pkgconf 2.4.3.post3__tar.gz → 2.5.1.post1__tar.gz

{pkgconf-2.4.3.post3 → pkgconf-2.5.1.post1}/.github/workflows/build.yml

@@ -36,8 +36,8 @@ jobs:
           - ubuntu-24.04-arm
           - windows-latest
           - windows-11-arm
-          - macos-13      # x86-64
-          - macos-latest  # arm64
+          - macos-15-intel  # x86-64
+          - macos-latest    # arm64
       fail-fast: false
     steps:
       - uses: actions/checkout@v4

{pkgconf-2.4.3.post3 → pkgconf-2.5.1.post1}/.github/workflows/test.yml

@@ -28,7 +28,7 @@ jobs:
           - '3.11'
           - '3.12'
           - '3.13'
-          - '3.14-dev'
+          - '3.14'
         exclude:
           - os: windows-11-arm
             python: '3.10'

{pkgconf-2.4.3.post3 → pkgconf-2.5.1.post1}/.pre-commit-config.yaml

@@ -4,7 +4,7 @@ ci:
 
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: check-added-large-files
       - id: check-ast
@@ -34,9 +34,9 @@ repos:
     hooks:
       - id: validate-pyproject
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.11.2
+    rev: v0.14.8
     hooks:
-      - id: ruff
+      - id: ruff-check
         args: [--fix, --show-fixes]
       - id: ruff-format
   - repo: https://github.com/codespell-project/codespell
@@ -56,7 +56,7 @@ repos:
       - id: rst-inline-touching-normal
       - id: text-unicode-replacement-char
   - repo: https://github.com/asottile/pyupgrade
-    rev: v3.19.1
+    rev: v3.21.2
     hooks:
     - id: pyupgrade
-      args: [--py38-plus]
+      args: [--py310-plus]

{pkgconf-2.4.3.post3 → pkgconf-2.5.1.post1}/PKG-INFO

@@ -1,32 +1,12 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: pkgconf
-Version: 2.4.3.post3
+Version: 2.5.1.post1
 Summary: `pkgconf` is a program which helps with discovering library dependencies and configuring compiler and linker flags.
 Author-Email: Ralf Gommers <ralf.gommers@gmail.com>, =?utf-8?q?Filipe_La=C3=ADns?= <lains@riseup.net>
-License: Copyright (c) 2024 pypackaging-native contributors
-         
-         Permission is hereby granted, free of charge, to any person obtaining a copy of
-         this software and associated documentation files (the “Software”), to deal in
-         the Software without restriction, including without limitation the rights to
-         use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
-         of the Software, and to permit persons to whom the Software is furnished to do
-         so, subject to the following conditions:
-         
-         The above copyright notice and this permission notice shall be included in all
-         copies or substantial portions of the Software.
-         
-         THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-         IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-         FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-         AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-         LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-         OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-         SOFTWARE.
-         
+License-Expression: MIT
+License-File: LICENSE
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: MIT License
-Classifier: License :: OSI Approved :: ISC License (ISCL)
 Classifier: Programming Language :: C
 Classifier: Topic :: Software Development
 Classifier: Operating System :: Microsoft :: Windows

{pkgconf-2.4.3.post3 → pkgconf-2.5.1.post1}/docs/index.rst

@@ -63,6 +63,8 @@ If the embedded pkgconf cannot find a package, by default it will fallback to th
 ``pkgconf``/``pkg-config``, which may find packages present on the system. To disable
 this behavior, set the ``PKGCONF_PYPI_EMBEDDED_ONLY=1`` environment variable.
 
+To enable debug output to ``syserr``, set ``PYPI_PKGCONF_DEBUG=1``.
+
 API
 ===
 

{pkgconf-2.4.3.post3 → pkgconf-2.5.1.post1}/meson.build

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: MIT
 
 project('pkgconf-pypi',
-  version : '2.4.3-3',
+  version : '2.5.1-1',
   license : 'MIT AND ISC',
   license_files : ['LICENSE'],
   meson_version : '>=1.3.2',

{pkgconf-2.4.3.post3 → pkgconf-2.5.1.post1}/pyproject.toml

@@ -5,16 +5,17 @@
 [build-system]
 backend-path = ['src']
 # build-backend = 'mesonpy'
-# requires = ['meson-python']
+# requires = ['meson-python>=0.18.0']
 build-backend = 'buildhack'
-requires = ['meson-python', 'wheel']
+requires = ['meson-python>=0.18.0', 'wheel']
 
 [project]
 name = 'pkgconf'
-version = '2.4.3-3'
+version = '2.5.1-1'
 description = '`pkgconf` is a program which helps with discovering library dependencies and configuring compiler and linker flags.'
 readme = 'README.md'
-license = {file = 'LICENSE'}
+license = 'MIT'
+license-files = ['LICENSE']
 authors = [
   {name = 'Ralf Gommers', email = 'ralf.gommers@gmail.com'},
   {name = 'Filipe Laíns', email = 'lains@riseup.net'}
@@ -22,8 +23,6 @@ authors = [
 classifiers = [
   'Development Status :: 4 - Beta',
   'Intended Audience :: Developers',
-  'License :: OSI Approved :: MIT License',
-  'License :: OSI Approved :: ISC License (ISCL)',
   'Programming Language :: C',
   'Topic :: Software Development',
   'Operating System :: Microsoft :: Windows',
@@ -78,13 +77,12 @@ config-settings = 'setup-args=--vsenv build-dir=build'
 
 [tool.mypy]
 files = 'src'
-python_version = '3.9'
+python_version = '3.10'
 show_error_codes = true
 strict = true
 
 [tool.ruff]
 line-length = 127
-src = ['src']
 
 [tool.ruff.format]
 quote-style = 'single'

{pkgconf-2.4.3.post3 → pkgconf-2.5.1.post1}/src/pkgconf/__init__.py

@@ -14,7 +14,7 @@ import pkgconf._path_entrypoints
 from pkgconf._path_entrypoints import PathWarning
 
 
-__version__ = '2.4.3-3'
+__version__ = '2.5.1-1'
 
 
 _LOGGER = logging.getLogger(__name__)

{pkgconf-2.4.3.post3 → pkgconf-2.5.1.post1}/src/pkgconf/__main__.py

@@ -101,7 +101,10 @@ def _setup_cli():
         stream=sys.stderr,
         format=f'{dim}> %(message)s{reset} [%(levelname)s:%(name)s]',
     )
-    pkgconf._CLI_LOGGER.setLevel(logging.INFO)
+    if os.environ.get('PYPI_PKGCONF_DEBUG'):
+        pkgconf._CLI_LOGGER.setLevel(logging.INFO)
+    else:
+        pkgconf._CLI_LOGGER.setLevel(logging.WARNING)
 
     def _showwarning(
         message: Warning | str,

pkgconf-2.5.1.post1/subprojects/pkgconf/.github/workflows/release-tarballs.yml

@@ -0,0 +1,51 @@
+name: Generate and upload release tarballs
+
+on:
+  push:
+    tags:
+      - 'pkgconf-*'
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    container:
+      image: alpine:latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v2
+      with:
+        repository: pkgconf/pkgconf
+
+    - name: Update system and add dependencies
+      run: |
+        apk update
+        apk add kyua atf build-base autoconf automake libtool xz gzip openssh-client
+
+    - name: Bootstrap autotools
+      run: |
+        sh autogen.sh
+        ./configure
+
+    - name: Run tests and generate dist tarballs
+      run: |
+        make distcheck -j$(nproc)
+
+    - name: Upload dist tarballs to distfiles.ariadne.space
+      env:
+        DISTFILES_PRIVATE_KEY: ${{ secrets.DISTFILES_PRIVATE_KEY }}
+        DISTFILES_HOST_KEYS: ${{ secrets.DISTFILES_HOST_KEYS }}
+      run: |
+        mkdir -p $HOME/.ssh
+
+        # Ensure the private key is read-only so SSH doesn't reject it.
+        umask 277
+        (echo "$DISTFILES_PRIVATE_KEY" | base64 -d) > $HOME/.ssh/id_ed25519
+
+        umask 077
+        (echo "$DISTFILES_HOST_KEYS" | base64 -d) > $HOME/.ssh/known_hosts
+
+        # Upload the tarballs.
+        scp -i "$HOME/.ssh/id_ed25519" -o "UserKnownHostsFile=$HOME/.ssh/known_hosts" *.tar* kaniini@distfiles.ariadne.space:distfiles/pkgconf/
+
+        # Delete the key material.
+        rm -rf $HOME/.ssh

{pkgconf-2.4.3.post3 → pkgconf-2.5.1.post1}/subprojects/pkgconf/.github/workflows/test.yml

@@ -13,7 +13,6 @@ jobs:
       matrix:
         include: [
           { msystem: MINGW64, arch: x86_64},
-          { msystem: MINGW32, arch: i686}
         ]
     steps:
       - name: Checkout code
@@ -28,6 +27,7 @@ jobs:
             mingw-w64-${{ matrix.arch }}-meson
             mingw-w64-${{ matrix.arch }}-ninja
             mingw-w64-${{ matrix.arch }}-gcc
+            mingw-w64-${{ matrix.arch }}-msitools
 
       - name: Build
         shell: msys2 {0}
@@ -36,7 +36,16 @@ jobs:
           export CFLAGS=-D__USE_MINGW_ANSI_STDIO=0
 
           meson -Dtests=disabled _build
-          meson compile -C _build
+          meson compile -C _build msi
+
+      - name: Upload Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-output
+          path: |
+            _build/*.exe
+            _build/*.dll
+            _build/*.msi
 
   debian-meson:
     runs-on: ubuntu-latest
@@ -151,3 +160,23 @@ jobs:
       - name: Run tests
         run: |
           make distcheck
+
+  analysis:
+    runs-on: ubuntu-latest
+    container:
+      image: alpine
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Update system and add dependencies
+        run: |
+          apk update
+          apk add kyua atf build-base autoconf automake libtool xz gzip
+
+      - name: Build
+        run: |
+          export CFLAGS="-Wall -Werror -O2 -ggdb3 -fanalyzer"
+          ./autogen.sh
+          ./configure
+          make -j9 CFLAGS="$CFLAGS"

{pkgconf-2.4.3.post3 → pkgconf-2.5.1.post1}/subprojects/pkgconf/Makefile.am

@@ -18,6 +18,8 @@ lib_LTLIBRARIES = libpkgconf.la
 EXTRA_DIST =	pkg.m4 \
 		meson.build \
 		meson_options.txt \
+		pkgconf.wxs.in \
+		txt2rtf.py \
 		libpkgconf/meson.build \
 		libpkgconf/config.h.meson \
 		libpkgconf/win-dirent.h \
@@ -174,9 +176,10 @@ libpkgconf_la_SOURCES  =	\
 		libpkgconf/path.c		\
 		libpkgconf/personality.c	\
 		libpkgconf/parser.c
-libpkgconf_la_LDFLAGS = -no-undefined -version-info 6:0:0 -export-symbols-regex '^pkgconf_'
+libpkgconf_la_LDFLAGS = -no-undefined -version-info 7:0:0 -export-symbols-regex '^pkgconf_'
 
 dist_man_MANS    = 		\
+	man/bomtool.1		\
 	man/pkgconf.1		\
 	man/pkg.m4.7		\
 	man/pc.5		\

{pkgconf-2.4.3.post3 → pkgconf-2.5.1.post1}/subprojects/pkgconf/Makefile.lite

@@ -39,7 +39,7 @@ all: pkgconf-lite
 libpkgconf/config.h:
 	@echo '#define PACKAGE_NAME "pkgconf-lite"' >> $@
 	@echo '#define PACKAGE_BUGREPORT "https://git.dereferenced.org/pkgconf/pkgconf/issues"' >> $@
-	@echo '#define PACKAGE_VERSION "2.4.3"' >> $@
+	@echo '#define PACKAGE_VERSION "2.5.1"' >> $@
 	@echo '#define PACKAGE PACKAGE_NAME " " PACKAGE_VERSION' >> $@
 	@echo '#define HAVE_STRLCPY' >> $@
 	@echo '#define HAVE_STRLCAT' >> $@

{pkgconf-2.4.3.post3 → pkgconf-2.5.1.post1}/subprojects/pkgconf/NEWS

@@ -1,6 +1,46 @@
 Changes from previous version of pkgconf
 ========================================
 
+Changes from 2.5.0 to 2.5.1:
+----------------------------
+
+* Fix processing of empty dependency lists.
+
+Changes from 2.4.3 to 2.5.0:
+----------------------------
+
+* Added a manual page for bomtool.
+
+* Add support for preloaded packages.
+  These are modules which are preloaded into the package database
+  and preferred over searching the module search path when present.
+
+* Refactor Windows registry PKG_CONFIG_PATH support so that it
+  augments the main directory search list instead of being treated
+  as a special case.
+
+* Processing of `--with-path` arguments by the pkgconf CLI is
+  now deferred until libpkgconf is fully initialized, effectively
+  aligning behavior with PKG_CONFIG_PATH processing.
+
+* Fix several minor memory safety bugs which were identified by
+  the GCC 15 static analyzer.
+
+* Added support for pledge(2) and unveil(2) on systems where
+  this functionality is available.
+
+* Significant improvements to pkgconf's manual pages.
+  Patches by Ingo Schwarze and Jonathan Gray (OpenBSD).
+
+* Remove questionable default-static assumption on Windows that
+  was inherited from the original pkg-config.  Most distributions
+  of pkgconf on Windows were already patching this out.
+  Patch by Kai Pastor.
+
+* Add -D_POSIX_C_SOURCE=200809L to the build definitions, which
+  is needed for readlinkat on glibc.
+  Patch by Filipe Laíns.
+
 Changes from 2.4.2 to 2.4.3:
 ----------------------------
 

pkgconf-2.5.1.post1/subprojects/pkgconf/README.md

@@ -0,0 +1,130 @@
+# pkgconf [![test](https://github.com/pkgconf/pkgconf/actions/workflows/test.yml/badge.svg)](https://github.com/pkgconf/pkgconf/actions/workflows/test.yml)
+
+`pkgconf` is a program which helps to configure compiler and linker flags for
+development libraries.  It is a superset of the functionality provided by
+pkg-config from freedesktop.org, but does not provide bug-compatibility with
+the original pkg-config.
+
+`libpkgconf` is a library which provides access to most of `pkgconf`'s functionality, 
+to allow other tooling such as compilers and IDEs to discover and use libraries 
+configured by pkgconf.
+
+## release tarballs
+
+Release tarballs are available on [distfiles.ariadne.space][distfiles].
+
+   [distfiles]: https://distfiles.ariadne.space/pkgconf/
+
+## build system setup
+
+If you would like to use the git sources directly, or a snapshot of the
+sources from GitHub, you will need to regenerate the autotools build
+system artifacts yourself, or use Meson instead.  For example, on Alpine:
+
+    $ apk add autoconf automake libtool build-base
+    $ sh ./autogen.sh
+
+## pkgconf-lite
+
+If you only need the original pkg-config functionality, there is also pkgconf-lite,
+which builds the `pkgconf` frontend and relevant portions of `libpkgconf` functionality
+into a single binary:
+
+    $ make -f Makefile.lite
+
+## why `pkgconf` over original `pkg-config`?
+
+pkgconf builds a flattened directed dependency graph, which allows for more insight
+into relationships between dependencies, allowing for some link-time dependency
+optimization, which allows for the user to more conservatively link their binaries,
+which may be helpful in some environments, such as when prelink(1) is being used.
+
+The solver is also optimized to handle large dependency graphs with hundreds of
+thousands of edges, which can be seen in any project using the Abseil frameworks
+for example.
+
+In addition, pkgconf has full support for virtual packages, while the original
+pkg-config does not, as well as fully supporting `Conflicts` at dependency
+resolution time, which is more efficient than checking for `Conflicts` while
+walking the dependency graph.
+
+## linker flags optimization
+
+pkgconf, when used effectively, can make optimizations to avoid overlinking binaries.
+
+This functionality depends on the pkg-config module properly declaring its dependency
+tree instead of using `Libs` and `Cflags` fields to directly link against other modules
+which have pkg-config metadata files installed.
+
+The practice of using `Libs` and `Cflags` to describe unrelated dependencies is
+not recommended in [Dan Nicholson's pkg-config tutorial][fd-tut] for this reason.
+
+   [fd-tut]: http://people.freedesktop.org/~dbn/pkg-config-guide.html
+
+## bug compatibility with original pkg-config
+
+In general, we do not provide bug-level compatibility with pkg-config.
+
+What that means is, if you feel that there is a legitimate regression versus pkg-config,
+do let us know, but also make sure that the .pc files are valid and follow the rules of
+the [pkg-config tutorial][fd-tut], as most likely fixing them to follow the specified
+rules will solve the problem.
+
+## debug output
+
+Please use only the stable interfaces to query pkg-config.  Do not screen-scrape the
+output from `--debug`: this is sent to `stderr` for a reason, it is not intended to be
+scraped.  The `--debug` output is **not** a stable interface, and should **never** be
+depended on as a source of information.  If you need a stable interface to query pkg-config
+which is not covered, please get in touch.
+
+## compiling `pkgconf` and `libpkgconf` on UNIX
+
+pkgconf is basically compiled the same way any other autotools-based project is
+compiled:
+
+    $ ./configure
+    $ make
+    $ sudo make install
+
+If you are installing pkgconf into a custom prefix, such as `/opt/pkgconf`, you will
+likely want to define the default system includedir and libdir for your toolchain.
+To do this, use the `--with-system-includedir` and `--with-system-libdir` configure
+flags like so:
+
+    $ ./configure \
+         --prefix=/opt/pkgconf \
+         --with-system-libdir=/lib:/usr/lib \
+         --with-system-includedir=/usr/include
+    $ make
+    $ sudo make install
+
+## compiling `pkgconf` and `libpkgconf` with Meson (usually for Windows)
+
+pkgconf is compiled using [Meson](https://mesonbuild.com) on Windows. In theory, you could also use
+Meson to build on UNIX, but this is not recommended at this time as pkgconf is typically built
+much earlier than Meson.
+
+    $ meson setup build -Dtests=disabled
+    $ meson compile -C build
+    $ meson install -C build
+
+There are a few defines such as `SYSTEM_LIBDIR`, `PKGCONFIGDIR` and `SYSTEM_INCLUDEDIR`.
+However, on Windows, the default `PKGCONFIGDIR` value is usually overridden at runtime based
+on path relocation.
+
+## pkg-config symlink
+
+If you want pkgconf to be used when you invoke `pkg-config`, you should install a
+symlink for this.  We do not do this for you, as we believe it is better for vendors
+to make this determination themselves.
+
+    $ ln -sf pkgconf /usr/bin/pkg-config
+
+## contacts
+
+You can report bugs at <https://github.com/pkgconf/pkgconf/issues>.
+
+There is a mailing list at <https://lists.sr.ht/~kaniini/pkgconf>.
+
+You can contact us via IRC at `#pkgconf` at `irc.oftc.net`.

{pkgconf-2.4.3.post3 → pkgconf-2.5.1.post1}/subprojects/pkgconf/cli/main.c

@@ -1031,6 +1031,47 @@ deduce_personality(char *argv[])
 }
 #endif
 
+static void
+unveil_handler(const pkgconf_client_t *client, const char *path, const char *permissions)
+{
+	(void) client;
+
+	if (pkgconf_unveil(path, permissions) == -1)
+	{
+		fprintf(stderr, "pkgconf: unveil failed: %s\n", strerror(errno));
+		exit(EXIT_FAILURE);
+	}
+}
+
+static bool
+unveil_search_paths(const pkgconf_client_t *client, const pkgconf_cross_personality_t *personality)
+{
+	pkgconf_node_t *n;
+
+	if (pkgconf_unveil("/dev/null", "rwc") == -1)
+		return false;
+
+	PKGCONF_FOREACH_LIST_ENTRY(client->dir_list.head, n)
+	{
+		pkgconf_path_t *pn = n->data;
+
+		if (pkgconf_unveil(pn->path, "r") == -1)
+			return false;
+	}
+
+	PKGCONF_FOREACH_LIST_ENTRY(personality->dir_list.head, n)
+	{
+		pkgconf_path_t *pn = n->data;
+
+		if (pkgconf_unveil(pn->path, "r") == -1)
+			return false;
+	}
+
+	pkgconf_client_set_unveil_handler(&pkg_client, unveil_handler);
+
+	return true;
+}
+
 int
 main(int argc, char *argv[])
 {
@@ -1055,6 +1096,12 @@ main(int argc, char *argv[])
 		.flags = PKGCONF_PKG_PROPF_STATIC | PKGCONF_PKG_PROPF_VIRTUAL,
 	};
 
+	if (pkgconf_pledge("stdio rpath wpath cpath unveil", NULL) == -1)
+	{
+		fprintf(stderr, "pkgconf: pledge failed: %s\n", strerror(errno));
+		return EXIT_FAILURE;
+	}
+
 	want_flags = 0;
 
 #ifdef _WIN32
@@ -1218,9 +1265,6 @@ main(int argc, char *argv[])
 #endif
 	}
 
-	pkgconf_path_copy_list(&personality->dir_list, &dir_list);
-	pkgconf_path_free(&dir_list);
-
 #ifndef PKGCONF_LITE
 	if ((want_flags & PKG_DUMP_PERSONALITY) == PKG_DUMP_PERSONALITY)
 	{
@@ -1232,6 +1276,13 @@ main(int argc, char *argv[])
 	/* now, bring up the client.  settings are preserved since the client is prealloced */
 	pkgconf_client_init(&pkg_client, error_handler, NULL, personality);
 
+	/* unveil the entire search path now that we have loaded the personality data. */
+	if (!unveil_search_paths(&pkg_client, personality))
+	{
+		fprintf(stderr, "pkgconf: unveil failed: %s\n", strerror(errno));
+		return EXIT_FAILURE;
+	}
+
 #ifndef PKGCONF_LITE
 	if ((want_flags & PKG_MSVC_SYNTAX) == PKG_MSVC_SYNTAX || getenv("PKG_CONFIG_MSVC_SYNTAX") != NULL)
 		want_render_ops = msvc_renderer_get();
@@ -1259,6 +1310,9 @@ main(int argc, char *argv[])
 		pkgconf_client_set_trace_handler(&pkg_client, error_handler, NULL);
 #endif
 
+	pkgconf_path_prepend_list(&pkg_client.dir_list, &dir_list);
+	pkgconf_path_free(&dir_list);
+
 	if ((want_flags & PKG_ABOUT) == PKG_ABOUT)
 	{
 		about();
@@ -1398,6 +1452,9 @@ main(int argc, char *argv[])
 	/* at this point, want_client_flags should be set, so build the dir list */
 	pkgconf_client_dir_list_build(&pkg_client, personality);
 
+	/* preload any files in PKG_CONFIG_PRELOADED_FILES */
+	pkgconf_client_preload_from_environ(&pkg_client, "PKG_CONFIG_PRELOADED_FILES");
+
 	if (required_pkgconfig_version != NULL)
 	{
 		if (pkgconf_compare_version(PACKAGE_VERSION, required_pkgconfig_version) >= 0)
@@ -1427,6 +1484,12 @@ main(int argc, char *argv[])
 
 	if (logfile_arg != NULL)
 	{
+		if (pkgconf_unveil(logfile_arg, "rwc") == -1)
+		{
+			fprintf(stderr, "pkgconf: unveil failed: %s\n", strerror(errno));
+			return EXIT_FAILURE;
+		}
+
 		logfile_out = fopen(logfile_arg, "w");
 		pkgconf_audit_set_log(&pkg_client, logfile_out);
 	}
@@ -1619,6 +1682,13 @@ cleanup3:
 		goto out;
 	}
 
+	/* we shouldn't need to unveil any more filesystem accesses from this point, so lock it down */
+	if (pkgconf_unveil(NULL, NULL) == -1)
+	{
+		fprintf(stderr, "pkgconf: unveil lockdown failed: %s\n", strerror(errno));
+		return EXIT_FAILURE;
+	}
+
 #ifndef PKGCONF_LITE
 	if ((want_flags & PKG_SIMULATE) == PKG_SIMULATE)
 	{

{pkgconf-2.4.3.post3 → pkgconf-2.5.1.post1}/subprojects/pkgconf/configure.ac

@@ -12,7 +12,7 @@ dnl implied.  In no event shall the authors be liable for any damages arising
 dnl from the use of this software.
 
 AC_PREREQ([2.71])
-AC_INIT([pkgconf],[2.4.3],[https://github.com/pkgconf/pkgconf/issues/new])
+AC_INIT([pkgconf],[2.5.1],[https://github.com/pkgconf/pkgconf/issues/new])
 AC_CONFIG_SRCDIR([cli/main.c])
 AC_CONFIG_MACRO_DIR([m4])
 AX_CHECK_COMPILE_FLAG([-Wall], [CFLAGS="$CFLAGS -Wall"])
@@ -23,6 +23,7 @@ AX_CHECK_COMPILE_FLAG([-std=gnu99], [CFLAGS="$CFLAGS -std=gnu99"], [
 ])
 AC_CONFIG_HEADERS([libpkgconf/config.h])
 AC_CHECK_DECLS([strlcpy, strlcat, strndup], [], [], [[#include <string.h>]])
+AC_CHECK_DECLS([pledge, unveil], [], [], [[#include <unistd.h>]])
 AC_CHECK_DECLS([reallocarray])
 AC_CHECK_HEADERS([sys/stat.h])
 AM_INIT_AUTOMAKE([foreign dist-xz subdir-objects])

{pkgconf-2.4.3.post3 → pkgconf-2.5.1.post1}/subprojects/pkgconf/libpkgconf/argvsplit.c

@@ -59,7 +59,10 @@ pkgconf_argv_free(char **argv)
 int
 pkgconf_argv_split(const char *src, int *argc, char ***argv)
 {
-	char *buf = malloc(strlen(src) + 1);
+	char *buf = calloc(1, strlen(src) + 1);
+	if (buf == NULL)
+		return -1;
+
 	const char *src_iter;
 	char *dst_iter;
 	int argc_count = 0;
@@ -70,9 +73,13 @@ pkgconf_argv_split(const char *src, int *argc, char ***argv)
 	src_iter = src;
 	dst_iter = buf;
 
-	memset(buf, 0, strlen(src) + 1);
-
 	*argv = calloc(argv_size, sizeof (void *));
+	if (*argv == NULL)
+	{
+		free(buf);
+		return -1;
+	}
+
 	(*argv)[argc_count] = dst_iter;
 
 	while (*src_iter)