pacman-key: stricter parsing for -verify

Prevents trust being spoofed by using TRUST_FULLY in the signatory's name
or in an added notation.

Fixes FS#41147.

Signed-off-by: Allan McRae <allan@archlinux.org>
PKGBUILD(5): arch-specific fields are always additional

Change e10775340 should have included this.

Signed-off-by: Allan McRae <allan@archlinux.org>
paccache: add support for multiple cachedirs

Signed-off-by: Maxim Andersson <thesilentboatman@gmail.com>
paccache: read default cachedir from pacman.conf

Implements FS#40738.
makepkg: Allow using sources with :: in them

Git has the ability to use helper applications for interfacing with hg,
and from what we had before, the following url::

  foo::git+hg::http://foo.bar/foobar

would get converted to something along the lines of:

  filename: foo
  URL: http://foo.bar/foobar

and the 'git+hg' part would essentially be ignored when it's getting set
up in the 'get_protocol' and 'get_downloadclient' functions. With this
patch it is possible to have a source link with '::' in it, however it
is not possible to have a filename with '::', which is the current
behavior.

Signed-off-by: Allan McRae <allan@archlinux.org>
makepkg: do not eval dlcmd

This eval enables the following in a PKGBUILD to "just work":

  source=('$pkgname-$pkgver.tar.gz'::'https://host/$pkgver.tar.gz')

This has at least two problems:

- It violated the principle of least surprise.
- It could be a security issue since URLs are arbitrary input.

Instead, expand the dlagent command line into an array, replace the %o,
%u place holders, and run the resultant command line as is.

Embedded spaces in the DLAGENTS entry can be escaped with a backslash.

Fixes FS#41682

Signed-off-by: Allan McRae <allan@archlinux.org>
updpkgsums: use a throwaway build dir

This prevents updpkgsums from potentially dirtying an otherwise pristine
directory (likely $PWD) when makepkg creates the srclinks.

Signed-off-by: Allan McRae <allan@archlinux.org>