Skip to content

[fix(builder): pre-import PKGBUILD validpgpkeys before build #362

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Aroy-Art wants to merge 2 commits into
base: master
Choose a base branch
from
Open

[fix(builder): pre-import PKGBUILD validpgpkeys before build #362

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2cf5ab1
fix(builder): pre-import PKGBUILD validpgpkeys before build
Aroy-Art May 15, 2026
2ce8d91
style(builder): apply rustfmt to docker.rs
Aroy-Art May 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 13 additions & 2 deletions backend/aurcache-builder/src/docker.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -227,18 +227,29 @@ and check also if the 'DOCKER_HOST=unix:///var/run/user/1000/podman/podman.sock'
}

let self_update = "paru -Syu --noconfirm --noprogressbar --color never";
// Import PGP keys listed in validpgpkeys from PKGBUILD before building.
// Tries multiple keyservers as fallback; never fails the build if import fails
// (--pgpfetch will still attempt to fetch during build as a secondary attempt).
let import_pgp_keys = |pkgbuild_dir: &str| {
format!(
r#"(bash -c 'cd {pkgbuild_dir} && source PKGBUILD 2>/dev/null; for k in "${{validpgpkeys[@]:-}}"; do [ -z "$k" ] && continue; gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys "$k" 2>/dev/null || gpg --keyserver hkps://keys.openpgp.org --recv-keys "$k" 2>/dev/null || gpg --keyserver hkp://pgp.mit.edu --recv-keys "$k" 2>/dev/null || echo "Warning: failed to import PGP key $k"; done' || true)"#

@Lukas-Heiligenbrunner Lukas-Heiligenbrunner May 16, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR. I think source PKGBUILD is not a very good idea to run manually since it can be an arbitrary shell script.
Doing makepkg --printsrcinfo should be a better option since its run in an controlled way.

PR #360 moves from using paru to doing our own dependency resolution and added already something similar than you here:
https://github.com/Lukas-Heiligenbrunner/AURCache/pull/360/changes#diff-9824f463ed3db347394cc2d3267d13ed1349c9412eeb7de66503066486f4878bR5

We still need to review and pollish this pr until it gets to master.
Do you allign with the approach taken there?
Its not a very clean way to pass such a large shell script to the docker containers CMD tho.
Feel free to comment on PR #360 if you have improvement suggestions / input.
Thanks!

@Aroy-Art Aroy-Art May 17, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point — source PKGBUILD executing arbitrary shell is a valid concern. Agree that makepkg --printsrcinfo (or reading .SRCINFO if already present) is cleaner and safer.

The approach in #360 looks right: prefer .SRCINFO when it exists, fall back to makepkg --printsrcinfo, parse validpgpkeys lines with sed. Happy to update this PR to use that pattern instead of source PKGBUILD if it's useful as a quick fix on master while #360 is still being polished — otherwise happy to close this in favor of #360 since it handles the problem more comprehensively. Let me know which you prefer.

@Lukas-Heiligenbrunner Lukas-Heiligenbrunner Jun 9, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @Aroy-Art I think it still makes sense to polish and merge this PR since #360 will probably take a while until RTM.
Maybe you can have a look at the relevant bits from #360 and port them over. When merged I can bump out a new release with this one and the new settings page too. :)

)
};
let source_data = SourceData::from_str(self.package_model.source_data.get()?)?;
let build_cmd = match source_data {
SourceData::Aur { .. } => {
// -Ga forces paru to clone from AUR even when a same-named package exists in a repo
let import_keys =
import_pgp_keys(&format!("{}/{name}", container_build_dir.display()));
format!(
"mkdir -p {container_build_dir} && cd {container_build_dir} && {self_update} && paru -Ga {name} && paru {build_flags} *",
"mkdir -p {container_build_dir} && cd {container_build_dir} && {self_update} && paru -Ga {name} && {import_keys} && paru {build_flags} *",
container_build_dir = container_build_dir.display(),
)
}
SourceData::Git { .. } => {
let import_keys = import_pgp_keys(GIT_REPO_PATH);
format!(
"sudo chmod -R 1777 {GIT_REPO_PATH} && {self_update} && cd {GIT_REPO_PATH} && paru {build_flags} ."
"sudo chmod -R 1777 {GIT_REPO_PATH} && {self_update} && cd {GIT_REPO_PATH} && {import_keys} && paru {build_flags} ."
)
}
SourceData::Upload { .. } => {
Expand Down
Loading