feat: add PKG_EVENT_RC_SCRIPT for rc.d script actions
Introduce a dedicated event for rc script start/stop/restart, with
display in src/event.c and pipe JSON in libpkg/pkg_event.c.
Renamed internal PKG_RC_START/STOP to PKG_RC_ATTR_START/STOP to avoid
conflict with the new public pkg_rc_action_t enum.
pkg_repo: Fix incompatible pointer
Fix incompatible variable pointer which causes compile to fail in Linux
systems.
Fix variable clevel_buf that was 'char **'' which is corrected type to 'char *'
Bound vulnerability database handling
The audit updater writes an unbounded remote download and decompressed
output before validation. An HTTP attacker can fill temporary or package
database storage.
Set fixed maxima and also limit each stage to half its filesystem.
Build a temporary database and atomically replace the existing one after
success.
Drop privileges in sandboxed callbacks
The callback sandbox processes untrusted archive and signature parsers
after forking, but retains root identity. It also inherits a descriptor
for /, so Capsicum alone does not remove root filesystem authority.
Drop to nobody before entering Capsicum, matching the string-returning
callback path.
Enforce signed package size while fetching
The HTTP fetcher replaces the signed package size with server metadata.
It validates size only after writing the cache file. An HTTP attacker
can fill that filesystem before rejection.
Keep the trusted expected size separate from response metadata. Cap the
stream at that size, including unknown-length responses.
Reject invalid repository signature types
An unrecognized signature_type is silently treated as none. A misspelled
repository policy can disable verification. An HTTP attacker can then
replace package metadata.
Accept only pubkey, fingerprints, and none. Reject invalid values before
creating a repository or modifying an existing repository.
fetch: fix SRV/mirror server failover (#296955)
- move server-list discovery before the fetch loop and seed the
walking pointer once; it was reset to the list head every iteration,
so only the first SRV record / mirror was ever tried
- give each server its own FETCH_RETRY budget before advancing to the
next; the list is walked at most once then we give up
- report SRV and mirror-list lookup failures and fall back to the
configured URL host instead of silently trying host:0
- update pkg.conf.5 FETCH_RETRY docs to per-server semantics
Store filesite as compressed archive, parse in memory for rwhich
Remove pkg_files and file_dirs tables from the repo SQLite database
(~96% of the DB size). The compressed filesite archive is now saved
as a standalone "files" file in the repo directory during pkg update.
pkg rwhich decompresses and streams the archive on demand, keeping
only the directory dictionary in memory.
While at here: expand the path in the output for more clarity
Bound repository archive handling
Repository archives are downloaded and extracted before signatures are
verified. A spoofed response could use either a large download or a
compressed member to exhaust filesystem space before rejection.
Limit downloaded archives and extracted target members to 1 GiB or half
of currently free temporary storage. Limit repository metadata to 1 MiB.
Reject duplicate members and check target member size before extraction.
Bound repository signature extraction
Repository signature entries are extracted in a sandbox, but the
privileged parent previously accumulated the entire callback response before
fingerprint verification. A spoofed repository response could exhaust memory
without a valid signing key.
Limit the sandbox callback response to 8 MiB and reject archives with more
than eight signature entries or an entry larger than 1 MiB. This bounds both
the parent allocation and the child extraction workload before verification.
repo: open catalogue read-only when checking validity
pkg_repo_binary_update opened the repo DB read-write just to sanity
check it, even when no update was needed. Open read-only instead;
the actual read-write open in pkg_repo_binary_init_update already
runs only after new data is fetched.
tests: add repo_filelist_data regression test
Verify that data.pkg never contains file lists or directories
regardless of --list-files, and that -l still generates the file
database (files.pkg) listing the package files.
repo: keep file lists out of the data catalog
The data catalog (data.pkg) and per-package manifest must not contain
file lists or directories; those belong only to the file database emitted
via -l/--list-files. Emit the data catalog in compact form so data.pkg
is identical whether or not --list-files is used. Previously -l caused the
full +MANIFEST (with files) to be read and re-emitted into data, ballooning
the catalog (e.g. a full i386 repo grew from ~60MB to ~2GB).
macho: map macOS 26 / iOS 19 to Darwin 25
Add missing Tahoe/iOS 19 entries so pkg config abi reports Darwin:25
instead of falling back to the macOS 15 (Darwin 24) row.
