systemd-selinux 232-4 update

1 files changed, 63 insertions, 20 deletions

diff --git a/PKGBUILD b/PKGBUILD
index e4401aca40e3..41282d5fee77 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -6,51 +6,95 @@
 
 pkgbase=systemd-selinux
 pkgname=('systemd-selinux' 'libsystemd-selinux' 'systemd-sysvcompat-selinux')
-pkgver=231
+pkgver=232
 pkgrel=4
 arch=('i686' 'x86_64')
-url="http://www.freedesktop.org/wiki/Software/systemd"
+url="https://www.github.com/systemd/systemd"
 groups=('selinux')
 makedepends=('acl' 'cryptsetup' 'docbook-xsl' 'gperf' 'lz4' 'xz' 'pam-selinux' 'libelf'
              'intltool' 'iptables' 'kmod' 'libcap' 'libidn' 'libgcrypt'
              'libmicrohttpd' 'libxslt' 'util-linux' 'linux-api-headers'
              'python-lxml' 'quota-tools' 'shadow-selinux' 'gnu-efi-libs' 'git'
              'libselinux')
-options=('strip' 'debug')
+options=('strip')
 # Retrieve the splash-arch.bmp image from systemd package sources, as this
 # file is too big to fit in the AUR.
-source=("git://github.com/systemd/systemd.git#tag=v$pkgver"
+source=("git+https://github.com/systemd/systemd.git#tag=v$pkgver"
         'initcpio-hook-udev'
         'initcpio-install-systemd'
         'initcpio-install-udev'
         'arch.conf'
         'loader.conf'
         'splash-arch.bmp::https://projects.archlinux.org/svntogit/packages.git/plain/trunk/splash-arch.bmp?h=packages/systemd&id=e43ddb71a5b1ab56e898347a63e54c5d5d07728a'
-        'udev-hwdb.hook')
-md5sums=('SKIP'
-         '90ea67a7bb237502094914622a39e281'
-         '55ea7d81c02d090b65c42a88f1a5a21a'
-         '1b3aa3a0551b08af9305d33f85b5c2fc'
-         '20ead378f5d6df4b2a3e670301510a7d'
-         'ddaef54f68f6c86c6c07835fc668f62a'
-         '1e2f9a8b0fa32022bf0a8f39123e5f4e'
-         'a475a5ed8f03fb0f6b58b4684998d05c')
+        'udev-hwdb.hook'
+        '0001-disable-RestrictAddressFamilies-on-i686.patch'
+        '0001-Revert-nspawn-try-to-bind-mount-resolved-s-resolv.co.patch')
+sha512sums=('SKIP'
+            'f0d933e8c6064ed830dec54049b0a01e27be87203208f6ae982f10fb4eddc7258cb2919d594cbfb9a33e74c3510cfd682f3416ba8e804387ab87d1a217eb4b73'
+            '52af734947a768758d5eb3f18e31a1cfec6699eca6fa10e40b90c7f11991509186c0a696e3490af3eaba80064ea4cb93e041579abf05addf072d294300aa4b28'
+            'fec639de0d99967ed3e67289eff5ff78fff0c5829d350e73bed536a8391f1daa1d118d72dbdc1f480ffd33fc22b72f4817d0973bd09ec7f182fd26ad87b24355'
+            '61032d29241b74a0f28446f8cf1be0e8ec46d0847a61dadb2a4f096e8686d5f57fe5c72bcf386003f6520bc4b5856c32d63bf3efe7eb0bc0deefc9f68159e648'
+            'c416e2121df83067376bcaacb58c05b01990f4614ad9de657d74b6da3efa441af251d13bf21e3f0f71ddcb4c9ea658b81da3d915667dc5c309c87ec32a1cb5a5'
+            '5a1d78b5170da5abe3d18fdf9f2c3a4d78f15ba7d1ee9ec2708c4c9c2e28973469bc19386f70b3cf32ffafbe4fcc4303e5ebbd6d5187a1df3314ae0965b25e75'
+            '888ab01bc6e09beb08d7126472c34c9e1aa35ea34e62a09e900ae34c93b1de2fcc988586efd8d0dc962393974f45c77b206d59a86cf53e370f061bf9a1b1a862'
+            '89f9b2d3918c679ce4f76c2b10dc7fcb7e04f1925a5f92542f06891de2a123a91df7eb67fd4ce71506a8132f5440b3560b7bb667e1c1813944b115c1dfe35e3f'
+            'b993a42c5534582631f7b379d54f6abc37e3aaa56ecf869a6d86ff14ae5a52628f4e447b6a30751bc1c14c30cec63a5c6d0aa268362d235ed477b639cac3a219')
+validpgpkeys=(
+  '63CDA1E5D3FC22B998D20DD6327F26951A015CC4'  # Lennart Poettering
+)
 
 _backports=(
-  '531ac2b2349da02acc9c382849758e07eb92b020'  # If the notification message length is 0, ignore the message
-  '8523bf7dd514a3a2c6114b7b8fb8f308b4f09fc4'  # pid1: process zero-length notification messages again
-  '9987750e7a4c62e0eb8473603150596ba7c3a015'  # pid1: don't return any error in manager_dispatch_notify_fd()
-  'bd64d82c1c0e3fe2a5f9b3dd9132d62834f50b2d'  # Revert "pid1: reconnect to the console before being re-executed"
-  'bd5b9f0a12dd9c1947b11534e99c395ddf44caa9'  # systemctl: suppress errors with "show" for nonexistent units and properties
+  '843d5baf6aad6c53fc00ea8d95d83209a4f92de1'  # core: don't use the unified hierarchy for the systemd cgroup yet (#4628)
+  'abd67ce74858491565cde157c7b08fda43d3279c'  # basic/virt: fix userns check on CONFIG_USER_NS=n kernel (#4651)
+  '4318abe8d26e969ebdb97744a63ab900233a0185'  # build-sys: do not install ctrl-alt-del.target symlink twice
+  'd112eae7da77899be245ab52aa1747d4675549f1'  # device: Avoid calling unit_free(NULL) in device setup logic (#4748)
 )
 
+_validate_tag() {
+  local success fingerprint trusted status tag=v$pkgver
+
+  parse_gpg_statusfile /dev/stdin < <(git verify-tag --raw "$tag" 2>&1)
+
+  if (( ! success )); then
+    error 'failed to validate tag %s\n' "$tag"
+    return 1
+  fi
+
+  if ! in_array "$fingerprint" "${validpgpkeys[@]}" && (( ! trusted )); then
+    error 'unknown or untrusted public key: %s\n' "$fingerprint"
+    return 1
+  fi
+
+  case $status in
+    'expired')
+      warning 'the signature has expired'
+      ;;
+    'expiredkey')
+      warning 'the key has expired'
+      ;;
+  esac
+
+  return 0
+}
+
 prepare() {
   cd "${pkgbase/-selinux}"
 
+  _validate_tag || return
+
   if (( ${#_backports[*]} > 0 )); then
     git cherry-pick -n "${_backports[@]}"
   fi
 
+  # these patches aren't upstream, but they make v232 more useable.
+
+  # https://github.com/systemd/systemd/issues/4575
+  patch -Np1 <../0001-disable-RestrictAddressFamilies-on-i686.patch
+
+  # https://github.com/systemd/systemd/issues/4595
+  # https://github.com/systemd/systemd/issues/3826
+  patch -Np1 <../0001-Revert-nspawn-try-to-bind-mount-resolved-s-resolv.co.patch
+
   ./autogen.sh
 }
 
@@ -172,8 +216,7 @@ package_libsystemd-selinux() {
             "${pkgname/-selinux}=${pkgver}-${pkgrel}")
   conflicts=("${pkgname/-selinux}")
 
-  # TODO(dreisner): for v232, this should be install-rootlibLTLIBRARIES.
-  make -C "${pkgbase/-selinux}" DESTDIR="$pkgdir" install-libLTLIBRARIES
+  make -C "${pkgbase/-selinux}" DESTDIR="$pkgdir" install-rootlibLTLIBRARIES
 }
 
 package_systemd-sysvcompat-selinux() {