| index : pacman | |
| Archlinux32 fork of pacman | gitolite user |
| summaryrefslogtreecommitdiff |
| Age | Commit message (Collapse) | Author | |
|---|---|---|---|
| 2017-09-13 | libmakepkg: check for invalid tags in git | Eli Schwartz | |
| As per https://lists.archlinux.org/pipermail/arch-general/2017-July/043876.html git doesn't check that the tag name matches what an annotated tag object *thinks* it should be called. This is a bit of a theoretical attack and some would argue that we should always use commits since upstream can legitimately change a tag, but nevertheless this can result in a downgrade attack if the git download transport was manipulated or the upstream repository hacked. So, check the tag blob to make sure the tag actually matches the name we used for `git checkout`. This really should be fixed in git itself, rather than forcing all downstream users of git verify-tag to implement their own checks, but the git developers disagree, see the discussion surrounding https://public-inbox.org/git/xmqqk2hzldx8.fsf@gitster.mtv.corp.google.com/ Signed-off-by: Eli Schwartz <eschwartz@archlinux.org> Signed-off-by: Allan McRae <allan@archlinux.org> | |||
| 2017-01-04 | makepkg: Verify git signatures | Eli Schwartz | |
| A git repository is marked as signed if it contains the query "signed" as defined by https://tools.ietf.org/html/rfc3986 Adds two utility functions in util/source.sh.in to extract fragments and queries, and modifies source/git.sh.in to use them. Signed-off-by: Eli Schwartz <eschwartz93@gmail.com> Signed-off-by: Allan McRae <allan@archlinux.org> | |||
| 2017-01-04 | Update copyright years | Allan McRae | |
| Signed-off-by: Allan McRae <allan@archlinux.org> | |||
| 2016-01-04 | Update copyright years for 2016 | Allan McRae | |
| make update-copyright OLD=2015 NEW=2016 Signed-off-by: Allan McRae <allan@archlinux.org> | |||
| 2015-05-19 | libmakepkg: extract functions for source download and extraction | Allan McRae | |
| Signed-off-by: Allan McRae <allan@archlinux.org> | |||