Merge branch 'exit_on_nvchecker_cmd_source' into 'master'

fix(version): Fail if the 'cmd' source is used in .nvchecker.toml See merge request archlinux/devtools!295
fix(license): add .gitignore to REUSE defaults
2025-09-13 01:46:19 +02:00 · 2025-08-11 01:04:48 +02:00 · 2025-08-08 14:13:32 +02:00 · 2025-08-05 17:48:12 +02:00 · 2025-08-01 11:26:57 +02:00 · 2025-07-28 23:38:32 -04:00
4 changed files with 11 additions and 1 deletions
--- a/contrib/completion/bash/devtools.in
+++ b/contrib/completion/bash/devtools.in
@@ -150,6 +150,7 @@ _pkgctl_cmds=(
 	db
 	diff
 	issue
+	license
 	release
 	repo
 	search
--- a/src/commitpkg.in
+++ b/src/commitpkg.in
@@ -155,7 +155,7 @@ if (( ${#needsversioning[*]} )); then
 		if [[ ! -f "${file}" ]]; then
 			continue
 		fi
-		if ! git ls-files --error-unmatch "$file"; then
+		if ! git ls-files --error-unmatch "$file" >/dev/null; then
 			die "%s is not under version control" "$file"
 		fi
 	done
--- a/src/lib/license/setup.sh
+++ b/src/lib/license/setup.sh
@@ -188,10 +188,13 @@ path = [
    "README.md",
    "keys/**",
    ".SRCINFO",
+    ".gitignore",
    ".nvchecker.toml",
    "*.install",
    "*.sysusers",
+    "*sysusers.conf",
    "*.tmpfiles",
+    "*tmpfiles.conf",
    "*.logrotate",
    "*.pam",
    "*.service",
--- a/src/lib/version/check.sh
+++ b/src/lib/version/check.sh
@@ -350,6 +350,12 @@ nvchecker_check_config() {
 		printf "non-pkgbase section not supported in %s: %s" "${config}" "${property}"
 		return 1
 	fi
+
+	# check if the config is using the 'cmd' source
+	if grep --extended-regexp --quiet '^\s*source\s*=\s*["'\'']cmd["'\'']\s*$' "${config}"; then
+		printf "using the 'cmd' source in %s is disallowed" "${config}"
+		return 1
+	fi
 }

 nvchecker_check_error() {
Author	SHA1	Message	Date
Robin Candau	4c6e9c037b	Merge branch 'exit_on_nvchecker_cmd_source' into 'master' fix(version): Fail if the 'cmd' source is used in .nvchecker.toml See merge request archlinux/devtools!295	2025-08-11 01:04:48 +02:00
Aaron Liu	3f0ebbc6d2	fix(license): add .gitignore to REUSE defaults 36 packages use this while 26 use .pam and 21 use .logrotate. Seems anecdotally common enough to add this here.	2025-08-08 14:13:32 +02:00
Jakub Klinkovský	fc56ebedf3	fix(completion): fix bash completion for the license subcommand Signed-off-by: Jakub Klinkovský <lahwaacz@archlinux.org>	2025-08-05 17:48:12 +02:00
Christian Heusel	01757e6904	fix(commitpkg): Quiet git ls-files output So far all files in `needsversioning=(...)` have been printed to the command line if they were found, which is not useful, especially now that we have more files present there. It makes sense however to keep the standard error output, as this gives a actionable suggestion what one should to to fix the issue: > error: pathspec 'PKGBUILD' did not match any file(s) known to git > Did you forget to 'git add'? Fixes #281 Signed-off-by: Christian Heusel <christian@heusel.eu>	2025-08-01 11:26:57 +02:00
Daniel M. Capella	c5fe8ff3e6	feat(license): Extend matches for sysusers/tmpfiles configs Eg. to match: - sysusers.conf - $pkgname.sysusers - $pkgname.sysusers.conf	2025-07-28 23:38:32 -04:00
Robin Candau	cfb99fd2d8	fix(version): Fail if the 'cmd' source is used in .nvchecker.toml The [cmd](https://nvchecker.readthedocs.io/en/latest/usage.html#find-with-a-command) source allows nvchecker to use a shell command line to get versions. Using this source within `.nvchecker.toml` would result in `pkgctl version {check,upgrade}` to run arbitrary commands which isn't desirable, as it can lead to various issues (e.g. missing packages / dependencies to run said commands or even executing malicious commands in hypothetical worst case scenarios)	2025-01-04 12:25:32 +01:00