The release of the Pacman package manager 7.1, used in the Arch Linux distribution, is now available. Key changes include:
- Mandatory signature verification for packages and repository database files is enabled by default (the SigLevel setting is set to 'Required' by default). The absence of a signature or an incorrect signature will now by default lead to an error termination.
- Sandbox isolation for the network data loading handler has been strengthened. The number of permissible system calls has been limited, the NO_NEW_PRIVS flag has been employed to prevent privilege escalation, and the Landlock mechanism has enhanced the restrictions. Parameters for managing isolation have been added in pacman.conf and the command-line utility: 'DisableSandboxFilesystem', 'DisableSandboxSyscalls', and 'DisableSandbox'.
- A prompt for re-importing expired keys has been ensured, considering that updated keys are already available. server Updated keys for existing keys are already available.
- The makepkg utility has added the NPROC parameter for configuring the number of concurrently executed tasks. It is now possible to parallelize file cleanup operations. Support for 'xdata' and 'options_$arch' fields has been added to PKGBUILD files. A separate file /etc/makepkg.d/gitconfig is used for configuring Git (system settings are ignored). Support for reproducible builds has been improved.
- The 'repo-add' utility has added options '--wait-for-lock' to retry locking the database instead of terminating and '--remove' to delete old package files.
Source: opennet.ru
