything that fails
-# 
+#
 # Due to sudo usage, it is recommended to allow makechrootpkg
 # to be run with NOPASSWD in your sudoers file
 #
@@ -14,8 +14,8 @@
 m4_include(lib/common.sh)
 
 if (( $# < 1 )); then
-	printf 'Usage: %s <chrootdir> <packages to rebuild>\n' "$(basename "$0")"
-	printf '  example: %s ~/chroot readline bash foo bar baz\n' "$(basename "$0")"
+	printf 'Usage: %s <chrootdir> <packages to rebuild>\n' "$(basename "${BASH_SOURCE[0]}")"
+	printf '  example: %s ~/chroot readline bash foo bar baz\n' "$(basename "${BASH_SOURCE[0]}")"
 	exit 1
 fi
 

sogrep.in

@@ -0,0 +1,147 @@
+#!/bin/bash
+#
+#   sogrep - find shared library links in an Arch Linux repository.
+#
+#   Copyright (c) 2019 by Eli Schwartz <eschwartz@archlinux.org>
+#
+#   This program is free software; you can redistribute it and/or modify
+#   it under the terms of the GNU General Public License as published by
+#   the Free Software Foundation; either version 2 of the License, or
+#   (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+# globals
+: ${SOLINKS_MIRROR:="https://mirror.pkgbuild.com"}
+: ${SOCACHE_DIR:="${XDG_CACHE_HOME:-${HOME}/.cache}/sogrep"}
+
+m4_include(lib/valid-repos.sh)
+arches=('x86_64')
+
+# options
+REFRESH=0
+VERBOSE=0
+
+source /usr/share/makepkg/util/parseopts.sh
+source /usr/share/makepkg/util/util.sh
+
+recache() {
+    local repo arch verbosity=-s
+
+    (( VERBOSE )) && verbosity=--progress-bar
+
+    for repo in "${_repos[@]}"; do
+        for arch in "${arches[@]}"; do
+            rm -rf "${SOCACHE_DIR}/${arch}/${repo}"
+            mkdir -p "${SOCACHE_DIR}/${arch}/${repo}"
+            curl -L "$verbosity" "${SOLINKS_MIRROR}/${repo}/os/${arch}/${repo}.links.tar.gz" | bsdtar -xf - -C "${SOCACHE_DIR}/${arch}/${repo}"
+        done
+    done
+}
+
+search() {
+    local repo=$1 arch lib=$2 srepos=("${_repos[@]}")
+
+    if [[ $repo != all ]]; then
+        if ! in_array "${repo}" "${_repos[@]}"; then
+            echo "${BASH_SOURCE[0]##*/}: unrecognized repo '$repo'"
+            echo "Try '${BASH_SOURCE[0]##*/} --help' for more information."
+            exit 1
+        fi
+        srepos=("${repo}")
+    fi
+
+    for arch in "${arches[@]}"; do
+        for repo in "${srepos[@]}"; do
+            local prefix=
+            (( VERBOSE && ${#srepos[@]} > 1 )) && prefix=${repo}/
+            db=${SOCACHE_DIR}/${arch}/${repo}/
+            if [[ -d ${db} ]]; then
+                while read -rd '' pkg; do
+                    read -r match
+                    pkg=${pkg#${db}}
+                    pkg="${prefix}${pkg%-*-*/links}"
+
+                    if (( VERBOSE )); then
+                        printf '%-35s %s\n' "${pkg}" "${match}"
+                    else
+                        printf '%s\n' "${pkg}"
+                    fi
+                done < <(grep -rZ "${lib}" "${db}") | sort -u
+            fi
+        done
+    done | resort
+}
+
+usage() {
+    cat <<- _EOF_
+		Usage: ${BASH_SOURCE[0]##*/} [OPTIONS] REPO LIBNAME
+
+		Check the soname links database for Arch Linux repositories containing
+		packages linked to a given shared library. If the repository specified
+		is "all", then all repositories will be searched, otherwise only the
+		named repository will be searched.
+
+		If the links database does not exist, it will be downloaded first.
+
+		OPTIONS
+		    -v, --verbose   Show matched links in addition to pkgname
+		    -r, --refresh   Refresh the links databases
+		    -h, --help      Show this help text
+_EOF_
+}
+
+# utility function to resort with multiple repos + no-verbose
+resort() { sort -u; }
+
+if (( $# == 0 )); then
+    echo "error: No arguments passed."
+    echo "Try '${BASH_SOURCE[0]##*/} --help' for more information."
+    exit 1
+fi
+OPT_SHORT='vrh'
+OPT_LONG=('verbose' 'refresh' 'help')
+if ! parseopts "$OPT_SHORT" "${OPT_LONG[@]}" -- "$@"; then
+    exit 1
+fi
+set  -- "${OPTRET[@]}"
+
+while :; do
+    case $1 in
+        -v|--verbose)
+            resort() { cat; }
+            VERBOSE=1
+            ;;
+        -r|--refresh)
+            REFRESH=1
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        --)
+            shift; break
+            ;;
+    esac
+    shift
+done
+
+if ! (( ( REFRESH && $# == 0 ) || $# == 2 )); then
+    echo "error: Incorrect number of arguments passed."
+    echo "Try '${BASH_SOURCE[0]##*/} --help' for more information."
+    exit 1
+fi
+
+if (( REFRESH )) || [[ ! -d ${SOCACHE_DIR} ]]; then
+    recache
+    (( $# == 2 )) || exit 0
+fi
+
+search "$@"

zsh_completion.in

@@ -1,11 +1,15 @@
-#compdef archbuild archco arch-nspawn archrelease archrm commitpkg finddeps makechrootpkg mkarchroot rebuildpkgs extrapkg=commitpkg corepkg=commitpkg testingpkg=commitpkg stagingpkg=commitpkg communitypkg=commitpkg community-testingpkg=commitpkg community-stagingpkg=commitpkg multilibpkg=commitpkg multilib-testingpkg=commitpkg extra-i686-build=archbuild extra-x86_64-build=archbuild testing-i686-build=archbuild testing-x86_64-build=archbuild staging-i686-build=archbuild staging-x86_64-build=archbuild multilib-build=archbuild multilib-testing-build=archbuild multilib-staging-build=archbuild kde-unstable-i686-build=archbuild kde-unstable-x86_64-build=archbuild gnome-unstable-i686-build=archbuild gnome-unstable-x86_64-build=archbuild communityco=archco
+#compdef archbuild archco arch-nspawn archrelease commitpkg finddeps makechrootpkg mkarchroot rebuildpkgs extrapkg=commitpkg corepkg=commitpkg testingpkg=commitpkg stagingpkg=commitpkg communitypkg=commitpkg community-testingpkg=commitpkg community-stagingpkg=commitpkg multilibpkg=commitpkg multilib-testingpkg=commitpkg extra-x86_64-build=archbuild testing-x86_64-build=archbuild staging-x86_64-build=archbuild multilib-build=archbuild multilib-testing-build=archbuild multilib-staging-build=archbuild kde-unstable-x86_64-build=archbuild gnome-unstable-x86_64-build=archbuild communityco=archco checkpkg sogrep offload-build makerepropkg
 # License: Unspecified
 
 m4_include(lib/valid-tags.sh)
+m4_include(lib/valid-repos.sh)
+
+_binary_arch=${_arch[*]:0:-1}
 
 _archbuild_args=(
 	'-c[Recreate the chroot before building]'
 	'-r[Create chroots in this directory]:base_dir:_files -/'
+	'-h[Display usage]'
 )
 
 _archco_args=(
@@ -13,23 +17,25 @@ _archco_args=(
 )
 
 _arch_nspawn_args=(
-	'-C[Location of a pacman config file]:pacman_config:_files'
-	'-M[Location of a makepkg config file]:makepkg_config:_files'
+	'-C[Location of a pacman config file]:pacman_config:_files -g "*.conf(.)"'
+	'-M[Location of a makepkg config file]:makepkg_config:_files -g "*.conf(.)"'
 	'-c[Set pacman cache]:pacman_cache:_files -/'
+	'-f[Copy file from the host to the chroot]:copy_file:_files'
+	'-s[Do not run setarch]'
 	'-h[Display usage]'
+	'1:chroot_dir:_files -/'
 )
 
 _archrelease_args=(
+	'-f[Force release without checks]'
 	"*:arch:($_tags[*])"
 )
 
-_archrm_args=(
-	'1:path:_files -/'
-)
-
 _commitpkg_args=(
-	"-a[Release to a specific architecture only]:arch:($_arch[*])"
+	'-f[Force release without checks]'
+	'-s[Target repo server]'
 	'-l[Set bandwidth limit]:limit'
+	"-a[Release to a specific architecture only]:arch:($_arch[*])"
 	'1:commit_msg'
 )
 
@@ -38,19 +44,27 @@ _finddeps_args=(
 )
 
 _makechrootpkg_args=(
-	'-I[Install a package into the working copy]:target:_files -g "*.pkg.tar.*(.)"'
-	'-c[Clean the chroot before building]'
 	'-h[Display usage]'
-	'-l[The directory to use as the working copy]:copy_dir:_files -/'
-	'-r[The chroot dir to use]:chroot_dir:_files -/'
+	'-c[Clean the chroot before building]'
+	'-d[Bind directory into build chroot as read-write]:bind_dir_rw:_files -/'
+	'-D[Bind directory into build chroot as read-only]:bind_dir_ro:_files -/'
 	'-u[Update the working copy of the chroot before building]'
+	'-r[The chroot dir to use]:chroot_dir:_files -/'
+	'-I[Install a package into the working copy]:target:_files -g "*.pkg.tar.*(.)"'
+	'-l[The directory to use as the working copy]:copy_dir:_files -/'
+	'-n[Run namcap on the package]'
+	'-T[Build in a temporary directory]'
+	'-U[Run makepkg as a specified user]:makepkg_user'
 )
 
 _mkarchroot_args=(
-	'-C[Location of a pacman config file]:pacman_config:_files'
-	'-M[Location of a makepkg config file]:makepkg_config:_files'
+	'-U[Install a package into the working copy]:target:_files -g "*.pkg.tar.*(.)"'
+	'-C[Location of a pacman config file]:pacman_config:_files -g "*.conf(.)"'
+	'-M[Location of a makepkg config file]:makepkg_config:_files -g "*.conf(.)"'
 	'-c[Set pacman cache]:pacman_cache:_files -/'
 	'-h[Display usage]'
+	'1:working_dir:_files -/'
+	'*:packages:_devtools_completions_all_packages'
 )
 
 _rebuildpkgs_args=(
@@ -58,6 +72,34 @@ _rebuildpkgs_args=(
 	'*:packages:_devtools_completions_all_packages'
 )
 
+_checkpkg_args=(
+	'(-r --rmdir)'{-r,--rmdir}'[Remove the temporary directory]'
+	'(-w --warn)'{-w,--warn}'[Print a warning in case of differences]'
+	'(-h --help)'{-h,--help}'[Display usage]'
+)
+
+_sogrep_args=(
+	'(-v --verbose)'{-v,--verbose}'[Show matched links in addition to pkgname]'
+	'(-r --refresh)'{-r,--refresh}'[Refresh the links databases]'
+	'(-h --help)'{-h,--help}'[Display usage]'
+	'1:repo:(all $_repos[*])'
+	'2:libname'
+)
+
+_offload_build_args=(
+	'(-r --repo)'{-r,--repo}'[Build against a specific repository]:repo:($_build_repos[*])'
+	'(-a --arch)'{-a,--arch}'[Build against a specific architecture]:arch:(${_binary_arch[*]})'
+	'(-s --server)'{-s,--server}'[Offload to a specific Build server]:server:'
+	'(-h --help)'{-h,--help}'[Display usage]'
+)
+
+_makerepropkg_args=(
+	'-c[Set pacman cache]:pacman_cache:_files -/'
+	'-M[Location of a makepkg config file]:makepkg_config:_files -g "*.conf(.)"'
+	'-h[Display usage]'
+	'1:working_dir:_files -g "*.pkg.tar.*(.)"'
+)
+
 _devtools_completions_all_packages() {
 	typeset -U packages
 	packages=($(_call_program packages pacman -Sql))