Comment
The change is low risk. It only adjusts build-time compatibility fixes and version stamping in PKGBUILD: replacing a few sed-based source patches, adding an include path for mbedtls3, and exporting upstream-supported GIT_* metadata to avoid the build script accidentally deriving a version from the surrounding AUR checkout. I do not see any new network fetches, privilege escalation, persistence, or installation outside $pkgdir. The only notable concern is the hardcoded /usr/include/mbedtls3 and /usr/lib/mbedtls3 paths, but those are local system paths used for linking against an alternate library and do not introduce a security issue by themselves.
@@ -34,23 +42,34 @@ prepare() {
cd "$srcdir"/"$_pkgname"-"$pkgver"
# Fix nettle 4.0 API change: base64_decode_update dst_length is now also an input
patch -Np1 -i "$srcdir"/nettle4_base64_decode_update.patch
- # Fix strstr redefined warning treated as error (GCC 14+)
- sed -i '/#define memmove/a #undef strstr' src/FTL.h
- # Fix const qualifier warnings in webserver.c (GCC 14+)
- sed -i 's/\bchar \*pos = strchr(host,/const char *pos = strchr(host,/g' src/webserver/webserver.c
- sed -i 's/\bchar \*equal_sign = strchr(opt,/const char *equal_sign = strchr(opt,/g' src/webserver/webserver.c
- # Fix mbedtls 3.x API changes
+ # GCC 16: sanitize_dns_hosts() increments this counter but never reads it.
+ # Scoped to that function only - the other validator loops do use their i.
+ sed -i '/^void sanitize_dns_hosts(/,/^}/ s/int i = 0;/int i __attribute__((unused)) = 0;/' src/config/validator.c
+ # x509.c targets the mbedtls 2.x API; mbedtls3 needs the extra RNG arguments
sed -i 's/mbedtls_x509write_crt_pem(\([^,]*\), \([^,]*\), sizeof(\([^)]*\)))/mbedtls_x509write_crt_pem(\1, \2, sizeof(\3), NULL, NULL)/g' src/webserver/x509.c
sed -i 's/mbedtls_pk_parse_keyfile(\([^,]*\), \([^,]*\), NULL);/mbedtls_pk_parse_keyfile(\1, \2, NULL, NULL, NULL);/g' src/webserver/x509.c
- # Fix nettle 4.0 API change: digest functions no longer take a length argument
- find src -name '*.[ch]' -print0 | \
- xargs -0 sed -i 's/\(hmac_sha[0-9]*_digest\|sha[0-9]*_digest\)(\([^,]*\), [A-Z0-9_]*DIGEST_SIZE, \([^)]*\))/\1(\2, \3)/g'
- sed -i 's/hash->digest(ctx, hash->digest_size, digest)/hash->digest(ctx, digest)/g' src/dnsmasq/dnssec.c
}
build() {
cd "$srcdir"/"$_pkgname"-"$pkgver"
- STATIC=false ./build.sh
+
+ # mbedtls3 lives in a parallel include tree. -isystem keeps FTL's -Werror
+ # from turning warnings inside the mbedTLS headers into build failures.
+ CFLAGS+=" -isystem /usr/include/mbedtls3"
+
+ # GitHub release tarballs ship no .git directory, so gen_version.cmake's
+ # fallback runs git in $srcdir and can pick up the AUR checkout above it
+ # (producing e.g. vDev-f2a924d). These overrides are supported upstream.
+ export GIT_BRANCH='master'
+ export GIT_HASH="${_commit:0:8}"
+ export GIT_VERSION="v$pkgver"
+ export GIT_DATE="$_commit_date"
+ export GIT_TAG="v$pkgver"
+
+ STATIC=false ./build.sh \
+ "-DLIBMBEDTLS=/usr/lib/mbedtls3/libmbedtls.so \
+ -DLIBMBEDX509=/usr/lib/mbedtls3/libmbedx509.so \
+ -DLIBMBEDCRYPTO=/usr/lib/mbedtls3/libmbedcrypto.so"
}
package() {