Source Mage code commit list

[Thomas Orgis <scm AT sourcemage.org>]

GIT changes to master grimoire by Thomas Orgis <sobukus AT sourcemage.org>:

 dev/null            |binary
 disk/lvm/BUILD      |    2 +-
 disk/lvm/HISTORY    |    3 +++
 libs/libdrm/DETAILS |    6 +-----
 libs/libdrm/HISTORY |    5 +++++
 5 files changed, 10 insertions(+), 6 deletions(-)

New commits:
commit 13377fddd81b7c828d6e33f974af7b03c17bed84
Author: Thomas Orgis <sobukus AT sourcemage.org>
Commit: Thomas Orgis <sobukus AT sourcemage.org>

    libdrm: un-break by dropping GPG signature
    
    The used key was missing from drm.gpg, apparently (at least for my gpg
    command ... where did Treeve get the key from?!). We discussed this again
    and again: Relying on upstream sigs is bad. At least we'd need to also
    verify the hash of the sig.
    
    Otherwise, the file can be changed by upstream or attacker with access
    to a key at will. And regarding access to a key: We accumulate key after
    key and increase the attack surface for compromising one of them.
    
    Thinking again: Maybe the key just expired right now. That is the other
    reason: Upstream sigs break at predetermined times whent he keys expire
    and gpg refuses to check using them!
    
    DO NOT USE UPSTREAM GPG. We should really purge that. Now.
    
    Upstream signatures should be checked once by the developer doing an
    update, locally. Then the hash enters the grimoire. This is stable and
    as trustworthy as we can get.
    
    Now we need that spell that installs and updates a database (with wrapper
    script) of upstream keys for mages to use.

commit a4185e43ce05dc4ba690002bb69c93bb5f237656
Author: Thomas Orgis <sobukus AT sourcemage.org>
Commit: Thomas Orgis <sobukus AT sourcemage.org>

    lvm2: un-break build

diff --git a/disk/lvm/BUILD b/disk/lvm/BUILD
index cd39f99..b20fe09 100755
--- a/disk/lvm/BUILD
+++ b/disk/lvm/BUILD
@@ -1,4 +1,4 @@
-LDFLAGS+="-fuse-ld=bfd" &&
+LDFLAGS+=" -fuse-ld=bfd" &&
 ./configure --build=$BUILD                             \
             --prefix=$INSTALL_ROOT/usr                 \
             --sbindir=$INSTALL_ROOT/sbin               \
diff --git a/disk/lvm/HISTORY b/disk/lvm/HISTORY
index d255d32..8645f6f 100644
--- a/disk/lvm/HISTORY
+++ b/disk/lvm/HISTORY
@@ -1,3 +1,6 @@
+2024-01-02 Thomas Orgis <sobukus AT sourcemage.org>
+       * BUILD: Un-break build with non-empty LDFLAGS (as-needed, anyone?).
+
 2023-12-23 Treeve Jelbert <treeve AT sourcemage.org>
        * DETAILS: version 2.03.23
        * BUILD: don not use gold linker
diff --git a/libs/libdrm/DETAILS b/libs/libdrm/DETAILS
index 754ef60..a778739 100755
--- a/libs/libdrm/DETAILS
+++ b/libs/libdrm/DETAILS
@@ -12,11 +12,7 @@ else
          VERSION=2.4.119
           SOURCE=${SPELL}-${VERSION}.tar.xz
    SOURCE_URL[0]=https://dri.freedesktop.org/${SPELL}/${SOURCE}
-# Watch: https://dri.freedesktop.org/libdrm/
-         SOURCE2=$SOURCE.sig
-  SOURCE2_URL[0]=${SOURCE_URL[0]}.sig
-      SOURCE_GPG=drm.gpg:$SOURCE.sig:UPSTREAM_KEY
-  SOURCE2_IGNORE=signature
+     
SOURCE_HASH=sha512:c8dd7665e85c01a67fcce1c1c614bc05a3ec311f31cae7de5fb1cd27d0f11f1801be63de3fa3e33b2f505544fd4b1bc292965c5e8de46a3beaaedb10334945ca
 SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
 fi
         WEB_SITE=http://dri.freedesktop.org/
diff --git a/libs/libdrm/HISTORY b/libs/libdrm/HISTORY
index b19c8ab..c18127a 100644
--- a/libs/libdrm/HISTORY
+++ b/libs/libdrm/HISTORY
@@ -1,3 +1,8 @@
+2024-01-02 Thomas Orgis <sobukus AT sourcmage.org>
+       * DETAILS: Signature key not found in drm.gpg, switch to
+         hash computed from https download. 
+       * drm.gpg: gone
+
 2023-12-22 Treeve Jelbert <treeve AT sourcemage.org>
        * DETAILS: version 2.4.119
 
diff --git a/libs/libdrm/drm.gpg b/libs/libdrm/drm.gpg
deleted file mode 100644
index 96cd64a..0000000
Binary files a/libs/libdrm/drm.gpg and /dev/null differ