Compare commits

..

2 Commits

Author SHA1 Message Date
Robin Candau
4c6e9c037b Merge branch 'exit_on_nvchecker_cmd_source' into 'master'
fix(version): Fail if the 'cmd' source is used in .nvchecker.toml

See merge request archlinux/devtools!295
2025-08-11 01:04:48 +02:00
Robin Candau
cfb99fd2d8 fix(version): Fail if the 'cmd' source is used in .nvchecker.toml
The [cmd](https://nvchecker.readthedocs.io/en/latest/usage.html#find-with-a-command) source allows nvchecker to use a shell command line to get versions. Using this source within `.nvchecker.toml` would result in `pkgctl version {check,upgrade}` to run arbitrary commands which isn't desirable, as it can lead to various issues (e.g. missing packages / dependencies to run said commands or even executing malicious commands in hypothetical worst case scenarios)
2025-01-04 12:25:32 +01:00
6 changed files with 27 additions and 34 deletions

View File

@@ -14,7 +14,7 @@ Description
Build a PKGBUILD on a remote server using makechrootpkg. Requires a remote user
that can run archbuild in a non-interactive manner, e.g. must be able to
elevate permissions using passwordless run0.
elevate permissions using passwordless sudo.
Options
-------

View File

@@ -3,7 +3,7 @@ pkgctl-auth(1)
Name
----
pkgctl-auth - Authenticate with services like GitLab.
pkgctl-auth - Authenticate with serivces like GitLab.
Synopsis
--------

View File

@@ -15,11 +15,7 @@ check_root() {
local orig_argv=("$@")
(( EUID == 0 )) && return
if type -P run0 >/dev/null; then
keepenv=",$keepenv"
command="run0 ${keepenv//,/ --setenv=}"
exec ${command} -- "${orig_argv[@]}"
elif type -P sudo >/dev/null; then
if type -P sudo >/dev/null; then
exec sudo --preserve-env="${keepenv}" -- "${orig_argv[@]}"
else
exec su root -c "$(printf ' %q' "${orig_argv[@]}")"

View File

@@ -350,6 +350,12 @@ nvchecker_check_config() {
printf "non-pkgbase section not supported in %s: %s" "${config}" "${property}"
return 1
fi
# check if the config is using the 'cmd' source
if grep --extended-regexp --quiet '^\s*source\s*=\s*["'\'']cmd["'\'']\s*$' "${config}"; then
printf "using the 'cmd' source in %s is disallowed" "${config}"
return 1
fi
}
nvchecker_check_error() {

View File

@@ -185,18 +185,10 @@ prepare_chroot() {
echo "$x" >>"$copydir/etc/makepkg.conf"
done
# TODO(gromit): check if this rule is sane
# TODO(gromit): this will require a full container
cat > "$copydir/etc/polkit-1/rules.d/10-systemd-nopasswd.rules" <<EOF
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units") {
if (subject.isInGroup("wheel")) {
return polkit.Result.YES;
}
}
});
cat > "$copydir/etc/sudoers.d/builduser-pacman" <<EOF
builduser ALL = NOPASSWD: /usr/bin/pacman
EOF
chmod 440 "$copydir/etc/polkit-1/rules.d/10-systemd-nopasswd.rules"
chmod 440 "$copydir/etc/sudoers.d/builduser-pacman"
cat > "$copydir/etc/gitconfig" <<EOF
[safe]
@@ -230,14 +222,17 @@ _chrootbuild() {
# shellcheck source=/dev/null
. /etc/profile
run0 --setenv=SOURCE_DATE_EPOCH \
--setenv=BUILDTOOL \
--setenv=BUILDTOOLVER \
--via-shell --chdir='~' \
--user=builduser -- bash -c 'cd /startdir; makepkg "$@"' -bash "$@"
# Beware, there are some stupid arbitrary rules on how you can
# use "$" in arguments to commands with "sudo -i". ${foo} or
# ${1} is OK, but $foo or $1 isn't.
# https://bugzilla.sudo.ws/show_bug.cgi?id=765
sudo --preserve-env=SOURCE_DATE_EPOCH \
--preserve-env=BUILDTOOL \
--preserve-env=BUILDTOOLVER \
-iu builduser bash -c 'cd /startdir; makepkg "$@"' -bash "$@"
ret=$?
case $ret in
0)
0|14)
return 0;;
*)
return $ret;;
@@ -248,7 +243,7 @@ _chrootnamcap() {
pacman -S --needed --noconfirm namcap
for pkgfile in /startdir/PKGBUILD /pkgdest/*; do
echo "Checking ${pkgfile##*/}"
run0 --user=builduser -- namcap "$pkgfile" 2>&1 | tee "/logdest/${pkgfile##*/}-namcap.log"
sudo -u builduser namcap "$pkgfile" 2>&1 | tee "/logdest/${pkgfile##*/}-namcap.log"
done
}
@@ -257,12 +252,8 @@ download_sources() {
chown "$makepkg_user:" "$WORKDIR"
# Ensure sources are downloaded
run0 --user="$makepkg_user" \
--setenv=GNUPGHOME \
--setenv=SSH_AUTH_SOCK \
--setenv=SRCDEST="$SRCDEST" \
--setenv=BUILDDIR="$WORKDIR" \
--chdir=. -- \
sudo -u "$makepkg_user" --preserve-env=GNUPGHOME,SSH_AUTH_SOCK \
env SRCDEST="$SRCDEST" BUILDDIR="$WORKDIR" \
makepkg --config="$copydir/etc/makepkg.conf" --verifysource -o "${verifysource_args[@]}" ||
die "Could not download sources."
}
@@ -409,7 +400,7 @@ if arch-nspawn "$copydir" \
"${nspawn_build_args[@]}" \
/chrootbuild "${makepkg_args[@]}"
then
mapfile -t pkgnames < <(run0 --user="$makepkg_user" -- bash -c 'source PKGBUILD; printf "%s\n" "${pkgname[@]}"')
mapfile -t pkgnames < <(sudo -u "$makepkg_user" bash -c 'source PKGBUILD; printf "%s\n" "${pkgname[@]}"')
move_products
else
(( ret += 1 ))
@@ -462,7 +453,7 @@ else
done
msg2 "Checking packages"
run0 --user="$makepkg_user" -- checkpkg --rmdir --warn --makepkg-config "$copydir/etc/makepkg.conf" "${remotepkgs[@]/#file:\/\//}"
sudo -u "$makepkg_user" checkpkg --rmdir --warn --makepkg-config "$copydir/etc/makepkg.conf" "${remotepkgs[@]/#file:\/\//}"
fi
true
fi

View File

@@ -192,7 +192,7 @@ for p in "$@"; do
pkgfile=${pkgfile_remote#file://}
if [[ ! -f ${pkgfile} ]]; then
msg "Downloading package '%s' into pacman's cache" "${pkgfile}"
run0 -- pacman -Swdd --noconfirm --logfile /dev/null "${p}" || exit 1
sudo pacman -Swdd --noconfirm --logfile /dev/null "${p}" || exit 1
pkgfile_remote=$(pacman -Sddp "${p}" 2>/dev/null)
pkgfile="${pkgfile_remote#file://}"
fi