release of the package manager , used in the Arch Linux distribution. Among the highlights are:
- Full removal of support for delta updates, which allowed downloading only changes. This feature was removed due to the discovery of a vulnerability () that enabled the execution of arbitrary commands on the system when using unsigned databases. For an attack to succeed, the user would need to download specially crafted files with the database and delta update. Support for delta updates was disabled by default and did not gain widespread use. In the future, a complete rewrite of the delta update implementation is planned;
- In the XferCommand handler, a vulnerability was addressed () that could allow remote command execution during MITM attacks with an unsigned database;
- In makepkg, the ability to connect handlers for downloading source packages and verifying digital signatures has been added. Support for compressing packages using the lzip, lz4, and zstd algorithms has been introduced. In repo-add, support for compressing databases with zstd has been added. In the near future, Arch Linux will default to using zstd, which will speed up compression and decompression operations compared to the 'xz' algorithm while maintaining the level of compression;
- The capability to build using the Meson system instead of Autotools has been ensured. In the next release, Meson will completely replace Autotools;
- Support for downloading PGP keys using the (WKD) mechanism has been added, which involves hosting open keys on the web linked to the domain specified in the email address. For example, for the address 'test@example.com', the key can be retrieved via the link 'https://example.com/.well-known/openpgpkey/hu/183d7d5ab73cfc5ece9a5f94e6039d5a'. Key retrieval via WKD is enabled by default in pacman, pacman-key, and makepkg;
- The '—force' option has been removed, replaced by the more accurately reflecting option '—overwrite' proposed over a year ago;
- The results of file searches using the '-F' option now output extended information, such as the package group and installation status.
Source: opennet.ru
