Remove backslash typo from makepkg man page

Signed-off-by: Eric Bélanger <snowmaniscool@gmail.com>
Signed-off-by: Dan McGee <dan@archlinux.org>
Restrict pkgname from starting with a dot.

Adding this restriction means we can filter any FILENAME entry from
starting with a "/" or a ".".  Use the term "dot" as it is more
computing relevant compared to "full stop" or "period" which vary
depending on English locale.

Signed-off-by: Allan McRae <allan@archlinux.org>
validate %FILEPATH% when parsing repo dbs

Currently we make no effort to validate the %FILENAME% field in the
repo db. This allows for relative paths to be considered valid.

A carefully crafted db entry with a malicious relative path,
(e.g. `../../../../etc/passwd`) will cause pacman to to
overwrite _any_ file on the target's machine.

Add the following validation:

- doesn't start with '.'
- doesn't contain a '/'
- won't overflow PATH_MAX

Signed-off-by: Simon Gomizelj <simongmzlj@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
pacman-key: Do not reinterpret keys from revoked keyrings

Given a revoked keyring containing only:

  BC1FBE4D2826A0B51E47ED62E2539214C6C11350

We should only disable this specific keyid. This change enforces that the
contents of the -revoked keyring file are full fingerprints which can uniquely
identify a key.

Before:

  # pacman-key --populate archlinux
  ==> Appending keys from archlinux.gpg...
  ==> Locally signing trusted keys in keyring...
    -> Locally signing key 0E8B644079F599DFC1DDC3973348882F6AC6A4C2...
    -> Locally signing key 684148BB25B49E986A4944C55184252D824B18E8...
    -> Locally signing key 44D4A033AC140143927397D47EFD567D4C7EA887...
    -> Locally signing key 27FFC4769E19F096D41D9265A04F9397CDFD6BB0...
    -> Locally signing key AB19265E5D7D20687D303246BA1DFB64FFF979E7...
  ==> Importing owner trust values...
  ==> Disabling revoked keys in keyring...
    -> Disabling key 1390420191...
    -> Disabling key E2539214C6C11350...
    -> Disabling key 8544EA82113502DE...
  ==> Updating trust database...
  gpg: next trustdb check due at 2014-01-22

After:

  # pacman-key --populate archlinux
  ==> Appending keys from archlinux.gpg...
  ==> Locally signing trusted keys in keyring...
    -> Locally signing key 0E8B644079F599DFC1DDC3973348882F6AC6A4C2...
    -> Locally signing key 684148BB25B49E986A4944C55184252D824B18E8...
    -> Locally signing key 44D4A033AC140143927397D47EFD567D4C7EA887...
    -> Locally signing key 27FFC4769E19F096D41D9265A04F9397CDFD6BB0...
    -> Locally signing key AB19265E5D7D20687D303246BA1DFB64FFF979E7...
  ==> Importing owner trust values...
  ==> Disabling revoked keys in keyring...
    -> Disabling key BC1FBE4D2826A0B51E47ED62E2539214C6C11350...
  ==> Updating trust database...
  gpg: next trustdb check due at 2014-01-22

Partially addresses FS#35478. This does nothing to confirm whether or not the
key was successfully disabled -- a ridiculously simple request which appears to
be far too difficult for gpg to manage.

Signed-off-by: Dave Reisner <dreisner@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
Pull translation updates and regenerate

Signed-off-by: Allan McRae <allan@archlinux.org>
Merge branch 'maint'
die if '-' is given with empty stdin

Several operations default to all packages/repos/etc if no targets are
provided.  If a user provides '-' they almost certainly expect there to
be targets on stdin and will be surprised if pacman falls back to the
default because there are none.

Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
Document alpm_list files are to be stand alone

Signed-off-by: Allan McRae <allan@archlinux.org>
repo-add; add option to remove existing package files from disk

When maintaining a custom repo, often it is undesirable to retain older
versions of packages. This patch adds the --remove option to remove the
current package file and it's signature from disk before adding the new
one to the database. Documentation is also updated. This is an optional
flag and default behaviour (leaving ondisk files alone) is not changed.

Signed-off-by: Phillip Smith <fukawi2@gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
paccache: make --help output look nice on 80 width terminal

Signed-off-by: Allan McRae <allan@archlinux.org>
Correct INODECMD for BSD and Darwin

Fixes FS#35469.

Signed-off-by: Allan McRae <allan@archlinux.org>
makepkg: fix typo for distcc test

Introduced in commit 9dd42dc0.  Fixes FS#35741.

Signed-off-by: Allan McRae <allan@archlinux.org>
contrib/checkupdates: fix typo

Signed-off-by: Allan McRae <allan@archlinux.org>
checkupdates: Consistency in environmental variable name

Use CHECKUPDATES_DB rather than CHECKUPDATE_DB for consistency with the
script name.

Signed-off-by: Allan McRae <allan@archlinux.org>
pacscripts: don't read the whole package from cache

'-q' means "Exit as soon as each specified pattern or filename has
been matched." There is no reason to keep reading the whole package
from the cache when the install script has already been printed to
stdout.

Signed-off-by: Karol Błażewicz <karol.blazewicz at gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
pacscripts: Update for pacman changes

Changes to pacman mean that -Sp can be called without root permissions
and '-d' needs passed twice to completely ignore dependencies.

Signed-off-by: Karol Błażewicz <karol.blazewicz at gmail.com>
Signed-off-by: Allan McRae <allan@archlinux.org>
Pull translation updates

Signed-off-by: Allan McRae <allan@archlinux.org>
contrib: update .gitignore

Signed-off-by: Allan McRae <allan@archlinux.org>
4.1.2 release preparation

Signed-off-by: Allan McRae <allan@archlinux.org>
Merge branch 'maint'