Version 20180531

makepkg 5.1 implements error codes, and 14 means that installing the
packages after they were built has failed. We don't care about this
error and would like makechrootpkg to succeed regardless, e.g. for split
packages that are mutually exclusive.

Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>

Makefile

@@ -1,4 +1,4 @@
-V=20171108
+V=20180531
 
 PREFIX = /usr/local
 
@@ -31,7 +31,6 @@ CONFIGFILES = \
 
 COMMITPKG_LINKS = \
 	extrapkg \
-	corepkg \
 	testingpkg \
 	stagingpkg \
 	communitypkg \

arch-nspawn.in

@@ -58,8 +58,9 @@ else
 	cache_dirs=("$cache_dir")
 fi
 
+pacconf_cmd=$(command -v pacman-conf || command -v pacconf)
 # shellcheck disable=2016
-host_mirror=$(pacman --cachedir /doesnt/exist -Sddp extra/devtools 2>/dev/null | sed -r 's#(.*/)extra/os/.*#\1$repo/os/$arch#')
+host_mirror=$($pacconf_cmd --repo extra Server 2> /dev/null | head -1 | sed -r 's#(.*/)extra/os/.*#\1$repo/os/$arch#')
 # shellcheck disable=2016
 [[ $host_mirror == *file://* ]] && host_mirror_path=$(echo "$host_mirror" | sed -r 's#file://(/.*)/\$repo/os/\$arch#\1#g')
 
@@ -91,7 +92,7 @@ copy_hostconf () {
 		cp -T "$file" "$working_dir$file"
 	done
 
-	sed -r "s|^#?\\s*CacheDir.+|CacheDir = $(echo -n "${cache_dirs[@]}")|g" -i "$working_dir/etc/pacman.conf"
+	sed -r "s|^#?\\s*CacheDir.+|CacheDir = ${cache_dirs[*]}|g" -i "$working_dir/etc/pacman.conf"
 }
 # }}}
 
@@ -107,7 +108,7 @@ fi
 build_mount_args
 copy_hostconf
 
-eval "$(grep '^CARCH=' "$working_dir/etc/makepkg.conf")"
+eval "$(grep -a '^CARCH=' "$working_dir/etc/makepkg.conf")"
 
 [[ -z $nosetarch ]] || unset CARCH
 

archbuild.in

@@ -39,7 +39,7 @@ while getopts 'hcr:' arg; do
 	esac
 done
 
-check_root
+check_root SOURCE_DATE_EPOCH
 
 # Pass all arguments after -- right to makepkg
 makechrootpkg_args+=("${@:$OPTIND}")
@@ -74,5 +74,10 @@ else
                 pacman -Syu --noconfirm || abort
 fi
 
+# Always build official packages reproducibly
+if [[ ! -v SOURCE_DATE_EPOCH ]]; then
+	export SOURCE_DATE_EPOCH=$(date +%s)
+fi
+
 msg "Building in chroot for [%s] (%s)..." "${repo}" "${arch}"
 exec makechrootpkg -r "${chroots}/${repo}-${arch}" "${makechrootpkg_args[@]}"

lib/archroot.sh

@@ -6,13 +6,15 @@
 CHROOT_VERSION='v4'
 
 ##
-#  usage : check_root
+#  usage : check_root $keepenv
 ##
 orig_argv=("$0" "$@")
 check_root() {
+	local keepenv=$1
+
 	(( EUID == 0 )) && return
 	if type -P sudo >/dev/null; then
-		exec sudo -- "${orig_argv[@]}"
+		exec sudo --preserve-env=$keepenv -- "${orig_argv[@]}"
 	else
 		exec su root -c "$(printf ' %q' "${orig_argv[@]}")"
 	fi

lib/common.sh

@@ -4,10 +4,12 @@
 # License: Unspecified
 
 [[ -z ${_INCLUDE_COMMON_SH:-} ]] || return 0
-_INCLUDE_COMMON_SH=true
+_INCLUDE_COMMON_SH="$(set +o|grep nounset)"
 
+set +u +o posix
 # shellcheck disable=1091
 . /usr/share/makepkg/util.sh
+$_INCLUDE_COMMON_SH
 
 # Avoid any encoding problems
 export LANG=C

makechrootpkg.in

@@ -69,7 +69,7 @@ load_vars() {
 	[[ -f $makepkg_conf ]] || return 1
 
 	for var in {SRC,SRCPKG,PKG,LOG}DEST MAKEFLAGS PACKAGER; do
-		[[ -z ${!var:-} ]] && eval "$(grep "^${var}=" "$makepkg_conf")"
+		[[ -z ${!var:-} ]] && eval "$(grep -a "^${var}=" "$makepkg_conf")"
 	done
 
 	return 0
@@ -165,7 +165,7 @@ prepare_chroot() {
 	local keepbuilddir=$3
 	local run_namcap=$4
 
-	$keepbuilddir || rm -rf "$copydir/build"
+	[[ $keepbuilddir = true ]] || rm -rf "$copydir/build"
 
 	local builduser_uid builduser_gid
 	builduser_uid="${SUDO_UID:-$UID}"
@@ -176,16 +176,12 @@ prepare_chroot() {
 	# We can't use useradd without chrooting, otherwise it invokes PAM modules
 	# which we might not be able to load (i.e. when building i686 packages on
 	# an x86_64 host).
-	sed -e '/^builduser:/d' -i "$copydir"/etc/{passwd,group}
+	sed -e '/^builduser:/d' -i "$copydir"/etc/{passwd,shadow,group}
 	printf >>"$copydir/etc/group"  'builduser:x:%d:\n' "$builduser_gid"
 	printf >>"$copydir/etc/passwd" 'builduser:x:%d:%d:builduser:/build:/bin/bash\n' "$builduser_uid" "$builduser_gid"
+	printf >>"$copydir/etc/shadow" 'builduser:!!:%d::::::\n' "$(( $(date -u +%s) / 86400 ))"
 
-	$install -d "$copydir"/{build,build/.gnupg,startdir,{pkg,srcpkg,src,log}dest}
-
-	for x in .gnupg/pubring.{kbx,gpg}; do
-		[[ -r $USER_HOME/$x ]] || continue
-		$install -m 644 "$USER_HOME/$x" "$copydir/build/$x"
-	done
+	$install -d "$copydir"/{build,startdir,{pkg,srcpkg,src,log}dest}
 
 	sed -e '/^MAKEFLAGS=/d' -e '/^PACKAGER=/d' -i "$copydir/etc/makepkg.conf"
 	for x in BUILDDIR=/build PKGDEST=/pkgdest SRCPKGDEST=/srcpkgdest SRCDEST=/srcdest LOGDEST=/logdest \
@@ -205,9 +201,10 @@ EOF
 	{
 		printf '#!/bin/bash\n'
 		declare -f _chrootbuild
+		declare -p SOURCE_DATE_EPOCH 2>/dev/null || true
 		printf '_chrootbuild "$@" || exit\n'
 
-		if $run_namcap; then
+		if [[ $run_namcap = true ]]; then
 			declare -f _chrootnamcap
 			printf '_chrootnamcap || exit\n'
 		fi
@@ -218,9 +215,6 @@ EOF
 # These functions aren't run in makechrootpkg,
 # so no global variables
 _chrootbuild() {
-	# Work around nspawn not giving us a ctty
-	exec </dev/console
-
 	# No coredumps
 	ulimit -c 0
 
@@ -231,7 +225,14 @@ _chrootbuild() {
 	# use "$" in arguments to commands with "sudo -i".  ${foo} or
 	# ${1} is OK, but $foo or $1 isn't.
 	# https://bugzilla.sudo.ws/show_bug.cgi?id=765
-	sudo -iu builduser bash -c 'cd /startdir; makepkg "$@"' -bash "$@"
+	sudo --preserve-env=SOURCE_DATE_EPOCH -iu builduser bash -c 'cd /startdir; makepkg "$@"' -bash "$@"
+	ret=$?
+	case $ret in
+		0|14)
+			return 0;;
+		*)
+			return $ret;;
+	esac
 }
 
 _chrootnamcap() {
@@ -251,10 +252,11 @@ download_sources() {
 
 	local builddir
 	builddir="$(mktemp -d)"
-	chmod 1777 "$builddir"
+	chown "$makepkg_user:" "$builddir"
 
 	# Ensure sources are downloaded
-	sudo -u "$makepkg_user" env SRCDEST="$SRCDEST" BUILDDIR="$builddir" \
+	sudo -u "$makepkg_user" --preserve-env=GNUPGHOME \
+		env SRCDEST="$SRCDEST" BUILDDIR="$builddir" \
 		makepkg --config="$copydir/etc/makepkg.conf" --verifysource -o ||
 		die "Could not download sources."
 
@@ -343,7 +345,7 @@ main() {
 	[[ -n $makepkg_user && -z $(id -u "$makepkg_user") ]] && die 'Invalid makepkg user.'
 	makepkg_user=${makepkg_user:-${SUDO_USER:-$USER}}
 
-	check_root
+	check_root SOURCE_DATE_EPOCH,GNUPGHOME
 
 	# Canonicalize chrootdir, getting rid of trailing /
 	chrootdir=$(readlink -e "$passeddir")
@@ -411,7 +413,7 @@ main() {
 
 	download_sources "$copydir" "$makepkg_user"
 
-	prepare_chroot "$copydir" "$USER_HOME" "$keepbuilddir"
+	prepare_chroot "$copydir" "$USER_HOME" "$keepbuilddir" "$run_namcap"
 
 	if arch-nspawn "$copydir" \
 		--bind="$PWD:/startdir" \