Update to 3.36.3-1

8 files changed, 226 insertions, 29 deletions

diff --git a/.SRCINFO b/.SRCINFO
index d2c7f7e78f1e..ad3fcbca1a43 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,5 +1,5 @@
 pkgbase = gdm-prime
-	pkgver = 3.36.2
+	pkgver = 3.36.3
 	pkgrel = 1
 	url = https://wiki.gnome.org/Projects/GDM
 	arch = x86_64
@@ -15,15 +15,17 @@ pkgbase = gdm-prime
 	depends = xorg-xrdb
 	depends = xorg-server
 	depends = xorg-xhost
-	source = git+https://gitlab.gnome.org/GNOME/gdm.git#commit=02c42c1ca84bc28928618b773c12f2cea67ed71e
+	source = git+https://gitlab.gnome.org/GNOME/gdm.git#commit=24a4c0afe337a7a381397c87a39e3a666c0ae6cc
 	source = 0001-Xsession-Don-t-start-ssh-agent-by-default.patch
 	source = 0002-pam-arch-Don-t-check-greeter-account-for-expiry.patch
 	source = 0003-pam-arch-Restrict-greeter-service-to-the-gdm-user.patch
-	source = 0004-nvidia-prime.patch
+	source = 0004-pam-arch-Update-to-match-pambase-20200721.1-2.patch
+	source = 0005-nvidia-prime.patch
 	sha256sums = SKIP
-	sha256sums = 098ffb1cdc0232f014e5fe5fb8d268b752afc54d6ee661664036879acd075b22
-	sha256sums = 2e2b12d4609004a010245de51a8c017b164e84f249cd19706d020cb599d2d7e7
-	sha256sums = 3fa02eb7bbbe1586eae4ae98221a284251ca2869dc731c80b753e7effc443379
+	sha256sums = b9ead66d2b6207335f0bd982a835647536998e7c7c6b5248838e5d53132ca21a
+	sha256sums = d89a3a852c9656a61a3d418817c883f7a607a0e65aa0eaf9904738c0299f006d
+	sha256sums = c18dc79bdd3207c66b6f66a41a51dd069442d2e9053055147c2f90e39f0c4a7d
+	sha256sums = c4d04a019a7f7db57c6909d76f3c8f3dbaf7be86c81d38c6672f1c730bd5b72d
 	sha256sums = f2ac60c8e4d62805dc2f441a8754f1c15e12c64ec0dbb1031dbd91dd47df52d9
 
 pkgname = gdm-prime
diff --git a/0001-Xsession-Don-t-start-ssh-agent-by-default.patch b/0001-Xsession-Don-t-start-ssh-agent-by-default.patch
index bfdaca1ee13a..6eaa16349312 100644
--- a/0001-Xsession-Don-t-start-ssh-agent-by-default.patch
+++ b/0001-Xsession-Don-t-start-ssh-agent-by-default.patch
@@ -1,7 +1,7 @@
-From 58cdf43d7b053a7370e6779d06835c239598f59a Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Jan Alexander Steffens (heftig)" <jan.steffens@gmail.com>
 Date: Sat, 20 Jun 2015 17:22:38 +0200
-Subject: [PATCH 1/3] Xsession: Don't start ssh-agent by default
+Subject: [PATCH] Xsession: Don't start ssh-agent by default
 
 ---
  data/Xsession.in | 8 --------
@@ -26,6 +26,3 @@ index 9d79558c..ff6d9de0 100755
  echo "$0: Setup done, will execute: $command"
  
  eval exec $command
--- 
-2.23.0
-
diff --git a/0002-pam-arch-Don-t-check-greeter-account-for-expiry.patch b/0002-pam-arch-Don-t-check-greeter-account-for-expiry.patch
index 60ae9d0d7565..5263f9af286e 100644
--- a/0002-pam-arch-Don-t-check-greeter-account-for-expiry.patch
+++ b/0002-pam-arch-Don-t-check-greeter-account-for-expiry.patch
@@ -1,7 +1,7 @@
-From a9c2cb0ae478caf40cc24001fbf6cfbbcc19196e Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Jan Alexander Steffens (heftig)" <jan.steffens@gmail.com>
 Date: Tue, 10 Sep 2019 20:37:08 +0000
-Subject: [PATCH 2/3] pam-arch: Don't check greeter account for expiry
+Subject: [PATCH] pam-arch: Don't check greeter account for expiry
 
 systemd-sysusers now creates expired accounts, which broke the greeter
 on new installations.
@@ -25,6 +25,3 @@ index 618a7d3a..89521472 100644
  
  password required  pam_deny.so
  
--- 
-2.23.0
-
diff --git a/0003-pam-arch-Restrict-greeter-service-to-the-gdm-user.patch b/0003-pam-arch-Restrict-greeter-service-to-the-gdm-user.patch
index daed25a7feb0..2587f9e02fe4 100644
--- a/0003-pam-arch-Restrict-greeter-service-to-the-gdm-user.patch
+++ b/0003-pam-arch-Restrict-greeter-service-to-the-gdm-user.patch
@@ -1,7 +1,7 @@
-From 3b6ca2e211b9874e61e9a6950c52b52f2a79dca3 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: "Jan Alexander Steffens (heftig)" <jan.steffens@gmail.com>
 Date: Tue, 10 Sep 2019 20:41:10 +0000
-Subject: [PATCH 3/3] pam-arch: Restrict greeter service to the gdm user
+Subject: [PATCH] pam-arch: Restrict greeter service to the gdm user
 
 Copied from pam-exherbo.
 ---
@@ -26,6 +26,3 @@ index 89521472..d59c9cb9 100644
 +session  required  pam_succeed_if.so audit quiet_success user = gdm
  session  required  pam_systemd.so
  session  optional  pam_permit.so
--- 
-2.23.0
-
diff --git a/0004-pam-arch-Update-to-match-pambase-20200721.1-2.patch b/0004-pam-arch-Update-to-match-pambase-20200721.1-2.patch
new file mode 100644
index 000000000000..07b09d970d7d
--- /dev/null
+++ b/0004-pam-arch-Update-to-match-pambase-20200721.1-2.patch
@@ -0,0 +1,200 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Jan Alexander Steffens (heftig)" <heftig@archlinux.org>
+Date: Sun, 9 Aug 2020 00:34:37 +0000
+Subject: [PATCH] pam-arch: Update to match pambase 20200721.1-2
+
+https://bugs.archlinux.org/task/67485
+---
+ data/pam-arch/gdm-autologin.pam          | 22 +++++++++--------
+ data/pam-arch/gdm-fingerprint.pam        | 31 +++++++++++++++---------
+ data/pam-arch/gdm-launch-environment.pam | 24 ++++++++++--------
+ data/pam-arch/gdm-password.pam           | 17 +++++++------
+ data/pam-arch/gdm-pin.pam                | 13 ----------
+ data/pam-arch/gdm-smartcard.pam          | 31 +++++++++++++++---------
+ 6 files changed, 75 insertions(+), 63 deletions(-)
+ delete mode 100644 data/pam-arch/gdm-pin.pam
+
+diff --git a/data/pam-arch/gdm-autologin.pam b/data/pam-arch/gdm-autologin.pam
+index 99b14209..30bdf529 100644
+--- a/data/pam-arch/gdm-autologin.pam
++++ b/data/pam-arch/gdm-autologin.pam
+@@ -1,13 +1,15 @@
+-auth     requisite pam_nologin.so
+-auth     required  pam_env.so
+-auth     optional  pam_gdm.so
+-auth     optional  pam_gnome_keyring.so
+-auth     optional  pam_permit.so
++#%PAM-1.0
+ 
+-account  include   system-local-login
++auth       required                    pam_shells.so
++auth       requisite                   pam_nologin.so
++auth       optional                    pam_permit.so
++auth       required                    pam_env.so
++auth       [success=ok default=1]      pam_gdm.so
++auth       optional                    pam_gnome_keyring.so
+ 
+-password include   system-local-login
++account    include                     system-local-login
+ 
+-session  optional  pam_keyinit.so force revoke
+-session  include   system-local-login
+-session  optional  pam_gnome_keyring.so auto_start
++password   required                    pam_deny.so
++
++session    include                     system-local-login
++session    optional                    pam_gnome_keyring.so auto_start
+diff --git a/data/pam-arch/gdm-fingerprint.pam b/data/pam-arch/gdm-fingerprint.pam
+index a4808617..cc660d9a 100644
+--- a/data/pam-arch/gdm-fingerprint.pam
++++ b/data/pam-arch/gdm-fingerprint.pam
+@@ -1,14 +1,23 @@
+-auth     required  pam_tally.so onerr=succeed file=/var/log/faillog
+-auth     required  pam_shells.so
+-auth     requisite pam_nologin.so
+-auth     required  pam_env.so
+-auth     required  pam_fprintd.so
+-auth     optional  pam_permit.so
++#%PAM-1.0
+ 
+-account  include   system-local-login
++auth       required                    pam_shells.so
++auth       requisite                   pam_nologin.so
++auth       required                    pam_faillock.so      preauth
++# Optionally use requisite above if you do not want to prompt for the fingerprint
++# on locked accounts.
++auth       [success=1 default=ignore]  pam_fprintd.so
++auth       [default=die]               pam_faillock.so      authfail
++auth       optional                    pam_permit.so
++auth       required                    pam_env.so
++auth       required                    pam_faillock.so      authsucc
++# If you drop the above call to pam_faillock.so the lock will be done also
++# on non-consecutive authentication failures.
++auth       [success=ok default=1]      pam_gdm.so
++auth       optional                    pam_gnome_keyring.so
+ 
+-password required  pam_fprintd.so
+-password optional  pam_permit.so
++account    include                     system-local-login
+ 
+-session  optional  pam_keyinit.so force revoke
+-session  include   system-local-login
++password   required                    pam_deny.so
++
++session    include                     system-local-login
++session    optional                    pam_gnome_keyring.so auto_start
+diff --git a/data/pam-arch/gdm-launch-environment.pam b/data/pam-arch/gdm-launch-environment.pam
+index d59c9cb9..2ff5ae56 100644
+--- a/data/pam-arch/gdm-launch-environment.pam
++++ b/data/pam-arch/gdm-launch-environment.pam
+@@ -1,13 +1,17 @@
+-auth     required  pam_env.so
+-auth     required  pam_succeed_if.so audit quiet_success user = gdm
+-auth     optional  pam_permit.so
++#%PAM-1.0
+ 
+-account  required  pam_succeed_if.so audit quiet_success user = gdm
+-account  optional  pam_permit.so
++auth       required                    pam_succeed_if.so    audit quiet_success user = gdm
++auth       optional                    pam_permit.so
++auth       required                    pam_env.so
+ 
+-password required  pam_deny.so
++account    required                    pam_succeed_if.so    audit quiet_success user = gdm
++account    optional                    pam_permit.so
+ 
+-session  optional  pam_keyinit.so force revoke
+-session  required  pam_succeed_if.so audit quiet_success user = gdm
+-session  required  pam_systemd.so
+-session  optional  pam_permit.so
++password   required                    pam_deny.so
++
++session    optional                    pam_loginuid.so
++session    optional                    pam_keyinit.so       force revoke
++session    required                    pam_succeed_if.so    audit quiet_success user = gdm
++session    optional                    pam_permit.so
++-session   optional                    pam_systemd.so
++session    required                    pam_env.so           user_readenv=1
+diff --git a/data/pam-arch/gdm-password.pam b/data/pam-arch/gdm-password.pam
+index 8d34794e..137242a6 100644
+--- a/data/pam-arch/gdm-password.pam
++++ b/data/pam-arch/gdm-password.pam
+@@ -1,11 +1,12 @@
+-auth     include   system-local-login
+-auth     optional  pam_gnome_keyring.so
++#%PAM-1.0
+ 
+-account  include   system-local-login
++auth       include                     system-local-login
++auth       optional                    pam_gnome_keyring.so
+ 
+-password include   system-local-login
+-password optional  pam_gnome_keyring.so use_authtok
++account    include                     system-local-login
+ 
+-session  optional  pam_keyinit.so force revoke
+-session  include   system-local-login
+-session  optional  pam_gnome_keyring.so auto_start
++password   include                     system-local-login
++password   optional                    pam_gnome_keyring.so use_authtok
++
++session    include                     system-local-login
++session    optional                    pam_gnome_keyring.so auto_start
+diff --git a/data/pam-arch/gdm-pin.pam b/data/pam-arch/gdm-pin.pam
+deleted file mode 100644
+index 135e205e..00000000
+--- a/data/pam-arch/gdm-pin.pam
++++ /dev/null
+@@ -1,13 +0,0 @@
+-auth     requisite pam_pin.so
+-auth     include   system-local-login
+-auth     optional  pam_gnome_keyring.so
+-
+-account  include   system-local-login
+-
+-password include   system-local-login
+-password optional  pam_pin.so
+-password optional  pam_gnome_keyring.so use_authtok
+-
+-session  optional  pam_keyinit.so force revoke
+-session  include   system-local-login
+-session  optional  pam_gnome_keyring.so auto_start
+diff --git a/data/pam-arch/gdm-smartcard.pam b/data/pam-arch/gdm-smartcard.pam
+index ec6f75d5..e6ec1299 100644
+--- a/data/pam-arch/gdm-smartcard.pam
++++ b/data/pam-arch/gdm-smartcard.pam
+@@ -1,14 +1,23 @@
+-auth     required  pam_tally.so onerr=succeed file=/var/log/faillog
+-auth     required  pam_shells.so
+-auth     requisite pam_nologin.so
+-auth     required  pam_env.so
+-auth     required  pam_pkcs11.so wait_for_card card_only
+-auth     optional  pam_permit.so
++#%PAM-1.0
+ 
+-account  include   system-local-login
++auth       required                    pam_shells.so
++auth       requisite                   pam_nologin.so
++auth       required                    pam_faillock.so      preauth
++# Optionally use requisite above if you do not want to prompt for the smartcard
++# on locked accounts.
++auth       [success=1 default=ignore]  pam_pkcs11.so        wait_for_card card_only
++auth       [default=die]               pam_faillock.so      authfail
++auth       optional                    pam_permit.so
++auth       required                    pam_env.so
++auth       required                    pam_faillock.so      authsucc
++# If you drop the above call to pam_faillock.so the lock will be done also
++# on non-consecutive authentication failures.
++auth       [success=ok default=1]      pam_gdm.so
++auth       optional                    pam_gnome_keyring.so
+ 
+-password required  pam_pkcs11.so
+-password optional  pam_permit.so
++account    include                     system-local-login
+ 
+-session  optional  pam_keyinit.so force revoke
+-session  include   system-local-login
++password   required                    pam_deny.so
++
++session    include                     system-local-login
++session    optional                    pam_gnome_keyring.so auto_start
diff --git a/0004-nvidia-prime.patch b/0005-nvidia-prime.patch
index b11baa16202e..b11baa16202e 100644
--- a/0004-nvidia-prime.patch
+++ b/0005-nvidia-prime.patch
diff --git a/PKGBUILD b/PKGBUILD
index 59ee81e04a1b..31eede3eb3ce 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -4,7 +4,7 @@
 
 pkgbase=gdm-prime
 pkgname=(gdm-prime libgdm-prime)
-pkgver=3.36.2
+pkgver=3.36.3
 pkgrel=1
 url="https://wiki.gnome.org/Projects/GDM"
 arch=(x86_64)
@@ -12,16 +12,18 @@ license=(GPL)
 depends=(gnome-shell gnome-session upower xorg-xrdb xorg-server xorg-xhost)
 makedepends=(yelp-tools gobject-introspection git docbook-xsl)
 checkdepends=(check)
-_commit=02c42c1ca84bc28928618b773c12f2cea67ed71e  # tags/3.36.2^0
+_commit=24a4c0afe337a7a381397c87a39e3a666c0ae6cc  # tags/3.36.3^0
 source=("git+https://gitlab.gnome.org/GNOME/gdm.git#commit=$_commit"
         0001-Xsession-Don-t-start-ssh-agent-by-default.patch
         0002-pam-arch-Don-t-check-greeter-account-for-expiry.patch
         0003-pam-arch-Restrict-greeter-service-to-the-gdm-user.patch
-        0004-nvidia-prime.patch)
+	0004-pam-arch-Update-to-match-pambase-20200721.1-2.patch
+        0005-nvidia-prime.patch)
 sha256sums=('SKIP'
-            '098ffb1cdc0232f014e5fe5fb8d268b752afc54d6ee661664036879acd075b22'
-            '2e2b12d4609004a010245de51a8c017b164e84f249cd19706d020cb599d2d7e7'
-            '3fa02eb7bbbe1586eae4ae98221a284251ca2869dc731c80b753e7effc443379'
+            'b9ead66d2b6207335f0bd982a835647536998e7c7c6b5248838e5d53132ca21a'
+            'd89a3a852c9656a61a3d418817c883f7a607a0e65aa0eaf9904738c0299f006d'
+            'c18dc79bdd3207c66b6f66a41a51dd069442d2e9053055147c2f90e39f0c4a7d'
+            'c4d04a019a7f7db57c6909d76f3c8f3dbaf7be86c81d38c6672f1c730bd5b72d'
             'f2ac60c8e4d62805dc2f441a8754f1c15e12c64ec0dbb1031dbd91dd47df52d9')
 
 prepare() {
@@ -33,7 +35,10 @@ prepare() {
   patch -Np1 -i ../0002-pam-arch-Don-t-check-greeter-account-for-expiry.patch
   patch -Np1 -i ../0003-pam-arch-Restrict-greeter-service-to-the-gdm-user.patch
 
-  patch -Np1 -i ../0004-nvidia-prime.patch
+  # https://bugs.archlinux.org/task/67485
+  patch -Np1 -i ../0004-pam-arch-Update-to-match-pambase-20200721.1-2.patch
+
+  patch -Np1 -i ../0005-nvidia-prime.patch
 
   NOCONFIGURE=1 ./autogen.sh
 }
diff --git a/gdm-prime.install b/gdm-prime.install
index fedeb975d8c8..4b39564cba61 100644
--- a/gdm-prime.install
+++ b/gdm-prime.install
@@ -1,4 +1,3 @@
-
 post_upgrade() {
   if (( $(vercmp $2 3.34.0-2) < 0 )); then
     usermod --expiredate= gdm >/dev/null