this affected the old version too- duplicate sodiffs on symlinks are useless

closes #10070

previously:
>>> Size difference for gegl: 7480 KiB -> 7956 KiB
--- filelist-gegl-old	2023-06-26 02:28:40.176085274 +0200
+++ filelist-gegl	2023-06-26 02:28:40.202085952 +0200
@@ -47,12 +47,13 @@
 usr/lib/gegl-0.4/tiff-load.so
 usr/lib/gegl-0.4/tiff-save.so
 usr/lib/gegl-0.4/transformops.so
+usr/lib/gegl-0.4/vector-fill.so
 usr/lib/gegl-0.4/vector-stroke.so
 usr/lib/gegl-0.4/webp-load.so
 usr/lib/gegl-0.4/webp-save.so
 usr/lib/girepository-1.0/
 usr/lib/girepository-1.0/Gegl-0.4.typelib
 usr/lib/libgegl-0.4.so.0
-usr/lib/libgegl-0.4.so.0.443.1
+usr/lib/libgegl-0.4.so.0.445.1
 usr/lib/libgegl-npd-0.4.so
 usr/lib/libgegl-sc-0.4.so
usr/lib/gegl-0.4/vector-fill.so:    SONAME               vector-fill.so
usr/lib/libgegl-0.4.so.0.445.1:    SONAME               libgegl-0.4.so.0

now:
>>> Size difference for gegl: 7480 KiB -> 7956 KiB
--- filelist-gegl-old
+++ filelist-gegl-new
@@ -47,12 +47,13 @@
 usr/lib/gegl-0.4/tiff-load.so
 usr/lib/gegl-0.4/tiff-save.so
 usr/lib/gegl-0.4/transformops.so
+usr/lib/gegl-0.4/vector-fill.so
 usr/lib/gegl-0.4/vector-stroke.so
 usr/lib/gegl-0.4/webp-load.so
 usr/lib/gegl-0.4/webp-save.so
 usr/lib/girepository-1.0/
 usr/lib/girepository-1.0/Gegl-0.4.typelib
 usr/lib/libgegl-0.4.so.0
-usr/lib/libgegl-0.4.so.0.443.1
+usr/lib/libgegl-0.4.so.0.445.1
 usr/lib/libgegl-npd-0.4.so
 usr/lib/libgegl-sc-0.4.so
SODIFF:
+usr/lib/gegl-0.4/vector-fill.so:    SONAME               vector-fill.so
-usr/lib/libgegl-0.4.so.0.443.1:    SONAME               libgegl-0.4.so.0
+usr/lib/libgegl-0.4.so.0.445.1:    SONAME               libgegl-0.4.so.0

it also no longer relies on diffutils default output, utilising diff -U0 for comparison

there is also a slight optimisation wrt apk handling, previously it
would get decompressed twice for soname diff. now the intermediate is
stored

this doesn't work for setting lvalues and *size= is never populated

todo: write tests.., or just port this to lua

when apk fetch fails (a new package is added) these just say 'gzip invalid magic' or similar, as there is no old apk to compare to.

the || die is also never triggered, as it only triggers when the sort fails, since it won't trigger on earlier pipeline steps

this needs more cleaning up, but i'll leave that for the future when i write some tests.

for consistency with every default split

We can't run mkusers inside the chroot because of bwrap peculiarities.
Presently, rootbld does therefore not work at all for APKBUILDs which
use $pkggroups/$pkguser. While not polluting the host is a noble goal
it isn't really useful if it causes rootbld to be incapable of building
certain packages (i.e. those using $pkggroups/$pkguser with groups
not existent on the host).

This commit therefore restores the original behavior for now. While at
it, I also added a comment to the mkusers invocation.

See: alpine/abuild#10094

This reverts commit 84d7b769.

Rodrigo Lourenço authored 1 year ago and alice committed 1 year ago

When giving GitHub URLs like

https://github.com/USER/REPO/archive/refs/tags/TAG.tar.gz

Strip away the /refs/tags part so a valid URL is generated.
Fixes #10034.

Jakub Panek authored 1 year ago and alice committed 1 year ago

Signed-off-by: Jakub Panek <me@panekj.dev>

Dimitry Andric authored 1 year ago and alice committed 1 year ago

In abuild's getopts loop, option variables such as "keep", "verbose",
etc are only set if the corresponding option is found. If such an option
is *not* found, any environment variable with the same name will leak
in, instead. Prevent this by explicitly unsetting almost all of them.

Patrycja Rosa authored 1 year ago and alice committed 1 year ago

this allows for isolating cache directories per package

alice authored 1 year ago and alice committed 1 year ago

the previous implementation used -regex, which is subtly different between busybox and findutils

[0-9]\+ matches on busybox, but doesn't match with gnu findutils
[0-9]+ matches with findutils, but doesn't match on busybox

this means python deps were subtly broken when findutils was installed
(sometimes pulled via makedeps) vs not

/usr/bin/somedirectory/ was providing cmd:somedirectory, because dirs
have +x.

Similar to suid binaries, abuild will now error out if the package
includes binaries with setcap(8) capabilities but doesn't have `setcap`
in `$options`. This eases identifying package which ship binaries
with extra capabilities.

Furthermore, if these binaries are executable by others a warning is
emitted. This warning could be changed to an error in the future.
The recommendation is to make such binaries only executable by owner
and group, thereby requiring the system administrator to explicitly
add users to a specific group in order to give them accesses to these
capabilities.

See: tsc#45

Discussion: This change requires abuild to depend on the `libcap`
package for the `getcap` binary. It does not seem to be possible
at the moment to use scanelf(1) to identify these binaries.

Musl _SC_NGROUPS_MAX is fixed at 32. The kernel can support more.
Query the kernel for number of groups needed.

see alpine/tsc#64 discussion

Sören Tempel authored 1 year ago and alice committed 1 year ago

In the warning, suggest splitting the -doc subpackage into additional
smaller packages (which are not pulled in by the `docs` meta package).

Fixes alpine/tsc#16

strictly speaking, it is possible for an x86_64 cpu to run 32-bit
userspace binaries without qemu emulation. it is also possible for an
aarch64 cpu to run armhf/armv7 binaries (as long as the cpu implements
it, most do). rather than check for every possible combination of when
this is allowed (host cpu + emulated target, does cpu support it, ...),
just downgrade this case to a warning, to permit non-emulated use.

ref alpine/abuild!117 (comment 255174)

alice authored 1 year ago and alice committed 1 year ago

these have a slight runtime hit (like fortify-source), but help find
bugs early, by making programs crash on invariants that would corrupt
memory and lead to hard to debug crashes/bugs later.

alice authored 1 year ago and alice committed 1 year ago

these are mostly useless and redundant given the other flags. all they
do is spam more flags onto every invocation line- things don't "only"
pass cppflags for anything in the general case.