Version 20220621

In case the validpgpkeys array is empty or undefined, the empty printf
line only included a single line break which lead to mapfile -t
consuming it as an array with 1 element consisting of an empty string.

Fix this by only calling the printf in case the validpgpkeys array is
not empty. Without any output, the mapfile -t will simply produce an
empty array.

Signed-off-by: Levente Polyak <anthraxx@archlinux.org>

.github/workflows/test.yml

@@ -1,15 +0,0 @@
-on: push
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    container: archlinux/archlinux:latest
-    steps:
-      - name: Install dependencies
-        run: pacman -Syu --noconfirm m4 make openssh subversion rsync arch-install-scripts git bzr mercurial diffutils asciidoc shellcheck
-      - uses: actions/checkout@v2
-      - name: Run tests
-        run: |
-           make PREFIX=/usr
-           make PREFIX=/usr DESTDIR="$(mktemp -d)" install
-           make check || true
-           SHELLCHECK_OPTS="-S error" make check

.gitignore

@@ -6,6 +6,8 @@ archrelease
 bash_completion
 checkpkg
 commitpkg
+diffpkg
+export-pkgbuild-keys
 finddeps
 lddd
 makechrootpkg

.gitlab-ci.yml

@@ -0,0 +1,21 @@
+image: "archlinux:latest"
+
+stages:
+  - build
+  - test
+
+build:
+  stage: build
+  needs: []
+  script:
+    - pacman -Syu --noconfirm m4 make openssh subversion rsync arch-install-scripts git bzr mercurial diffutils asciidoc
+    - make PREFIX=/usr
+    - make PREFIX=/usr DESTDIR=build install
+
+check:
+  stage: test
+  needs: []
+  script:
+    - pacman -Syu --noconfirm m4 make openssh subversion rsync arch-install-scripts git bzr mercurial diffutils asciidoc shellcheck
+    - make check || true
+    - SHELLCHECK_OPTS="-S error" make check

Makefile

@@ -1,4 +1,4 @@
-V=20211129
+V=20220621
 BUILDTOOLVER ?= $(V)
 
 PREFIX = /usr/local
@@ -12,6 +12,8 @@ IN_PROGS = \
 	checkpkg \
 	commitpkg \
 	crossrepomove\
+	diffpkg \
+	export-pkgbuild-keys \
 	finddeps \
 	find-libdeps \
 	lddd \
@@ -27,9 +29,13 @@ BINPROGS = \
 
 CONFIGFILES = \
 	makepkg-x86_64.conf \
+	makepkg-x86_64_v3.conf \
 	pacman-extra.conf \
+	pacman-extra-x86_64_v3.conf \
 	pacman-testing.conf \
+	pacman-testing-x86_64_v3.conf \
 	pacman-staging.conf \
+	pacman-staging-x86_64_v3.conf \
 	pacman-multilib.conf \
 	pacman-multilib-testing.conf \
 	pacman-multilib-staging.conf \
@@ -37,6 +43,7 @@ CONFIGFILES = \
 	pacman-gnome-unstable.conf
 
 SETARCH_ALIASES = \
+	x86_64_v3
 
 COMMITPKG_LINKS = \
 	extrapkg \
@@ -53,8 +60,11 @@ COMMITPKG_LINKS = \
 
 ARCHBUILD_LINKS = \
 	extra-x86_64-build \
+	extra-x86_64_v3-build \
 	testing-x86_64-build \
+	testing-x86_64_v3-build \
 	staging-x86_64-build \
+	staging-x86_64_v3-build \
 	multilib-build \
 	multilib-testing-build \
 	multilib-staging-build \
@@ -73,9 +83,11 @@ BASHCOMPLETION_LINKS = \
 MANS = \
 	doc/archbuild.1 \
 	doc/arch-nspawn.1 \
+	doc/export-pkgbuild-keys.1 \
 	doc/makechrootpkg.1 \
 	doc/lddd.1 \
 	doc/checkpkg.1 \
+	doc/diffpkg.1 \
 	doc/offload-build.1 \
 	doc/sogrep.1 \
 	doc/makerepropkg.1 \
@@ -116,8 +128,8 @@ install:
 	for l in ${ARCHBUILD_LINKS}; do ln -sf archbuild $(DESTDIR)$(PREFIX)/bin/$$l; done
 	for l in ${CROSSREPOMOVE_LINKS}; do ln -sf crossrepomove $(DESTDIR)$(PREFIX)/bin/$$l; done
 	ln -sf find-libdeps $(DESTDIR)$(PREFIX)/bin/find-libprovides
-	install -Dm0644 bash_completion $(DESTDIR)/usr/share/bash-completion/completions/devtools
-	for l in ${BASHCOMPLETION_LINKS}; do ln -sf devtools $(DESTDIR)/usr/share/bash-completion/completions/$$l; done
+	install -Dm0644 bash_completion $(DESTDIR)$(PREFIX)/share/bash-completion/completions/devtools
+	for l in ${BASHCOMPLETION_LINKS}; do ln -sf devtools $(DESTDIR)$(PREFIX)/share/bash-completion/completions/$$l; done
 	install -Dm0644 zsh_completion $(DESTDIR)$(PREFIX)/share/zsh/site-functions/_devtools
 	ln -sf archco $(DESTDIR)$(PREFIX)/bin/communityco
 	for manfile in $(MANS); do \
@@ -131,7 +143,8 @@ uninstall:
 	for l in ${COMMITPKG_LINKS}; do rm -f $(DESTDIR)$(PREFIX)/bin/$$l; done
 	for l in ${ARCHBUILD_LINKS}; do rm -f $(DESTDIR)$(PREFIX)/bin/$$l; done
 	for l in ${CROSSREPOMOVE_LINKS}; do rm -f $(DESTDIR)$(PREFIX)/bin/$$l; done
-	rm $(DESTDIR)/usr/share/bash-completion/completions/devtools
+	for l in ${BASHCOMPLETION_LINKS}; do rm -f $(DESTDIR)$(PREFIX)/share/bash-completion/completions/$$l; done
+	rm $(DESTDIR)$(PREFIX)/share/bash-completion/completions/devtools
 	rm $(DESTDIR)$(PREFIX)/share/zsh/site-functions/_devtools
 	rm -f $(DESTDIR)$(PREFIX)/bin/communityco
 	rm -f $(DESTDIR)$(PREFIX)/bin/find-libprovides
@@ -146,7 +159,7 @@ tag:
 	@git tag --sign --message "Version $(TODAY)" $(TODAY)
 
 dist:
-	git archive --format=tar --prefix=devtools-$(V)/ $(V) | gzip -9 > devtools-$(V).tar.gz
+	git archive --format=tar --prefix=devtools-$(V)/ $(V) | gzip > devtools-$(V).tar.gz
 	gpg --detach-sign --use-agent devtools-$(V).tar.gz
 
 upload:

archrelease.in

@@ -51,11 +51,6 @@ fi
 pushd .. >/dev/null
 mapfile -t known_files < <(svn ls -r HEAD "$trunk")
 wait $! || die "failed to discover committed files"
-for file in "${known_files[@]}"; do
-	if [[ ${file:(-1)} = '/' ]]; then
-		die "archrelease: subdirectories are not supported in package directories!"
-	fi
-done
 
 # gracefully handle files containing an "@" character
 known_files=("${known_files[@]/%/@}")
@@ -67,7 +62,7 @@ for tag in "$@"; do
 	stat_busy "Copying %s to %s" "${trunk}" "${tag}"
 
 	if [[ -d repos/$tag ]]; then
-		mapfile -t trash < <(svn ls "repos/$tag")
+		mapfile -t trash < <(svn ls --recursive "repos/$tag")
 		wait $! || die "failed to discover existing files"
 		if (( ${#trash[@]} )); then
 			trash=("${trash[@]/#/repos/$tag/}")

checkpkg.in

@@ -6,23 +6,6 @@ shopt -s extglob
 
 m4_include(lib/common.sh)
 
-# Source makepkg.conf; fail if it is not found
-if [[ -r '/etc/makepkg.conf' ]]; then
-	# shellcheck source=makepkg-x86_64.conf
-	source '/etc/makepkg.conf'
-else
-	die '/etc/makepkg.conf not found!'
-fi
-
-# Source user-specific makepkg.conf overrides
-if [[ -r "${XDG_CONFIG_HOME:-$HOME/.config}/pacman/makepkg.conf" ]]; then
-	# shellcheck source=/dev/null
-	source "${XDG_CONFIG_HOME:-$HOME/.config}/pacman/makepkg.conf"
-elif [[ -r "$HOME/.makepkg.conf" ]]; then
-	# shellcheck source=/dev/null
-	source "$HOME/.makepkg.conf"
-fi
-
 usage() {
     cat <<- _EOF_
 		Usage: ${BASH_SOURCE[0]##*/} [OPTIONS]
@@ -37,39 +20,64 @@ usage() {
 		OPTIONS
 		    -r, --rmdir          Remove the temporary directory
 		    -w, --warn           Print a warning in case of differences
+		    -M, --makepkg-config Set an alternate makepkg configuration file
 		    -h, --help           Show this help text
 _EOF_
 }
 
 RMDIR=0
 WARN=0
+MAKEPKG_CONF=/etc/makepkg.conf
 
-OPT_SHORT='rwh'
-OPT_LONG=('rmdir' 'warn' 'help')
-if ! parseopts "$OPT_SHORT" "${OPT_LONG[@]}" -- "$@"; then
-    exit 1
-fi
-set  -- "${OPTRET[@]}"
-
-while :; do
+# option checking
+while (( $# )); do
 	case $1 in
-        -r|--rmdir)
-            RMDIR=1
-            ;;
-        -w|--warn)
-            WARN=1
-            ;;
 		-h|--help)
 			usage
 			exit 0
 			;;
+		-r|--rmdir)
+			RMDIR=1
+			shift
+			;;
+		-w|--warn)
+			WARN=1
+			shift
+			;;
+		-M|--makepkg-config)
+			MAKEPKG_CONF="$2"
+			shift 2
+			;;
 		--)
-            shift; break
+			shift
+			break
+			;;
+		-*,--*)
+			die "invalid argument: %s" "$1"
+			;;
+		*)
+			break
 			;;
 	esac
-    shift
 done
 
+# Source makepkg.conf; fail if it is not found
+if [[ -r "${MAKEPKG_CONF}" ]]; then
+	# shellcheck source=makepkg-x86_64.conf
+	source "${MAKEPKG_CONF}"
+else
+	die "${MAKEPKG_CONF} not found!"
+fi
+
+# Source user-specific makepkg.conf overrides
+if [[ -r "${XDG_CONFIG_HOME:-$HOME/.config}/pacman/makepkg.conf" ]]; then
+	# shellcheck source=/dev/null
+	source "${XDG_CONFIG_HOME:-$HOME/.config}/pacman/makepkg.conf"
+elif [[ -r "$HOME/.makepkg.conf" ]]; then
+	# shellcheck source=/dev/null
+	source "$HOME/.makepkg.conf"
+fi
+
 if [[ ! -f PKGBUILD ]]; then
 	die 'This must be run in the directory of a built package.'
 fi

commitpkg.in

@@ -48,6 +48,21 @@ case "$cmd" in
 		;;
 esac
 
+
+if (( ${#validpgpkeys[@]} != 0 )); then
+	if [[ -d keys ]]; then
+		for key in "${validpgpkeys[@]}"; do
+			if [[ ! -f keys/pgp/$key.asc ]]; then
+				export-pkgbuild-keys || die 'Failed to export valid PGP keys for source files'
+			fi
+		done
+	else
+		export-pkgbuild-keys || die 'Failed to export valid PGP keys for source files'
+	fi
+
+	svn add --parents --force keys/pgp/*
+fi
+
 # find files which should be under source control
 needsversioning=()
 for s in "${source[@]}"; do
@@ -60,6 +75,9 @@ for i in 'changelog' 'install'; do
 		needsversioning+=("$file")
 	done < <(sed -n "s/^[[:space:]]*$i=//p" PKGBUILD)
 done
+for key in "${validpgpkeys[@]}"; do
+	needsversioning+=("keys/pgp/$key.asc")
+done
 
 # assert that they really are controlled by SVN
 if (( ${#needsversioning[*]} )); then
@@ -93,16 +111,14 @@ for _arch in "${arch[@]}"; do
 		fullver=$(get_full_version "$_pkgname")
 
 		if pkgfile=$(find_cached_package "$_pkgname" "$fullver" "$_arch"); then
-			if grep -q "packager = Unknown Packager" <(bsdtar -xOqf "$pkgfile" .PKGINFO); then
-				die "PACKAGER was not set when building package"
-			fi
-			hashsum=sha256sum
-			pkgbuild_hash=$(awk -v"hashsum=$hashsum" -F' = ' '$1 == "pkgbuild_"hashsum {print $2}' <(bsdtar -xOqf "$pkgfile" .BUILDINFO))
-			if [[ "$pkgbuild_hash" != "$($hashsum PKGBUILD|cut -d' ' -f1)" ]]; then
-				die "PKGBUILD $hashsum mismatch: expected $pkgbuild_hash"
-			fi
+			check_package_validity "$pkgfile"
 		fi
 	done
+
+	fullver=$(get_full_version "$pkgbase")
+	if pkgfile=$(find_cached_package "$pkgbase-debug" "$fullver" "$_arch"); then
+		check_package_validity "$pkgfile"
+	fi
 done
 
 if [[ -z $server ]]; then
@@ -147,14 +163,25 @@ for _arch in "${arch[@]}"; do
 
 	for _pkgname in "${pkgname[@]}"; do
 		fullver=$(get_full_version "$_pkgname")
-
 		if ! pkgfile=$(find_cached_package "$_pkgname" "$fullver" "${_arch}"); then
 			warning "Skipping %s: failed to locate package file" "$_pkgname-$fullver-$_arch"
 			skip_arches+=("$_arch")
 			continue 2
 		fi
 		uploads+=("$pkgfile")
+	done
 
+	fullver=$(get_full_version "$pkgbase")
+	if ! pkgfile=$(find_cached_package "$pkgbase-debug" "$fullver" "$_arch"); then
+		continue
+	fi
+	if ! is_debug_package "$pkgfile"; then
+		continue
+	fi
+	uploads+=("$pkgfile")
+done
+
+for pkgfile in "${uploads[@]}"; do
 	sigfile="${pkgfile}.sig"
 	if [[ ! -f $sigfile ]]; then
 		msg "Signing package %s..." "${pkgfile}"
@@ -167,7 +194,6 @@ for _arch in "${arch[@]}"; do
 		die "Signature %s is incorrect!" "$sigfile"
 	fi
 	uploads+=("$sigfile")
-	done
 done
 
 for _arch in "${arch[@]}"; do

diffpkg.in

@@ -0,0 +1,228 @@
+#!/bin/bash
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+shopt -s extglob
+
+m4_include(lib/common.sh)
+
+usage() {
+    cat <<- _EOF_
+		Usage: ${BASH_SOURCE[0]##*/} [OPTIONS] [MODES] [FILE|PKGNAME...]
+
+		Searches for a locally built package corresponding to the PKGBUILD, and
+		downloads the last version of that package from the Pacman repositories.
+		It then compares the package archives using different modes while using
+		simple tar content list by default.
+
+		When given one package, use it to diff against the locally built one.
+		When given two packages, diff both packages against each other.
+
+		In either case, a package name will be converted to a filename from the
+		cache, and diffpkg will proceed as though this filename was initially
+		specified.
+
+		OPTIONS
+		    -M, --makepkg-config Set an alternate makepkg configuration file
+		    -v, --verbose        Provide more detailed/unfiltered output
+		    -h, --help           Show this help text
+
+		MODES
+		    -l, --list           Activate content list diff mode (default)
+		    -d, --diffoscope     Activate diffoscope diff mode
+		    -p, --pkginfo        Activate .PKGINFO diff mode
+		    -b, --buildinfo      Activate .BUILDINFO diff mode
+_EOF_
+}
+
+MAKEPKG_CONF=/etc/makepkg.conf
+VERBOSE=0
+TARLIST=0
+DIFFOSCOPE=0
+PKGINFO=0
+BUILDINFO=0
+
+# option checking
+while (( $# )); do
+	case $1 in
+		-h|--help)
+			usage
+			exit 0
+			;;
+		-M|--makepkg-config)
+			MAKEPKG_CONF="$2"
+			shift 2
+			;;
+		-l|--list)
+			TARLIST=1
+			shift
+			;;
+		-d|--diffoscope)
+			DIFFOSCOPE=1
+			shift
+			;;
+		-p|--pkginfo)
+			PKGINFO=1
+			shift
+			;;
+		-b|--buildinfo)
+			BUILDINFO=1
+			shift
+			;;
+		-v|--verbose)
+			VERBOSE=1
+			shift
+			;;
+		--)
+			shift
+			break
+			;;
+		-*,--*)
+			die "invalid argument: %s" "$1"
+			;;
+		*)
+			break
+			;;
+	esac
+done
+
+if ! (( DIFFOSCOPE || TARLIST || PKGINFO || BUILDINFO )); then
+	TARLIST=1
+fi
+
+# Source makepkg.conf; fail if it is not found
+if [[ -r "${MAKEPKG_CONF}" ]]; then
+	# shellcheck source=makepkg-x86_64.conf
+	source "${MAKEPKG_CONF}"
+else
+	die "${MAKEPKG_CONF} not found!"
+fi
+
+# Source user-specific makepkg.conf overrides
+if [[ -r "${XDG_CONFIG_HOME:-$HOME/.config}/pacman/makepkg.conf" ]]; then
+	# shellcheck source=/dev/null
+	source "${XDG_CONFIG_HOME:-$HOME/.config}/pacman/makepkg.conf"
+elif [[ -r "$HOME/.makepkg.conf" ]]; then
+	# shellcheck source=/dev/null
+	source "$HOME/.makepkg.conf"
+fi
+
+STARTDIR=$(pwd)
+trap 'rm -rf $TMPDIR' EXIT INT TERM QUIT
+TMPDIR=$(mktemp -d --tmpdir diffpkg-script.XXXXXXXX)
+export TMPDIR
+
+tar_list() {
+	bsdtar tf "$*" | if (( VERBOSE )); then
+		cat
+	else
+		sed -E 's|^usr/lib/modules/[0-9][^/]+|usr/lib/modules/[…]|g'
+	fi | sort
+}
+
+diff_pkgs() {
+	local oldpkg newpkg
+	oldpkg=$(readlink -m "$1")
+	newpkg=$(readlink -m "$2")
+
+	[[ -f $oldpkg ]] || die "No such file: %s" "${oldpkg}"
+	[[ -f $newpkg ]] || die "No such file: %s" "${newpkg}"
+
+	if (( TARLIST )); then
+		tar_list "$oldpkg" > "$TMPDIR/filelist-old"
+		tar_list "$newpkg" > "$TMPDIR/filelist"
+
+		sdiff -s "$TMPDIR/filelist-old" "$TMPDIR/filelist"
+	fi
+
+	if (( PKGINFO )); then
+		bsdtar xOqf "$oldpkg" .PKGINFO > "$TMPDIR/pkginfo-old"
+		bsdtar xOqf "$newpkg" .PKGINFO > "$TMPDIR/pkginfo"
+
+		sdiff -s "$TMPDIR/pkginfo-old" "$TMPDIR/pkginfo"
+	fi
+
+	if (( BUILDINFO )); then
+		bsdtar xOqf "$oldpkg" .BUILDINFO > "$TMPDIR/buildinfo-old"
+		bsdtar xOqf "$newpkg" .BUILDINFO > "$TMPDIR/buildinfo"
+
+		sdiff -s "$TMPDIR/buildinfo-old" "$TMPDIR/buildinfo"
+	fi
+
+	if (( DIFFOSCOPE )); then
+		diffoscope "$oldpkg" "$newpkg"
+	fi
+}
+
+fetch_pkg() {
+	local pkg pkgdest pkgurl
+	case $1 in
+		*://*)
+			pkgurl=$1 ;;
+		/*|*/*)
+			pkgurl=$(readlink -m "$1") ;;
+		*.pkg.tar*)
+			pkgurl=$1 ;;
+		'')
+			;;
+		*)
+			pkg=$1 ;;
+	esac
+
+	[[ -n $pkgurl ]] || pkgurl=$(pacman -Spdd --print-format '%l' --noconfirm "$pkg") ||
+		die "Couldn't download previous package for %s." "$pkg"
+
+	pkg=${pkgurl##*/}
+	pkgdest=$(mktemp -t -d "${pkg}-XXXXXX")/${pkg}
+
+	if [[ $pkgurl = file://* || ( $pkgurl = /* && -f $pkgurl ) ]]; then
+		ln -sf "${pkgurl#file://}" "$pkgdest"
+	elif [[ -f "$PKGDEST/$pkg" ]]; then
+		ln -sf "$PKGDEST/$pkg" "$pkgdest"
+	elif [[ -f "$STARTDIR/$pkg" ]]; then
+		ln -sf "$STARTDIR/$pkg" "$pkgdest"
+	elif [[ $pkgurl = *://* ]]; then
+		curl -fsLC - --retry 3 --retry-delay 3 -o "$pkgdest" "$pkgurl" || \
+			die "Couldn't download %s" "$pkgurl"
+	else
+		die "File not found: %s" "$pkgurl"
+	fi
+
+	echo "$pkgdest"
+}
+
+if (( $# < 2 )); then
+	if [[ ! -f PKGBUILD ]]; then
+		die "This must be run in the directory of a built package.\nTry '$(basename "$0") --help' for more information."
+	fi
+
+	# shellcheck source=PKGBUILD.proto
+	. ./PKGBUILD
+	if [[ ${arch[0]} == 'any' ]]; then
+		CARCH='any'
+	fi
+
+	for _pkgname in "${pkgname[@]}"; do
+		comparepkg=$_pkgname
+		pkgurl=
+		target_pkgver=$(get_full_version "$_pkgname")
+		if ! pkgfile=$(find_cached_package "$_pkgname" "$target_pkgver" "$CARCH"); then
+			die 'tarball not found for package: %s' "${_pkgname}-$target_pkgver"
+		fi
+
+		ln -s "$pkgfile" "$TMPDIR"
+
+		if (( $# )); then
+			comparepkg="$1"
+		fi
+
+		oldpkg=$(fetch_pkg "$comparepkg") || exit 1
+
+		diff_pkgs "$oldpkg" "$pkgfile"
+	done
+else
+	file1=$(fetch_pkg "$1") || exit 1
+	file2=$(fetch_pkg "$2") || exit 1
+
+	diff_pkgs "$file1" "$file2"
+fi

doc/checkpkg.1.asciidoc

@@ -29,6 +29,9 @@ Options
 *-w, --warn*::
 	Print a warning instead of a regular message in case of soname differences.
 
+*-M, --makepkg-config*::
+	Set an alternate makepkg configuration file.
+
 *-h, --help*::
 	Show a help text
 

doc/diffpkg.1.asciidoc

@@ -0,0 +1,57 @@
+diffpkg(1)
+===========
+
+Name
+----
+diffpkg - Compare package files using different modes.
+
+Synopsis
+--------
+diffpkg [OPTIONS] [MODES] [FILE|PKGNAME...]
+
+Description
+-----------
+
+Searches for a locally built package corresponding to the PKGBUILD, and
+downloads the last version of that package from the Pacman repositories.
+It then compares the package archives using different modes while using
+simple tar content list by default.
+
+When given one package, use it to diff against the locally built one.
+When given two packages, diff both packages against each other.
+
+In either case, a package name will be converted to a filename from the
+cache, and diffpkg will proceed as though this filename was initially
+specified.
+
+Options
+-------
+
+*-M, --makepkg-config*::
+	Set an alternate makepkg configuration file
+
+*-v, --verbose*::
+	Provide more detailed/unfiltered output
+
+*-h, --help*::
+	Show a help text
+
+Modes
+-----
+
+*-l, --list*::
+	Activate tar content list diff mode (default)
+
+*-d, --diffoscope*::
+	Activate diffoscope diff mode
+
+*-p, --pkginfo*::
+	Activate .PKGINFO diff mode
+
+*-b, --buildinfo*::
+	Activate .BUILDINFO diff mode
+
+See Also
+--------
+
+include::footer.asciidoc[]

doc/export-pkgbuild-keys.1.asciidoc

@@ -0,0 +1,25 @@
+export-pkgbuild-keys(1)
+=======================
+
+Name
+----
+export-pkgbuild-keys - Export valid source signing keys from a PKGBUILD
+
+Synopsis
+--------
+export-pkgbuild-keys
+
+Description
+-----------
+
+Export the PGP keys from a PKGBUILDs validpgpkeys array into the keys/pgp/
+subdirectory. Useful for distributing packager validated source signing
+keys alongside PKGBUILDs.
+
+Options
+-------
+
+*-h, --help*::
+	Show a help text.
+
+include::footer.asciidoc[]

export-pkgbuild-keys.in

@@ -0,0 +1,75 @@
+#!/bin/bash
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+m4_include(lib/common.sh)
+
+usage() {
+	cat <<- _EOF_
+		Usage: ${BASH_SOURCE[0]##*/}
+
+		Export the PGP keys from a PKGBUILDs validpgpkeys array into the keys/pgp/
+		subdirectory. Useful for distributing packager validated source signing
+		keys alongside PKGBUILDs.
+
+		OPTIONS
+		    -h, --help      Show this help text
+_EOF_
+}
+
+# option checking
+while (( $# )); do
+	case $1 in
+		-h|--help)
+			usage
+			exit 0
+			;;
+		*)
+			die "invalid argument: %s" "$1"
+			;;
+	esac
+done
+
+if [[ ! -f PKGBUILD ]]; then
+	die "This must be run a directory containing a PKGBUILD."
+fi
+
+mapfile -t validpgpkeys < <(
+	# shellcheck source=PKGBUILD.proto
+	. ./PKGBUILD
+	if (( ${#validpgpkeys[@]} )); then
+		printf "%s\n" "${validpgpkeys[@]}"
+	fi
+)
+
+msg "Exporting ${#validpgpkeys[@]} PGP keys..."
+if (( ${#validpgpkeys[@]} == 0 )); then
+	exit 0
+fi
+
+trap 'rm -rf $TEMPDIR' EXIT INT TERM QUIT
+TEMPDIR=$(mktemp -d --tmpdir export-pkgbuild-keys.XXXXXXXXXX)
+
+mkdir -p keys/pgp
+error=0
+
+for key in "${validpgpkeys[@]}"; do
+	gpg --output "$TEMPDIR/$key.asc" --armor --export --export-options export-minimal "$key" 2>/dev/null
+
+	# gpg does not give a non-zero return value if it fails to export...
+	if [[ -f $TEMPDIR/$key.asc ]]; then
+		msg2 "Exported $key"
+		mv "$TEMPDIR/$key.asc" "keys/pgp/$key.asc"
+	else
+		if [[ -f keys/pgp/$key.asc ]]; then
+			warning "Failed to update key: $key"
+		else
+			error "Key unavailable: $key"
+			error=1
+		fi
+	fi
+done
+
+if (( error )); then
+	die "Failed to export all \'validpgpkeys\' entries."
+fi

lib/common.sh

@@ -189,3 +189,73 @@ find_cached_package() {
 			return 1
 	esac
 }
+
+
+check_package_validity(){
+	local pkgfile=$1
+	if grep -q "packager = Unknown Packager" <(bsdtar -xOqf "$pkgfile" .PKGINFO); then
+		die "PACKAGER was not set when building package"
+	fi
+	hashsum=sha256sum
+	pkgbuild_hash=$(awk -v"hashsum=$hashsum" -F' = ' '$1 == "pkgbuild_"hashsum {print $2}' <(bsdtar -xOqf "$pkgfile" .BUILDINFO))
+	if [[ "$pkgbuild_hash" != "$($hashsum PKGBUILD|cut -d' ' -f1)" ]]; then
+		die "PKGBUILD $hashsum mismatch: expected $pkgbuild_hash"
+	fi
+}
+
+
+# usage: grep_pkginfo pkgfile pattern
+grep_pkginfo() {
+	local _ret=()
+	mapfile -t _ret < <(bsdtar -xOqf "$1" ".PKGINFO" | grep "^${2} = ")
+	printf '%s\n' "${_ret[@]#${2} = }"
+}
+
+
+# Get the package name
+getpkgname() {
+	local _name
+
+	_name="$(grep_pkginfo "$1" "pkgname")"
+	if [[ -z $_name ]]; then
+		error "Package '%s' has no pkgname in the PKGINFO. Fail!" "$1"
+		exit 1
+	fi
+
+	echo "$_name"
+}
+
+
+# Get the package base or name as fallback
+getpkgbase() {
+	local _base
+
+	_base="$(grep_pkginfo "$1" "pkgbase")"
+	if [[ -z $_base ]]; then
+		getpkgname "$1"
+	else
+		echo "$_base"
+	fi
+}
+
+
+getpkgdesc() {
+	local _desc
+
+	_desc="$(grep_pkginfo "$1" "pkgdesc")"
+	if [[ -z $_desc ]]; then
+		error "Package '%s' has no pkgdesc in the PKGINFO. Fail!" "$1"
+		exit 1
+	fi
+
+	echo "$_desc"
+}
+
+
+is_debug_package() {
+	local pkgfile=${1} pkgbase pkgname pkgdesc
+	pkgbase="$(getpkgbase "${pkgfile}")"
+	pkgname="$(getpkgname "${pkgfile}")"
+	pkgdesc="$(getpkgdesc "${pkgfile}")"
+	[[ ${pkgdesc} == "Detached debugging symbols for "* && ${pkgbase}-debug = "${pkgname}" ]]
+}

makechrootpkg.in

@@ -408,7 +408,7 @@ else
 		done
 
 		msg2 "Checking packages"
-		sudo -u "$makepkg_user" checkpkg --rmdir --warn "${remotepkgs[@]/#file:\/\//}"
+		sudo -u "$makepkg_user" checkpkg --rmdir --warn --makepkg-config "$copydir/etc/makepkg.conf" "${remotepkgs[@]/#file:\/\//}"
 	fi
 	true
 fi

makepkg-x86_64.conf

@@ -45,12 +45,13 @@ CFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions \
         -fstack-clash-protection -fcf-protection"
 CXXFLAGS="$CFLAGS -Wp,-D_GLIBCXX_ASSERTIONS"
 LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
+LTOFLAGS="-flto=auto"
 #RUSTFLAGS="-C opt-level=2"
 #-- Make Flags: change this for DistCC/SMP systems
 #MAKEFLAGS="-j2"
 #-- Debugging flags
-DEBUG_CFLAGS="-g -fvar-tracking-assignments"
-DEBUG_CXXFLAGS="-g -fvar-tracking-assignments"
+DEBUG_CFLAGS="-g"
+DEBUG_CXXFLAGS="$DEBUG_CFLAGS"
 #DEBUG_RUSTFLAGS="-C debuginfo=2"
 
 #########################################################################

makepkg-x86_64_v3.conf

@@ -0,0 +1,162 @@
+#!/hint/bash
+# shellcheck disable=2034
+
+#
+# /etc/makepkg.conf
+#
+
+#########################################################################
+# SOURCE ACQUISITION
+#########################################################################
+#
+#-- The download utilities that makepkg should use to acquire sources
+#  Format: 'protocol::agent'
+DLAGENTS=('file::/usr/bin/curl -qgC - -o %o %u'
+          'ftp::/usr/bin/curl -qgfC - --ftp-pasv --retry 3 --retry-delay 3 -o %o %u'
+          'http::/usr/bin/curl -qgb "" -fLC - --retry 3 --retry-delay 3 -o %o %u'
+          'https::/usr/bin/curl -qgb "" -fLC - --retry 3 --retry-delay 3 -o %o %u'
+          'rsync::/usr/bin/rsync --no-motd -z %u %o'
+          'scp::/usr/bin/scp -C %u %o')
+
+# Other common tools:
+# /usr/bin/snarf
+# /usr/bin/lftpget -c
+# /usr/bin/wget
+
+#-- The package required by makepkg to download VCS sources
+#  Format: 'protocol::package'
+VCSCLIENTS=('bzr::bzr'
+            'fossil::fossil'
+            'git::git'
+            'hg::mercurial'
+            'svn::subversion')
+
+#########################################################################
+# ARCHITECTURE, COMPILE FLAGS
+#########################################################################
+#
+CARCH="x86_64_v3"
+CHOST="x86_64-pc-linux-gnu"
+
+#-- Compiler and Linker Flags
+#CPPFLAGS=""
+CFLAGS="-march=x86-64-v3 -mtune=generic -O2 -pipe -fno-plt -fexceptions \
+        -Wp,-D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security \
+        -fstack-clash-protection -fcf-protection"
+CXXFLAGS="$CFLAGS -Wp,-D_GLIBCXX_ASSERTIONS"
+LDFLAGS="-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
+LTOFLAGS="-flto=auto"
+#RUSTFLAGS="-C opt-level=2"
+#-- Make Flags: change this for DistCC/SMP systems
+#MAKEFLAGS="-j2"
+#-- Debugging flags
+DEBUG_CFLAGS="-g"
+DEBUG_CXXFLAGS="$DEBUG_CFLAGS"
+#DEBUG_RUSTFLAGS="-C debuginfo=2"
+
+#########################################################################
+# BUILD ENVIRONMENT
+#########################################################################
+#
+# Makepkg defaults: BUILDENV=(!distcc !color !ccache check !sign)
+#  A negated environment option will do the opposite of the comments below.
+#
+#-- distcc:   Use the Distributed C/C++/ObjC compiler
+#-- color:    Colorize output messages
+#-- ccache:   Use ccache to cache compilation
+#-- check:    Run the check() function if present in the PKGBUILD
+#-- sign:     Generate PGP signature file
+#
+BUILDENV=(!distcc color !ccache check !sign)
+#
+#-- If using DistCC, your MAKEFLAGS will also need modification. In addition,
+#-- specify a space-delimited list of hosts running in the DistCC cluster.
+#DISTCC_HOSTS=""
+#
+#-- Specify a directory for package building.
+#BUILDDIR=/tmp/makepkg
+
+#########################################################################
+# GLOBAL PACKAGE OPTIONS
+#   These are default values for the options=() settings
+#########################################################################
+#
+# Makepkg defaults: OPTIONS=(!strip docs libtool staticlibs emptydirs !zipman !purge !debug !lto)
+#  A negated option will do the opposite of the comments below.
+#
+#-- strip:      Strip symbols from binaries/libraries
+#-- docs:       Save doc directories specified by DOC_DIRS
+#-- libtool:    Leave libtool (.la) files in packages
+#-- staticlibs: Leave static library (.a) files in packages
+#-- emptydirs:  Leave empty directories in packages
+#-- zipman:     Compress manual (man and info) pages in MAN_DIRS with gzip
+#-- purge:      Remove files specified by PURGE_TARGETS
+#-- debug:      Add debugging flags as specified in DEBUG_* variables
+#-- lto:        Add compile flags for building with link time optimization
+#
+OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)
+
+#-- File integrity checks to use. Valid: md5, sha1, sha224, sha256, sha384, sha512, b2
+INTEGRITY_CHECK=(sha256)
+#-- Options to be used when stripping binaries. See `man strip' for details.
+STRIP_BINARIES="--strip-all"
+#-- Options to be used when stripping shared libraries. See `man strip' for details.
+STRIP_SHARED="--strip-unneeded"
+#-- Options to be used when stripping static libraries. See `man strip' for details.
+STRIP_STATIC="--strip-debug"
+#-- Manual (man and info) directories to compress (if zipman is specified)
+MAN_DIRS=({usr{,/local}{,/share},opt/*}/{man,info})
+#-- Doc directories to remove (if !docs is specified)
+DOC_DIRS=(usr/{,local/}{,share/}{doc,gtk-doc} opt/*/{doc,gtk-doc})
+#-- Files to be removed from all packages (if purge is specified)
+PURGE_TARGETS=(usr/{,share}/info/dir .packlist *.pod)
+#-- Directory to store source code in for debug packages
+DBGSRCDIR="/usr/src/debug"
+
+#########################################################################
+# PACKAGE OUTPUT
+#########################################################################
+#
+# Default: put built package and cached source in build directory
+#
+#-- Destination: specify a fixed directory where all packages will be placed
+#PKGDEST=/home/packages
+#-- Source cache: specify a fixed directory where source files will be cached
+#SRCDEST=/home/sources
+#-- Source packages: specify a fixed directory where all src packages will be placed
+#SRCPKGDEST=/home/srcpackages
+#-- Log files: specify a fixed directory where all log files will be placed
+#LOGDEST=/home/makepkglogs
+#-- Packager: name/email of the person or organization building packages
+#PACKAGER="John Doe <john@doe.com>"
+#-- Specify a key to use for package signing
+#GPGKEY=""
+
+#########################################################################
+# COMPRESSION DEFAULTS
+#########################################################################
+#
+COMPRESSGZ=(gzip -c -f -n)
+COMPRESSBZ2=(bzip2 -c -f)
+COMPRESSXZ=(xz -c -z -)
+COMPRESSZST=(zstd -c -T0 --ultra -20 -)
+COMPRESSLRZ=(lrzip -q)
+COMPRESSLZO=(lzop -q)
+COMPRESSZ=(compress -c -f)
+COMPRESSLZ4=(lz4 -q)
+COMPRESSLZ=(lzip -c -f)
+
+#########################################################################
+# EXTENSION DEFAULTS
+#########################################################################
+#
+PKGEXT='.pkg.tar.zst'
+SRCEXT='.src.tar.gz'
+
+#########################################################################
+# OTHER
+#########################################################################
+#
+#-- Command used to run pacman as root, instead of trying sudo and su
+#PACMAN_AUTH=()
+# vim: set ft=sh ts=2 sw=2 et:

mkarchroot.in

@@ -81,11 +81,11 @@ for file in "${files[@]}"; do
 	cp "$file" "$working_dir$file"
 done
 
-pacstrap -${umode}Mcd ${pac_conf:+-C "$pac_conf"} "$working_dir" \
+unshare --mount pacstrap -${umode}Mcd ${pac_conf:+-C "$pac_conf"} "$working_dir" \
 	"${cache_dirs[@]/#/--cachedir=}" "$@" || die 'Failed to install all packages'
 
-printf '%s.UTF-8 UTF-8\n' en_US de_DE > "$working_dir/etc/locale.gen"
-echo 'LANG=en_US.UTF-8' > "$working_dir/etc/locale.conf"
+printf '%s.UTF-8 UTF-8\n' C en_US de_DE > "$working_dir/etc/locale.gen"
+echo 'LANG=C.UTF-8' > "$working_dir/etc/locale.conf"
 echo "$CHROOT_VERSION" > "$working_dir/.arch-chroot"
 
 systemd-machine-id-setup --root="$working_dir"

pacman-extra-x86_64_v3.conf

@@ -0,0 +1,92 @@
+#
+# /etc/pacman.conf
+#
+# See the pacman.conf(5) manpage for option and repository directives
+
+#
+# GENERAL OPTIONS
+#
+[options]
+# The following paths are commented out with their default values listed.
+# If you wish to use different paths, uncomment and update the paths.
+#RootDir     = /
+#DBPath      = /var/lib/pacman/
+#CacheDir    = /var/cache/pacman/pkg/
+#LogFile     = /var/log/pacman.log
+#GPGDir      = /etc/pacman.d/gnupg/
+#HookDir     = /etc/pacman.d/hooks/
+HoldPkg     = pacman glibc
+#XferCommand = /usr/bin/curl -L -C - -f -o %o %u
+#XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u
+#CleanMethod = KeepInstalled
+Architecture = x86_64_v3 x86_64
+
+# Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup
+#IgnorePkg   =
+#IgnoreGroup =
+
+#NoUpgrade   =
+#NoExtract   =
+
+# Misc options
+#UseSyslog
+#Color
+NoProgressBar
+# We cannot check disk space from within a chroot environment
+#CheckSpace
+VerbosePkgLists
+ParallelDownloads = 5
+
+# By default, pacman accepts packages signed by keys that its local keyring
+# trusts (see pacman-key and its man page), as well as unsigned packages.
+SigLevel    = Required DatabaseOptional
+LocalFileSigLevel = Optional
+#RemoteFileSigLevel = Required
+
+# NOTE: You must run `pacman-key --init` before first using pacman; the local
+# keyring can then be populated with the keys of all official Arch Linux
+# packagers with `pacman-key --populate archlinux`.
+
+#
+# REPOSITORIES
+#   - can be defined here or included from another file
+#   - pacman will search repositories in the order defined here
+#   - local/custom mirrors can be added here or in separate files
+#   - repositories listed first will take precedence when packages
+#     have identical names, regardless of version number
+#   - URLs will have $repo replaced by the name of the current repo
+#   - URLs will have $arch replaced by the name of the architecture
+#
+# Repository entries are of the format:
+#       [repo-name]
+#       Server = ServerName
+#       Include = IncludePath
+#
+# The header [repo-name] is crucial - it must be present and
+# uncommented to enable the repo.
+#
+
+# The testing repositories are disabled by default. To enable, uncomment the
+# repo name header and Include lines. You can add preferred servers immediately
+# after the header, and they will be used before the default mirrors.
+
+#[testing]
+#Include = /etc/pacman.d/mirrorlist
+
+[core]
+Include = /etc/pacman.d/mirrorlist
+
+[extra]
+Include = /etc/pacman.d/mirrorlist
+
+#[community-testing]
+#Include = /etc/pacman.d/mirrorlist
+
+[community]
+Include = /etc/pacman.d/mirrorlist
+
+# An example of a custom package repository.  See the pacman manpage for
+# tips on creating your own repositories.
+#[custom]
+#SigLevel = Optional TrustAll
+#Server = file:///home/custompkgs

pacman-staging-x86_64_v3.conf

@@ -0,0 +1,98 @@
+#
+# /etc/pacman.conf
+#
+# See the pacman.conf(5) manpage for option and repository directives
+
+#
+# GENERAL OPTIONS
+#
+[options]
+# The following paths are commented out with their default values listed.
+# If you wish to use different paths, uncomment and update the paths.
+#RootDir     = /
+#DBPath      = /var/lib/pacman/
+#CacheDir    = /var/cache/pacman/pkg/
+#LogFile     = /var/log/pacman.log
+#GPGDir      = /etc/pacman.d/gnupg/
+#HookDir     = /etc/pacman.d/hooks/
+HoldPkg     = pacman glibc
+#XferCommand = /usr/bin/curl -L -C - -f -o %o %u
+#XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u
+#CleanMethod = KeepInstalled
+Architecture = x86_64_v3 x86_64
+
+# Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup
+#IgnorePkg   =
+#IgnoreGroup =
+
+#NoUpgrade   =
+#NoExtract   =
+
+# Misc options
+#UseSyslog
+#Color
+NoProgressBar
+# We cannot check disk space from within a chroot environment
+#CheckSpace
+VerbosePkgLists
+ParallelDownloads = 5
+
+# By default, pacman accepts packages signed by keys that its local keyring
+# trusts (see pacman-key and its man page), as well as unsigned packages.
+SigLevel    = Required DatabaseOptional
+LocalFileSigLevel = Optional
+#RemoteFileSigLevel = Required
+
+# NOTE: You must run `pacman-key --init` before first using pacman; the local
+# keyring can then be populated with the keys of all official Arch Linux
+# packagers with `pacman-key --populate archlinux`.
+
+#
+# REPOSITORIES
+#   - can be defined here or included from another file
+#   - pacman will search repositories in the order defined here
+#   - local/custom mirrors can be added here or in separate files
+#   - repositories listed first will take precedence when packages
+#     have identical names, regardless of version number
+#   - URLs will have $repo replaced by the name of the current repo
+#   - URLs will have $arch replaced by the name of the architecture
+#
+# Repository entries are of the format:
+#       [repo-name]
+#       Server = ServerName
+#       Include = IncludePath
+#
+# The header [repo-name] is crucial - it must be present and
+# uncommented to enable the repo.
+#
+
+# The testing repositories are disabled by default. To enable, uncomment the
+# repo name header and Include lines. You can add preferred servers immediately
+# after the header, and they will be used before the default mirrors.
+
+[staging]
+Include = /etc/pacman.d/mirrorlist
+
+[testing]
+Include = /etc/pacman.d/mirrorlist
+
+[core]
+Include = /etc/pacman.d/mirrorlist
+
+[extra]
+Include = /etc/pacman.d/mirrorlist
+
+[community-staging]
+Include = /etc/pacman.d/mirrorlist
+
+[community-testing]
+Include = /etc/pacman.d/mirrorlist
+
+[community]
+Include = /etc/pacman.d/mirrorlist
+
+# An example of a custom package repository.  See the pacman manpage for
+# tips on creating your own repositories.
+#[custom]
+#SigLevel = Optional TrustAll
+#Server = file:///home/custompkgs

pacman-testing-x86_64_v3.conf

@@ -0,0 +1,92 @@
+#
+# /etc/pacman.conf
+#
+# See the pacman.conf(5) manpage for option and repository directives
+
+#
+# GENERAL OPTIONS
+#
+[options]
+# The following paths are commented out with their default values listed.
+# If you wish to use different paths, uncomment and update the paths.
+#RootDir     = /
+#DBPath      = /var/lib/pacman/
+#CacheDir    = /var/cache/pacman/pkg/
+#LogFile     = /var/log/pacman.log
+#GPGDir      = /etc/pacman.d/gnupg/
+#HookDir     = /etc/pacman.d/hooks/
+HoldPkg     = pacman glibc
+#XferCommand = /usr/bin/curl -L -C - -f -o %o %u
+#XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u
+#CleanMethod = KeepInstalled
+Architecture = x86_64_v3 x86_64
+
+# Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup
+#IgnorePkg   =
+#IgnoreGroup =
+
+#NoUpgrade   =
+#NoExtract   =
+
+# Misc options
+#UseSyslog
+#Color
+NoProgressBar
+# We cannot check disk space from within a chroot environment
+#CheckSpace
+VerbosePkgLists
+ParallelDownloads = 5
+
+# By default, pacman accepts packages signed by keys that its local keyring
+# trusts (see pacman-key and its man page), as well as unsigned packages.
+SigLevel    = Required DatabaseOptional
+LocalFileSigLevel = Optional
+#RemoteFileSigLevel = Required
+
+# NOTE: You must run `pacman-key --init` before first using pacman; the local
+# keyring can then be populated with the keys of all official Arch Linux
+# packagers with `pacman-key --populate archlinux`.
+
+#
+# REPOSITORIES
+#   - can be defined here or included from another file
+#   - pacman will search repositories in the order defined here
+#   - local/custom mirrors can be added here or in separate files
+#   - repositories listed first will take precedence when packages
+#     have identical names, regardless of version number
+#   - URLs will have $repo replaced by the name of the current repo
+#   - URLs will have $arch replaced by the name of the architecture
+#
+# Repository entries are of the format:
+#       [repo-name]
+#       Server = ServerName
+#       Include = IncludePath
+#
+# The header [repo-name] is crucial - it must be present and
+# uncommented to enable the repo.
+#
+
+# The testing repositories are disabled by default. To enable, uncomment the
+# repo name header and Include lines. You can add preferred servers immediately
+# after the header, and they will be used before the default mirrors.
+
+[testing]
+Include = /etc/pacman.d/mirrorlist
+
+[core]
+Include = /etc/pacman.d/mirrorlist
+
+[extra]
+Include = /etc/pacman.d/mirrorlist
+
+[community-testing]
+Include = /etc/pacman.d/mirrorlist
+
+[community]
+Include = /etc/pacman.d/mirrorlist
+
+# An example of a custom package repository.  See the pacman manpage for
+# tips on creating your own repositories.
+#[custom]
+#SigLevel = Optional TrustAll
+#Server = file:///home/custompkgs

setarch-aliases.d/x86_64_v3

@@ -0,0 +1 @@
+x86_64

sogrep.in

@@ -36,8 +36,11 @@ recache() {
             local dbpath=${SOCACHE_DIR}/${arch}/${repo}.links.tar.gz
             mkdir -p "${dbpath%/*}"
             (( VERBOSE )) && echo "Fetching ${repo}.links.tar.gz..."
-            curl -LR "${verbosity}" -o "${dbpath}" -z "${dbpath}" \
-                "${SOLINKS_MIRROR}/${repo}/os/${arch}/${repo}.links.tar.gz"
+            if ! curl -fLR "${verbosity}" -o "${dbpath}" -z "${dbpath}" \
+                    "${SOLINKS_MIRROR}/${repo}/os/${arch}/${repo}.links.tar.gz"; then
+                echo "error: failed to download links database for repo ${repo}"
+                exit 1
+            fi
         done
     done
 }

zsh_completion.in

@@ -1,4 +1,4 @@
-#compdef archbuild archco arch-nspawn archrelease commitpkg finddeps makechrootpkg mkarchroot rebuildpkgs extrapkg=commitpkg corepkg=commitpkg testingpkg=commitpkg stagingpkg=commitpkg communitypkg=commitpkg community-testingpkg=commitpkg community-stagingpkg=commitpkg multilibpkg=commitpkg multilib-testingpkg=commitpkg extra-x86_64-build=archbuild testing-x86_64-build=archbuild staging-x86_64-build=archbuild multilib-build=archbuild multilib-testing-build=archbuild multilib-staging-build=archbuild kde-unstable-x86_64-build=archbuild gnome-unstable-x86_64-build=archbuild communityco=archco checkpkg sogrep offload-build makerepropkg
+#compdef archbuild archco arch-nspawn archrelease commitpkg diffpkg finddeps makechrootpkg mkarchroot rebuildpkgs extrapkg=commitpkg corepkg=commitpkg testingpkg=commitpkg stagingpkg=commitpkg communitypkg=commitpkg community-testingpkg=commitpkg community-stagingpkg=commitpkg multilibpkg=commitpkg multilib-testingpkg=commitpkg extra-x86_64-build=archbuild testing-x86_64-build=archbuild staging-x86_64-build=archbuild multilib-build=archbuild multilib-testing-build=archbuild multilib-staging-build=archbuild kde-unstable-x86_64-build=archbuild gnome-unstable-x86_64-build=archbuild communityco=archco checkpkg sogrep offload-build makerepropkg
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 
@@ -41,6 +41,17 @@ _commitpkg_args=(
 	'1:commit_msg'
 )
 
+_diffpkg_args=(
+	'(-l --list)'{-l,--list}'[Tar content list diff mode]'
+	'(-d --diffoscope)'{-d,--diffoscope}'[Diffoscope diff mode]'
+	'(-p --pkginfo)'{-p,--pkginfo}'[.PKGINFO diff mode]'
+	'(-b --buildinfo)'{-b,--buildinfo}'[.BUILDINFO diff mode]'
+	'(-m --makepkg-config)'{-m,--makepkg-config}'[Location of a makepkg config file]:makepkg_config:_files -g "*.conf(.)"'
+	'(-v --verbose)'{-v,--verbose}'[Provide more detailed/unfiltered output]'
+	'(-h --help)'{-h,--help}'[Display usage]'
+	'*:packages:_devtools_completions_all_packages'
+)
+
 _finddeps_args=(
 	'1:packages:_devtools_completions_all_packages'
 )
@@ -77,6 +88,7 @@ _rebuildpkgs_args=(
 _checkpkg_args=(
 	'(-r --rmdir)'{-r,--rmdir}'[Remove the temporary directory]'
 	'(-w --warn)'{-w,--warn}'[Print a warning in case of differences]'
+	'(-M --makepkg-config)'{-M,--makepkg-config}'[Location of a makepkg config file]:makepkg_config:_files -g "*.conf(.)"'
 	'(-h --help)'{-h,--help}'[Display usage]'
 )