feat(version): Disallow using the "cmd" source for nvchecker

The [cmd](https://nvchecker.readthedocs.io/en/latest/usage.html#find-with-a-command)
source allows nvchecker to use a shell command line to get versions.
Using this source within `.nvchecker.toml` would result in `pkgctl
version {check,upgrade}` to run arbitrary commands which isn't
desirable, as it can lead to various issues (e.g. missing packages /
dependencies to run said commands or even executing malicious commands
in hypothetical worst case scenarios)

Component: pkgctl version check
Signed-off-by: Levente Polyak <anthraxx@archlinux.org>

.gitlab-ci.yml

@@ -24,7 +24,7 @@ test:
   stage: test
   needs: []
   script:
-    - pacman -Syu --noconfirm m4 make openssh subversion rsync arch-install-scripts git bzr mercurial diffutils coreutils asciidoctor shellcheck nvchecker bats bats-assert bats-support
+    - pacman -Syu --noconfirm m4 make openssh subversion rsync arch-install-scripts git bzr mercurial diffutils coreutils asciidoctor shellcheck nvchecker bats
     - make test BATS_EXTRA_ARGS='--formatter junit'
   artifacts:
     reports:
@@ -34,7 +34,7 @@ coverage:
   stage: test
   needs: []
   script:
-    - pacman -Syu --noconfirm m4 make openssh subversion rsync arch-install-scripts git bzr mercurial diffutils coreutils asciidoctor shellcheck nvchecker bats bats-assert bats-support kcov jq
+    - pacman -Syu --noconfirm m4 make openssh subversion rsync arch-install-scripts git bzr mercurial diffutils coreutils asciidoctor shellcheck nvchecker bats kcov jq
     - make coverage
   coverage: '/Percent covered\s+\d+\.\d+/'
   artifacts:

doc/man/pkgctl-auth.1.asciidoc

@@ -3,7 +3,7 @@ pkgctl-auth(1)
 
 Name
 ----
-pkgctl-auth - Authenticate with serivces like GitLab.
+pkgctl-auth - Authenticate with services like GitLab.
 
 Synopsis
 --------

doc/man/pkgctl-version.1.asciidoc

@@ -39,6 +39,17 @@ placed in the `$XDG_CONFIG_HOME`/nvchecker` directory. This keyfile is
 used for providing the necessary authentication tokens required for
 accessing the GitHub or GitLab API.
 
+Combiner Source
+---------------
+
+To utilize the combiner source, the `pkgbase` section must be declared as the
+combiner source. Additionally, individual sections should be added using a
+quoted table key consisting of the `pkgbase` followed by the stage name,
+separated by double colons. For example: `["sudo:stage1"]`.
+
+This allows to chain different sources together into one result, or allow
+multi stage transformation of our source via multiple regex.
+
 Options
 -------
 

doc/man/pkgctl.1.asciidoc

@@ -49,6 +49,9 @@ pkgctl diff::
 pkgctl issue::
 	Work with GitLab packaging issues
 
+pkgctl license::
+	Check and manage package licenses
+
 pkgctl release::
 	Release step to commit, tag and upload build artifacts
 
@@ -70,6 +73,7 @@ pkgctl-build(1)
 pkgctl-db(1)
 pkgctl-diff(1)
 pkgctl-issue(1)
+pkgctl-license(1)
 pkgctl-release(1)
 pkgctl-repo(1)
 pkgctl-search(1)

src/lib/common.sh

@@ -54,7 +54,8 @@ export RSYNC_OPTS=(
   --human-readable
   --progress
   --partial
-  --partial-dir=.partial
+  # suffix the partial dir with the PID in order to avoid clashes
+  --partial-dir=.partial.$$
   --delay-updates
 )
 
@@ -441,3 +442,10 @@ relative_date_unit() {
 	done
 	printf "1 second"
 }
+
+
+# escapes regex metacharacters in a given string
+regex_escape() {
+	# shellcheck disable=SC2001,SC2016
+	sed 's/[\^.\[$()|*+?{\\]/\\&/g' <<<"$1"
+}

src/lib/license/check.sh

@@ -94,19 +94,19 @@ pkgctl_license_check() {
 		pushd "${path}" >/dev/null
 
 		if [[ ! -f PKGBUILD ]]; then
-			msg_error "${BOLD}${pkgbase}:${ALL_OFF} no PKGBUILD found"
+			msg_error "${BOLD}${path}:${ALL_OFF} no PKGBUILD found"
 			return 1
 		fi
 
-		# reset common PKGBUILD variables
+		if [[ ! -f .SRCINFO ]]; then
-		unset pkgbase
+			msg_error "${BOLD}${path}:${ALL_OFF} no .SRCINFO found"
-
+			return 1
-		# shellcheck source=contrib/makepkg/PKGBUILD.proto
+		fi
-		if ! . ./PKGBUILD; then
+
-			msg_error "${BOLD}${pkgbase}:${ALL_OFF} failed to source PKGBUILD"
+		if ! pkgbase=$(grep --max-count=1 --extended-regexp "pkgbase = (.+)" .SRCINFO | awk '{print $3}'); then
+			msg_error "${BOLD}${path}:${ALL_OFF} pkgbase not found in .SRCINFO"
 			return 1
 		fi
-		pkgbase=${pkgbase:-$pkgname}
 
 		if [[ ! -e LICENSE ]]; then
 			msg_error "${BOLD}${pkgbase}:${ALL_OFF} is missing the LICENSE file"

src/lib/license/setup.sh

@@ -188,6 +188,7 @@ path = [
     "README.md",
     "keys/**",
     ".SRCINFO",
+    ".gitignore",
     ".nvchecker.toml",
     "*.install",
     "*.sysusers",

src/lib/repo/configure.sh

@@ -109,11 +109,6 @@ pkgctl_repo_configure() {
 	local -r command=${_DEVTOOLS_COMMAND:-${BASH_SOURCE[0]##*/}}
 	local path realpath pkgbase remote_url project_path hook
 	local PACKAGER GPGKEY packager_name packager_email
-	
-	# Check if we're in a git repo
-	if ! git rev-parse --git-dir &>/dev/null; then
-		die "Not in a git repository"
-	fi
 
 	while (( $# )); do
 		case $1 in
@@ -155,8 +150,7 @@ pkgctl_repo_configure() {
 
 	# check if invoked without any path from within a packaging repo
 	if (( ${#paths[@]} == 0 )); then
-		if [[ -d .git ]] || git rev-parse --git-dir &>/dev/null; then
+		if [[ -f PKGBUILD ]]; then
-			# We're in a git repository, so use current directory
 			paths=(".")
 		else
 			pkgctl_repo_configure_usage
@@ -232,19 +226,10 @@ pkgctl_repo_configure() {
 
 		pushd "${path}" >/dev/null
 
-		# Check if this is a packaging repository
+		project_path=$(gitlab_project_name_to_path "${pkgbase}")
-		local is_packaging_repo=0
+		remote_url="${GIT_REPO_BASE_URL}/${project_path}.git"
-		if [[ -f PKGBUILD ]]; then
+		if ! git remote add origin "${remote_url}" &>/dev/null; then
-			is_packaging_repo=1
+			git remote set-url origin "${remote_url}"
-		fi
-
-		# Configure remote only for packaging repositories
-		if (( is_packaging_repo )); then
-			project_path=$(gitlab_project_name_to_path "${pkgbase}")
-			remote_url="${GIT_REPO_BASE_URL}/${project_path}.git"
-			if ! git remote add origin "${remote_url}" &>/dev/null; then
-				git remote set-url origin "${remote_url}"
-			fi
 		fi
 
 		# move the master branch to main
@@ -254,7 +239,7 @@ pkgctl_repo_configure() {
 		fi
 
 		# configure spec version and variant to avoid using development hooks in production
-		git config devtools.version "${GIT_REPO_SPEC_VERSION:-1.0.0}"
+		git config devtools.version "${GIT_REPO_SPEC_VERSION}"
 		if [[ ${_DEVTOOLS_LIBRARY_DIR} == /usr/share/devtools ]]; then
 			git config devtools.variant canonical
 		else
@@ -264,12 +249,8 @@ pkgctl_repo_configure() {
 
 		git config pull.rebase true
 		git config branch.autoSetupRebase always
-		
+		git config branch.main.remote origin
-		# Configure branch remote settings only for packaging repositories with remotes
+		git config branch.main.rebase true
-		if (( is_packaging_repo )) && git remote | grep -q "^origin$"; then
-			git config branch.main.remote origin
-			git config branch.main.rebase true
-		fi
 
 		git config transfer.fsckobjects true
 		git config fetch.fsckobjects true

src/lib/util/pkgbuild.sh

@@ -6,6 +6,8 @@
 DEVTOOLS_INCLUDE_UTIL_PKGBUILD_SH=1
 
 _DEVTOOLS_LIBRARY_DIR=${_DEVTOOLS_LIBRARY_DIR:-@pkgdatadir@}
+# shellcheck source=src/lib/common.sh
+source "${_DEVTOOLS_LIBRARY_DIR}"/lib/common.sh
 # shellcheck source=src/lib/util/makepkg.sh
 source "${_DEVTOOLS_LIBRARY_DIR}"/lib/util/makepkg.sh
 
@@ -21,6 +23,8 @@ pkgbuild_set_pkgver() {
 	local new_pkgver=$1
 	local pkgver=${pkgver}
 
+	pkgver="$(regex_escape "${pkgver}")"
+
 	if [[ $(type -t pkgver) == function ]]; then
 		# TODO: check if die or warn, if we provide _commit _gitcommit setter maybe?
 		warning 'setting pkgver variable has no effect if the PKGBUILD has a pkgver() function'

src/lib/version/check.sh

@@ -304,6 +304,11 @@ get_upstream_version() {
 		return 1
 	fi
 
+	if ! output=$(jq --raw-output --exit-status 'select(.name == "'"${pkgbase}"'")' <<< "${output}"); then
+		printf "failed to select pkgbase result from output"
+		return 1
+	fi
+
 	if ! upstream_version=$(jq --raw-output --exit-status '.version' <<< "${output}"); then
 		printf "failed to select version from result"
 		return 1
@@ -346,10 +351,16 @@ nvchecker_check_config() {
 	fi
 
 	# check if the config contains any section other than pkgbase
-	if [[ -n ${pkgbase} ]] && property=$(grep --max-count=1 --perl-regexp "^\\[(?!\"?${pkgbase//+/\\+}\"?\\]).+\\]" < "${config}"); then
+	if [[ -n ${pkgbase} ]] && property=$(grep --max-count=1 --perl-regexp "^\\[(?!\"?${pkgbase//+/\\+}(:.+)?\"?\\]).+\\]" < "${config}"); then
 		printf "non-pkgbase section not supported in %s: %s" "${config}" "${property}"
 		return 1
 	fi
+
+	# check if the config is using the 'cmd' source
+	if grep --extended-regexp --quiet '^\s*source\s*=\s*["'\'']cmd["'\''].*' "${config}"; then
+		printf "using the 'cmd' source in %s is disallowed" "${config}"
+		return 1
+	fi
 }
 
 nvchecker_check_error() {

test/case/repo-configure.bats

@@ -1,71 +0,0 @@
-#!/usr/bin/env bats
-bats_require_minimum_version 1.5.0
-
-# Load bats libraries
-load "/usr/lib/bats/bats-support/load.bash"
-load "/usr/lib/bats/bats-assert/load.bash"
-
-export _DEVTOOLS_LIBRARY_DIR="${PWD}/src"
-
-_pkgctl_repo_configure() {
-	source "${_DEVTOOLS_LIBRARY_DIR}"/lib/repo/configure.sh
-	pkgctl_repo_configure "$@"
-}
-
-@test "repo-configure-valid-packaging" {
-	local tmpdir
-	tmpdir=$(mktemp -dt devtools.test.repo-configure.XXXXXX)
-	pushd "${tmpdir}"
-	git init
-	git remote add origin "https://gitlab.archlinux.org/archlinux/packaging/packages/devtools.git"
-	run _pkgctl_repo_configure
-	assert_success
-	popd
-	rm -rf "${tmpdir}"
-}
-
-@test "repo-configure-non-packaging" {
-	local tmpdir
-	tmpdir=$(mktemp -dt devtools.test.repo-configure.XXXXXX)
-	pushd "${tmpdir}"
-	git init
-	git remote add origin "https://gitlab.com/kicad/libraries/kicad-packages3D.git"
-	run _pkgctl_repo_configure
-	assert_success
-	popd
-	rm -rf "${tmpdir}"
-}
-
-@test "repo-configure-non-arch" {
-	local tmpdir
-	tmpdir=$(mktemp -dt devtools.test.repo-configure.XXXXXX)
-	pushd "${tmpdir}"
-	git init
-	git remote add origin "https://github.com/torvalds/linux.git"
-	run _pkgctl_repo_configure
-	assert_success
-	popd
-	rm -rf "${tmpdir}"
-}
-
-@test "repo-configure-no-git" {
-	local tmpdir
-	tmpdir=$(mktemp -dt devtools.test.repo-configure.XXXXXX)
-	pushd "${tmpdir}"
-	run ! _pkgctl_repo_configure
-	assert_failure
-	assert_output --partial "Not in a git repository"
-	popd
-	rm -rf "${tmpdir}"
-}
-
-@test "repo-configure-local-git" {
-	local tmpdir
-	tmpdir=$(mktemp -dt devtools.test.repo-configure.XXXXXX)
-	pushd "${tmpdir}"
-	git init
-	run _pkgctl_repo_configure
-	assert_success
-	popd
-	rm -rf "${tmpdir}"
-}