protect maintainer-clean-footprint from being deleted by prtwash,prtsweep

scripts/git-driver

@@ -0,0 +1,69 @@
+#!/bin/sh
+#
+# /etc/ports/drivers/git: git driver script for ports(8)
+#
+
+[ $# = 1 ] || { echo "usage: $0 <file>" >&2; exit 1; }
+. "$1" || { echo "couldn't read $1" >&2 ; exit 1; }
+
+if [ -z "$URL" ]; then
+	echo "URL not set in '$1'" >&2
+	exit 2
+fi
+if [ -z "$NAME" ]; then
+	echo "NAME not set in '$1'" >&2
+	exit 2
+fi
+if [ -z "$BRANCH" ]; then
+	echo "BRANCH not set in '$1'" >&2
+	exit 2
+fi
+
+REPOSITORY="$PORTS_DIR/$NAME"
+# The following feature is explained in the Wiki page SettingUpAGitRepo.
+if [ -n "$LOCAL_REPOSITORY" ]; then
+	REPOSITORY="$LOCAL_REPOSITORY"
+fi
+
+echo "Fetching updates from $URL"
+echo "Updating collection $NAME"
+
+if [ -d "$REPOSITORY/.git" ]; then
+	cd "$REPOSITORY"
+	git checkout -q "$BRANCH"
+	git fetch -q
+	git diff --pretty=format: --name-status "$BRANCH" origin/"$BRANCH" | sed "s/M\t/ Edit /g; s/A\t/ Checkout /g; s/D\t/ Delete /g" | sort
+	# git-checkout(1) should ensure the existence of an exclude file,
+	# whose length needs to be saved to make this driver idempotent.
+	IGNORE_DEFAULT=$(wc -l .git/info/exclude | cut -d " " -f 1)
+	IGNORE_NOW=$(( IGNORE_DEFAULT+1 ))
+	# assemble the list of possible pkgmk artifacts.
+	cat ./*/.signature \
+		| awk -v FS=" " '{ if (($1 == "SHA256") && ($2 !~ /.footprint|Pkgfile/)) {$0=gensub(/SHA256 \((.*)\).*/,"\\1",1); print} }' >> .git/info/exclude
+	# ... in case the work directories appear in this ports tree ...
+	grep -E '^\s*PKGMK_KEEP_WORK=(|.)yes' /etc/pkgmk.conf && keepwork=1
+	# Note: don't bother to read the definition of PKGMK_KEEP_WORK from
+	# /usr/bin/pkgmk too; changing the defaults there is unsupported.
+	if [ "$keepwork" = 1 ]; then
+		echo "work/" >> .git/info/exclude
+	fi
+	# ... in case the built packages also appear in this ports tree...
+	COMPRESSION_MODE="gz"
+	eval $(grep "^PKGMK_COMPRESSION_MODE=" /etc/pkgmk.conf | sed 's/^PKGMK_//')
+	for portname in *; do
+		[ -f "$portname"/Pkgfile ] && echo "${portname}*.pkg.tar.${COMPRESSION_MODE}" >> .git/info/exclude
+	done
+	# end pkgmk artifacts. Now they should be safe from git-clean(1).
+	git clean -q -f
+	git reset -q --hard origin/"$BRANCH"
+	# reset the gitignore(5) file to its default, with the (possibly unwanted)
+	# side effect: the next run of this driver will delete sources in the ports
+	# tree that the master repo considers out of date. This behaviour avoids
+	# the performance impact of a constantly-growing gitignore(5) file.
+	sed -i "${IGNORE_NOW},$$d" .git/info/exclude
+else
+	git clone -q -b "$BRANCH" "$URL" "$REPOSITORY"
+	ls -1 "$REPOSITORY" | sed "s/^/ Checkout /"
+fi
+
+echo "Finished successfully"

scripts/prtcheckmissing

@@ -2,26 +2,28 @@
 #
 # $Id: prtcheckmissing,v 1.1 2003/10/27 15:26:50 opel Exp $
 #      prtcheckmissing,v 1.2 2022/05/31 18:41:19 jmq Exp $
+#      prtcheckmissing,v 1.3 2023/09/07 18:51:46 jmq Exp $
 
 use strict;
 use warnings;
 
-my @mask = parse_pkgadd_conf();
+sub check_missing {
+  my @mask = parse_pkgadd_conf();
+  open (my $dbh, "/var/lib/pkg/db") or die "Could not read package database!\n";
+  local $/ = ""; # read files paragraph-wise; see ``perldoc perlvar''
 
-open (my $dbh, "/var/lib/pkg/db") or die "Could not read package database!\n";
-local $/ = ""; # read files paragraph-wise; see ``perldoc perlvar''
+  while(<$dbh>) {
+    my ($name, $version, @files) = split /\n/;
 
-while(<$dbh>) {
-		my ($name, $version, @files) = split /\n/;
+    # apply the pkgadd rules to eliminate false positives
+    my @missing = grep { (! -e "/$_") && wanted($_, @mask) } @files;
 
-		# apply the pkgadd rules to eliminate false positives
-		my @missing = grep { (! -e "/$_") && wanted($_, @mask) } @files;
-
-		# final report for this package
-		next if not @missing;
-		print map "/$_ $name\n", @missing;
+    # final report for this package
+    next if not @missing;
+    print map "/$_ $name\n", @missing;
+  }
+  close($dbh);
 }
-close($dbh);
 
 sub parse_pkgadd_conf {
   my @unwanted;
@@ -48,3 +50,57 @@ sub wanted {
   }
   return $retval;
 }
+
+sub check_perms {
+  my %wrongmode; # hash from suspicious file to the port(s) that claim to own it
+
+  foreach (split('\n', `prt-get printf "%i:%p:%n\n"`)) {
+    my ($isinst, $repo, $name) = split(':', $_, 3);
+    next if ($isinst eq "no");
+    open (my $fp,"$repo/$name/.footprint") or die "no footprint for $repo/$name";
+    while(<$fp>) {
+      my ($Emod,$Eown,$file) = split(/\t| -> /, $_, 3);
+      chomp($file); $file =~ s/\/$//;
+      next if (! -e "/$file"); # this case is handled by check_missing
+
+      # there's a file on disk, so inspect its owner and perms
+      my @stat = (-l "/$file") ? lstat("/$file") : stat("/$file");
+      my $Fown = getpwuid($stat[4]) . "/" . getgrgid($stat[5]);
+      my $Fmod = mode_to_string($stat[2]);
+      $wrongmode{$file} .= " $name" if (($Eown ne $Fown) or ($Emod ne $Fmod));
+    }
+    close($fp);
+  }
+
+  # final report
+  next if (not %wrongmode);
+  print map "/$_ $wrongmode{$_}\n", sort keys %wrongmode; 
+}
+
+# inlined from Stat::lsMode in order to avoid an extra dependency
+# (https://metacpan.org/pod/Stat::lsMode)
+sub mode_to_string {
+  my ($mode) = @_;
+  my @perms = qw(--- --x -w- -wx r-- r-x rw- rwx);
+  my @ftype = qw(. p c ? d ? b ? - ? l ? s D ? ?);
+  $ftype[0] = '';
+  my @str_mode = @perms[($mode&0700)>>6, ($mode&0070)>>3, $mode&0007];
+  my $ftype = $ftype[($mode & 0170000)>>12];
+
+  my $setids = ($mode & 07000)>>9;
+  if ($setids) {
+    if ($setids & 01) { # Sticky bit
+      $str_mode[2] =~ s/([-x])$/$1 eq 'x' ? 't' : 'T'/e;
+    }
+    if ($setids & 02) { # Setgid bit
+      $str_mode[1] =~ s/([-x])$/$1 eq 'x' ? 's' : 'S'/e;
+    }
+    if ($setids & 04) { # Setuid bit
+      $str_mode[0] =~ s/([-x])$/$1 eq 'x' ? 's' : 'S'/e;
+    }
+  }
+  return join '', $ftype, @str_mode;
+}
+
+if ($0 =~ /perms$/) { check_perms;
+} else { check_missing; }

scripts/prtsweep.pl

@@ -103,7 +103,8 @@ sub parse_manifest {
     my $sigfile = shift;
     my $sigtype = (split /\//, $sigfile)[-1];
     my @keeplist = ("Pkgfile",".footprint","README","README.md",
-        "pre-install","post-install",".32bit",".nostrip");
+        "pre-install","post-install",".32bit",".nostrip",
+        "maintainer_clean_footprint");
     push (@keeplist,$sigtype);
     open (FILE, $sigfile) or return @keeplist;
     while (<FILE>) {

scripts/prtwash.pl

@@ -134,7 +134,7 @@ sub keeplist { # remember to pop off the last two elements for regex purposes
   my $port = shift;
   my @keepers = ("Pkgfile",".footprint",".signature");
     push (@keepers,"pre-install","post-install","README","README.md",
-    ".32bit",".nostrip") if $options{addons}==0;
+    ".32bit",".nostrip","maintainer_clean_footprint") if $options{addons}==0;
 
   my @parsed = parse_pkgfile("$port/Pkgfile"); # file existence already tested
   my $name = ${$parsed[0]};                    # by the caller. But if Pkgfile

scripts/rsync-driver

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+
+error() {
+    echo -e "Error: $1\nUpdating failed"
+    exit 1
+}
+
+warning() {
+    echo "Warning: $1"
+    exit 1
+}
+
+[ $# -gt 0 ] || { echo "Usage: $0 <file>"; exit 1; }
+
+. "$1"
+
+[ "$host" ] || error "Host field not set in $1";
+[ "$collection" ] || error "Collection field not set in $1";
+[ "$destination" ] || error "Destination field not set in $1";
+
+declare -A old_checkouts new_checkouts
+if [ -e "$destination/.checkouts" ]; then
+    { while read -r co; do
+        old_checkouts["$co"]=1
+    done } < "$destination/.checkouts" \
+	    || error "Couldn't read checkouts from $destination/.checkouts"
+fi
+
+printf "Updating file list from %s::%s\n" "$host" "$collection"
+
+# get the remote file list (new .checkouts)
+rm -f "$destination/.new_checkouts"
+{ while read -r nc; do
+    if [ "${nc:0:5}" = "MOTD:" ] || [ "${nc:43}" = "." ]; then continue; fi;
+    echo "${nc:43}" >> "$destination/.new_checkouts";
+    new_checkouts["${nc:43}"]=1;
+done || error "Running rsync failed"; } \
+	< <(rsync -crz --no-human-readable "${host}::${collection}")
+
+printf "Updating collection %s\n" "${destination##*/}"
+
+# now really run rsync
+rsync -crz --no-human-readable --log-format "%o %n" "${host}::${collection}" "${destination}" \
+    | while read -r line; do
+         [ "${line:0:5}" != "recv " ] && continue
+	 (( old_checkouts["${line:5}"]==1 )) && line=" Edit ${line:5}" \
+              || line=" Checkout ${line:5}"
+         echo "$line"
+      done || error "Running rsync failed"
+
+# no chroot safeguard, in contrast to the Perl version
+cd "$destination" || exit
+
+# iterate through old checkouts, remove obsolete files and directories
+if [ -e ".new_checkouts" ]; then
+    for oc in "${!old_checkouts[@]}"; do
+        if [ ! -f "$oc" ] || (( new_checkouts["$oc"] == 1 )); then continue; fi
+        echo " Delete $oc"
+	unset old_checkouts["$oc"]
+        rm -f "$oc" || warning "Couldn't delete $oc"
+    done
+    for oc in "${!old_checkouts[@]}"; do
+        if [ ! -d "$oc" ] || (( new_checkouts["$oc"] == 1 )); then continue; fi
+        echo " Delete $oc"
+        rmdir "$oc" || warning "Couldn't delete $oc"
+    done
+    mv .new_checkouts .checkouts
+fi
+
+echo "Finished successfully"