abuild-rootbld: copy SRCDEST value from host to chroot

Otherwise the default hardcoded in abuild-fetch (var/cache/distfiles) is
used.

(in the same vein as 6864df03aa)

Fixes: 1582617 ("abuild-rootbld: clear environment for bwrap container")

.editorconfig

@@ -20,3 +20,7 @@ indent_style = space
 [Makefile]
 indent_size = 8
 indent_style = tab
+
+[*.yml]
+indent_size = 2
+indent_style = space

.gitignore

@@ -11,6 +11,7 @@ abuild-rmtemp
 abuild-sign
 abuild-sudo
 abuild-tar
+abuild.conf
 abump
 ap
 apkbuild-cpan

.gitlab-ci.yml

@@ -5,7 +5,27 @@ tests:
   image:
     name: alpinelinux/abuild-ci
   stage: verify
-  script: [pwd]
+  script:
+    - make
+    - make check
+  tags:
+    - docker-alpine
+    - x86_64
+
+build-clang:
+  image:
+    name: alpinelinux/abuild-ci
+  stage: verify
+  script: [CC=clang make]
+  tags:
+    - docker-alpine
+    - x86_64
+
+build-scan:
+  image:
+    name: alpinelinux/abuild-ci
+  stage: verify
+  script: [scan-build --status-bugs make]
   tags:
     - docker-alpine
     - x86_64

APKBUILD.5.scd

@@ -168,6 +168,12 @@ file.
 	Specifies packages that the package replaces. This is typically
 	used for packages renamed by upstream.
 
+*replaces_priority*
+	Specifies the numeric value that is used by apk(8) when multiple
+	packages with *replaces* include the same file. It is also used
+	to decide which package should define the permissions of a directory
+	even without *replaces* set.
+
 *subpackages*
 	Specifies subpackages or split packages built with this
 	package. Typically, this will include _$pkgname-dev_ for development
@@ -215,6 +221,11 @@ file.
 		packages containing firmware, and should typically never
 		be needed.
 
+	*bigdocs*
+		Specifies that this packages intentionally has a large -doc subpackage.
+		Thereby suppressing a warning to be emitted if the -doc subpackage
+		exceeds a certain package size threshold (currently 2 MiB).
+
 	*charset.alias*
 		Specifies that the package ships a _/usr/lib/charset.alias_
 		file and that it should be installed on the user's
@@ -273,6 +284,12 @@ file.
 		to use capabilities or process separation instead of set-uid
 		where available.
 
+	*setcap*
+		Specifies that binaries in the package may be installed
+		with extra setcap(8) capabilities. If this option is enabled,
+		it is highly recommended to only make these binaries executable
+		by root and users of a specific group, not by others.
+
 	*textrels*
 		Specifies that the package's binaries are known to contain
 		relocations against text segments. By default, abuild(1)

Makefile

@@ -1,5 +1,5 @@
 PACKAGE		:= abuild
-VERSION		:= 3.11.0_rc7
+VERSION		:= 3.13.0
 
 prefix		?= /usr
 bindir		?= $(prefix)/bin
@@ -11,7 +11,7 @@ SCRIPTS		:= abuild abuild-keygen abuild-sign newapkbuild \
 		   abump apkgrel buildlab apkbuild-cpan apkbuild-pypi checkapk \
 		   apkbuild-gem-resolver
 USR_BIN_FILES	:= $(SCRIPTS) abuild-tar abuild-gzsplit abuild-sudo abuild-fetch abuild-rmtemp
-MAN_1_PAGES	:= newapkbuild.1
+MAN_1_PAGES	:= newapkbuild.1 abuild.1 abump.1
 MAN_5_PAGES	:= APKBUILD.5
 SAMPLES		:= sample.APKBUILD sample.initd sample.confd \
 		sample.pre-install sample.post-install
@@ -60,7 +60,10 @@ OBJS-abuild-fetch = abuild-fetch.o
 
 TEST_TIMEOUT = 15
 
-.SUFFIXES:	.sh.in .in
+.SUFFIXES:	.conf.in .sh.in .in
+%.conf: %.conf.in
+	${SED} ${SED_REPLACE} ${SED_EXTRA} $< > $@
+
 %.sh: %.sh.in
 	${SED} ${SED_REPLACE} ${SED_EXTRA} $< > $@
 	${CHMOD} +x $@
@@ -77,10 +80,10 @@ TEST_TIMEOUT = 15
 
 P=$(PACKAGE)-$(VERSION)
 
-all:	$(USR_BIN_FILES) $(MAN_PAGES) functions.sh
+all:	$(USR_BIN_FILES) $(MAN_PAGES) functions.sh abuild.conf
 
 clean:
-	@rm -f $(USR_BIN_FILES) $(MAN_PAGES) *.o functions.sh Kyuafile \
+	@rm -f $(USR_BIN_FILES) $(MAN_PAGES) *.o functions.sh abuild.conf Kyuafile \
 		tests/Kyuafile tests/testdata/abuild.key*
 
 %.o: %.c
@@ -124,9 +127,9 @@ Kyuafile: tests/Kyuafile
 	echo "include('tests/Kyuafile')" >> $@
 
 check: $(SCRIPTS) $(USR_BIN_FILES) functions.sh tests/Kyuafile Kyuafile tests/testdata/abuild.key.pub
-	kyua test || (kyua report --verbose && exit 1)
+	kyua --variable parallelism=$(shell nproc) test || (kyua report --verbose && exit 1)
 
-install: $(USR_BIN_FILES) $(SAMPLES) $(MAN_PAGES) abuild.conf functions.sh
+install: $(USR_BIN_FILES) $(SAMPLES) $(MAN_PAGES) default.conf abuild.conf functions.sh
 	install -d $(DESTDIR)/$(bindir) $(DESTDIR)/$(sysconfdir) \
 		$(DESTDIR)/$(sharedir) $(DESTDIR)/$(mandir)/man1 \
 		$(DESTDIR)/$(mandir)/man5
@@ -144,11 +147,12 @@ install: $(USR_BIN_FILES) $(SAMPLES) $(MAN_PAGES) abuild.conf functions.sh
 		install -m 644 $$i $(DESTDIR)/$(mandir)/man5/$$i;\
 	done
 	if [ -n "$(DESTDIR)" ] || [ ! -f "/$(sysconfdir)"/abuild.conf ]; then\
-		cp abuild.conf $(DESTDIR)/$(sysconfdir)/; \
+		install -t $(DESTDIR)/$(sysconfdir)/ abuild.conf; \
 	fi
-	cp $(SAMPLES) $(DESTDIR)/$(prefix)/share/abuild/
-	cp $(AUTOTOOLS_TOOLCHAIN_FILES) $(DESTDIR)/$(prefix)/share/abuild/
-	cp functions.sh $(DESTDIR)/$(sharedir)/
+
+	install -t $(DESTDIR)/$(prefix)/share/abuild/ $(SAMPLES)
+	install -t $(DESTDIR)/$(prefix)/share/abuild/ $(AUTOTOOLS_TOOLCHAIN_FILES)
+	install -t $(DESTDIR)/$(sharedir)/ functions.sh default.conf
 
 depends depend:
 	sudo apk --no-cache -U --virtual .abuild-depends add openssl-dev zlib-dev

abuild-fetch.c

@@ -34,6 +34,7 @@ THE SOFTWARE.
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <time.h>
 #include <unistd.h>
 
 static char *program;
@@ -181,7 +182,9 @@ fetch_done:
 	release_lock(lockfd);
 
 	// give other processes the chance to acquire the lock if they have the file open
-	sleep(0);
+	// sleep for a millisecond
+	const struct timespec ts = { .tv_sec = 0, .tv_nsec = 1000000};
+	nanosleep(&ts, NULL);
 
 	if (status == 0 || try_lock(lockfd))
 		unlink(lockfile);

abuild-keygen.in

@@ -90,6 +90,41 @@ do_keygen() {
 	msg ""
 }
 
+do_kernel_key() {
+	mkdir -p "$ABUILD_USERDIR"
+	pem="$ABUILD_USERDIR"/kernel_signing_key.pem
+	(
+	umask 0007
+	# https://www.kernel.org/doc/html/v6.1/admin-guide/module-signing.html#generating-signing-keys
+	openssl req -verbose -new -nodes -utf8 -sha256 -days 36500 -batch -x509 \
+		-outform PEM -out "$pem" \
+		-keyout "$pem" -config - <<-EOF
+			[ req ]
+			default_bits = 4096
+			distinguished_name = req_distinguished_name
+			prompt = no
+			string_mask = utf8only
+			x509_extensions = myexts
+
+			[ req_distinguished_name ]
+			O = alpinelinux.org
+			CN = Alpine Linux kernel key
+			#emailAddress = unspecified.user@unspecified.company
+
+			[ myexts ]
+			basicConstraints=critical,CA:FALSE
+			keyUsage=digitalSignature
+			subjectKeyIdentifier=hash
+			authorityKeyIdentifier=keyid
+		EOF
+	)
+	msg "Kernel signing key was created: $pem"
+	if ! grep -q "^KERNEL_SIGNING_KEY=" "$ABUILD_USERCONF" 2>/dev/null; then
+		echo "KERNEL_SIGNING_KEY='$pem'" >> "$ABUILD_USERCONF"
+	fi
+	msg "KERNEL_SIGNING_KEY='$pem' was added to $ABUILD_USERCONF"
+}
+
 usage() {
 	cat <<-__EOF__
 		$program $program_version - generate signing keys
@@ -100,6 +135,7 @@ usage() {
 
 		  -i, --install        Install public key into /etc/apk/keys using doas
 		  -n                   Non-interactive. Use defaults
+		      --kernel         Generate a key for kernel modules
 		  -b, --numbits [BITS] The size of the private key to generate in bits.
 		  -q, --quiet
 		  -h, --help           Show this help
@@ -116,8 +152,9 @@ install_pubkey=
 interactive=1
 numbits=4096
 quiet=
+kernel_key=
 
-args=$(getopt -o ab:inqh --long append,numbits:,install,quiet,help -n "$program" -- "$@")
+args=$(getopt -o ab:inqh --long append,numbits:,install,quiet,help,kernel -n "$program" -- "$@")
 if [ $? -ne 0 ]; then
 	usage
 	exit 2
@@ -127,6 +164,7 @@ while true; do
 	case $1 in
 		-a|--append) append_config=1;;
 		-i|--install) install_pubkey=1;;
+		--kernel) kernel_key=1;;
 		-n) unset interactive ;;
 		-b|--numbits) numbits="$2"; shift 1;;
 		-q|--quiet) quiet=1;; # suppresses msg
@@ -141,4 +179,8 @@ if [ $# -ne 0 ]; then
 	exit 2
 fi
 
+if [ -n "$kernel_key" ]; then
+	do_kernel_key
+	exit
+fi
 do_keygen

abuild-rmtemp.c

@@ -18,7 +18,7 @@
 
 #define PREFIX "/var/tmp/abuild."
 
-static void fail() {
+static void fail(void) {
 	errx(1, "%s", strerror(errno));
 }
 

abuild-sudo.c

@@ -62,7 +62,7 @@ void check_option(const char *opt)
 
 int is_in_group(gid_t group)
 {
-	int ngroups_max = sysconf(_SC_NGROUPS_MAX) + 1;
+	int ngroups_max = getgroups(0, 0);
 	gid_t *buf = malloc(ngroups_max * sizeof(gid_t));
 	int ngroups;
 	int i;
@@ -125,9 +125,11 @@ int main(int argc, const char *argv[])
 
 	argv[0] = path;
 	/* set our uid to root so bbsuid --install works */
-	setuid(0);
+	if (setuid(0) < 0)
+		err(1, "setuid(0) failed");
 	/* set our gid to root so apk commit hooks run with the same gid as for "sudo apk add ..." */
-	setgid(0);
+	if (setgid(0) < 0)
+		err(1, "setgid(0) failed");
 	execv(path, (char * const*)argv);
 	perror(path);
 	return 1;

abuild-tar.c

@@ -221,7 +221,8 @@ static int buf_padto(struct buf *b, size_t alignment)
 	newsize = (oldsize + alignment - 1) & -alignment;
 	if (buf_resize(b, newsize)) return -ENOMEM;
 	b->size = newsize;
-	memset(b->ptr + oldsize, 0, newsize - oldsize);
+	if (b->ptr)
+		memset(b->ptr + oldsize, 0, newsize - oldsize);
 	return 0;
 }
 
@@ -260,6 +261,8 @@ static int buf_add_ext_header_hexdump(struct buf *b, const char *hdr, const unsi
 	for (i = len; i > 9; i /= 10) len++;
 
 	if (buf_resize(b, b->size + len)) return -ENOMEM;
+	if (b->ptr == NULL)
+		return 0;
 	b->size += snprintf(&b->ptr[b->size], len, "%u %s=", len, hdr);
 	for (i = 0; i < valuelen; i++)
 		b->size += snprintf(&b->ptr[b->size], 3, "%02x", (int)value[i]);
@@ -385,7 +388,10 @@ int main(int argc, char **argv)
 	ENGINE_register_all_complete();
 #endif
 
-	while (getopt_long(argc, argv, "", options, &ndx) != -1) {
+	int c;
+	while ((c = getopt_long(argc, argv, "", options, &ndx)) != -1) {
+		if (c == '?')
+			return usage(stderr);
 		if (ndx == 0)
 			digest = optarg ? optarg : "sha1";
 	}

abuild.1.scd

@@ -0,0 +1,166 @@
+abuild(1)
+
+# NAME
+
+*abuild* - build an apk from an APKBUILD
+
+# SYNOPSIS
+
+*abuild* [options] [-P _REPODEST_] [-s _SRCDEST_] [-D _DESCRIPTION_] [cmd] ...
+
+# DESCRIPTION
+
+*abuild* builds an apk binary package based on an input APKBUILD(5), as well as
+other related operations.
+
+# OPTIONS
+
+*-A*
+	Print CARCH and exit
+
+*-c*
+	Enable colored output
+
+*-d*
+	Disable dependency checking
+
+*-D*
+	Set APKINDEX description (default: *$repo $(git describe)*)
+
+*-f*
+	Force specified cmd (skip checks: apk up to date, arch)
+
+*-F*
+	Force run as root
+
+*-h*
+	Show this help
+
+*-k*
+	Keep built packages, even if APKBUILD or sources are newer
+
+*-K*
+	Keep buildtime temp dirs and files (srcdir/pkgdir/deps)
+
+*-m*
+	Disable colors (monochrome)
+
+*-P*
+	Set REPODEST as the repository location for created packages
+
+*-q*
+	Quiet
+
+*-r*
+	Install missing dependencies from system repository (using sudo)
+
+*-s*
+	Set source package destination directory
+
+*-v*
+	Verbose: show every command as it is run (very noisy)
+
+# COMMANDS
+
+*build*
+	Compile and install package into *$pkgdir*.
+
+*check*
+	Run any defined tests concerning the package
+
+*checksum*
+	Generate checksum to be included in APKBUILD
+
+*clean*
+	Remove temp build and install dirs
+
+*cleancache*
+	Remove downloaded files from $SRCDEST
+
+*cleanoldpkg*
+	Remove binary packages except current version
+
+*cleanpkg*
+	Remove already built binary and source package
+
+*deps*
+	Install packages listed in makedepends and depends
+
+*fetch*
+	Fetch sources to $SRCDEST (consider: 'abuild fetch verify')
+
+*index*
+	Regenerate indexes in $REPODEST
+
+*listpkg*
+	List target packages
+
+*package*
+	Install project into
+
+*prepare*
+	Apply patches
+
+*rootbld*
+	Build package in clean chroot. Requires *abuild-rootbld*.
+
+*rootpkg*
+	Run 'package', the split functions and create apks as fakeroot
+
+*sanitycheck*
+	Basic sanity check of APKBUILD
+
+*snapshot*
+	Create a *$giturl* snapshot and upload to *$disturl*
+
+*sourcecheck*
+	Check if remote source package exists upstream
+
+*srcpkg*
+	Make a source package
+
+*undeps*
+	Uninstall packages listed in makedepends and depends
+
+*unpack*
+	Unpack sources to $srcdir
+
+*up2date*
+	Compare target and sources dates
+
+*verify*
+	Verify checksums
+
+# FILES
+
+/etc/abuild.conf
+	Configuration is read from this file by default.
+
+$HOME/.abuild/abuild.conf
+	User-specific configuration is read from this file, if it exists.
+
+# EXAMPLES
+
+Update checksums for an APKBUILD:
+
+```
+abuild checksum
+```
+
+Build an APKBUILD and print coloured output:
+
+```
+abuild -rc
+```
+
+# SEE ALSO
+
+SPDX license reference (on the Web at <https://spdx.org/licenses/>),
+newapkbuild(1), apk(8), APKBUILD(5).
+
+# AUTHORS
+
+*abuild*: Natanael Copa <_ncopa@alpinelinux.org_>
+
+Documentation:++
+Hugo Osvaldo Barrera <_hugo@whynothugo.nl_>

abuild.conf.in

@@ -0,0 +1,26 @@
+# defaults are in @sharedir@/default.conf
+#
+# uncomment line below to enable colors
+#USE_COLORS=1
+
+# uncomment line below to enable ccache support.
+#USE_CCACHE=1
+
+# where downloaded files are stored
+#SRCDEST=/var/cache/distfiles
+
+# uncomment line below to store built packages in other location
+# The package will be stored as $REPODEST/$repo/$pkgname-$pkgver-r$pkgrel.apk
+# where $repo is the name of the parent directory of $startdir.
+#REPODEST=$HOME/packages/
+
+# PACKAGER and MAINTAINER are used by newapkbuild when creating new aports for
+# the APKBUILD's "Contributor:" and "Maintainer:" comments, respectively.
+#PACKAGER="Your Name <your@email.address>"
+#MAINTAINER="$PACKAGER"
+
+# what to clean up after a successful build
+#CLEANUP="srcdir bldroot pkgdir deps"
+
+# what to cleanup after a failed build
+#ERROR_CLEANUP="bldroot deps"

abuild.in

@@ -1,4 +1,5 @@
 #!/bin/ash -e
+# vim: set filetype=sh:
 
 # abuild - build apk packages (light version of makepkg)
 # Copyright (c) 2008-2015 Natanael Copa <ncopa@alpinelinux.org>
@@ -32,6 +33,7 @@ fi
 : ${SETFATTR:="setfattr"}
 
 apk_opt_wait="--wait 30"
+doc_threshold=$((2 * 1024 * 1024)) # 2 MiB
 
 umask 022
 
@@ -76,17 +78,17 @@ amove() {
 	d="$(pwd -L)"
 
 	cd "$pkgdir"
-	local pattern f
+	local pattern f IFS=""
 	for pattern; do
 		for f in ${pattern#/}; do # let shell expand the pattern
 			# strip trailing /
 			f=${f%/}
 			if [ "${f%/*}" != "$f" ]; then
 				mkdir -p "$subpkgdir/${f%/*}"
-				mv -v "$pkgdir"/$f "$subpkgdir/${f%/*}"
+				mv -v "$pkgdir/$f" "$subpkgdir/${f%/*}"
 			else
 				mkdir -p "$subpkgdir"
-				mv -v "$pkgdir"/$f "$subpkgdir/"
+				mv -v "$pkgdir/$f" "$subpkgdir/"
 			fi
 			# cleanup
 			rmdir -p "$f" 2>/dev/null || rmdir -p "${f%/*}" 2>/dev/null || true
@@ -155,6 +157,7 @@ cleanup() {
 			fi;;
 		pkgdir) msg "Cleaning up pkgdir"; rm -rf "$pkgbasedir";;
 		srcdir) msg "Cleaning up srcdir"; cleanup_srcdir;;
+		tmpdir) msg "Cleaning up tmpdir"; rm -rf "$tmpdir";;
 		deps)
 			if [ -n "$uninstall_after" ]; then
 				msg "Uninstalling dependencies..."
@@ -177,30 +180,30 @@ spell_error() {
 }
 
 verify_pkgname() {
-	local name=${1%%=*}
-	case "$name" in
-		""|*" "*|-*) return 1;;
+	case $1 in
+		''|*[!a-zA-Z0-9._+-]*|[!a-zA-Z0-9]*) return 1;;
 	esac
 	return 0
 }
 
 # check if apkbuild is basically sane
 default_sanitycheck() {
-	local i= j= suggestion=
+	local i= j=
 	msg "Checking sanity of $APKBUILD..."
 	[ -z "$pkgver" ] && die "Missing pkgver in APKBUILD"
-	if [ -z "$nodeps" ]; then
-		$APK version --check --quiet "$pkgver" ||\
-			die "$pkgver is not a valid version"
-	fi
+	$APK version --check --quiet -- "$pkgver"-r0 || \
+		die "$pkgver is not a valid version"
 	[ -z "$pkgrel" ] && die "Missing pkgrel in APKBUILD"
 	# give 0 as it is always valid and give the pkgrel
 	$APK version --check --quiet 0-r"$pkgrel" || \
 		die "$pkgrel is not a valid pkgrel"
-	# warn when p1 should be _p1
-	case "$pkgver" in
-		*[0-9]p[0-9]) warning "pkgver should probably be $(echo "$pkgver" | sed -E -e 's/(.*[0-9])p([0-9])/\1_p\2/')";;
+	# digit+letter+digit passes the apk2 version check
+	case $pkgver in
+		*[0-9][a-z][0-9]*)
+			die "the digit+letter+digit version format is invalid. Use suffixes instead"
+			;;
 	esac
+
 	[ -z "$pkgdesc" ] && die "Missing pkgdesc in APKBUILD"
 	[ -z "$url" ] && die "Missing url in APKBUILD"
 	[ -z "$license" ] && die "Missing license in APKBUILD"
@@ -316,6 +319,9 @@ default_sanitycheck() {
 	check_secfixes_comment || return 1
 
 	makedepends_has 'g++' && ! options_has toolchain && warning "g++ should not be in makedepends"
+	if makedepends_has 'go' && ! options_has 'net'; then
+		warning "Go packages require network connection to build. Maybe add 'net' to options"
+	fi
 
 	if ! options_has "!check" && [ -n "$REQUIRE_CHECK" ]; then
 		(unset check; . "$APKBUILD"; type check >/dev/null 2>&1) || \
@@ -552,10 +558,11 @@ unpack() {
 	default_unpack
 }
 
-# cleanup source and package dir
+# cleanup source, package and temporary dir
 clean() {
 	cleanup srcdir
 	cleanup pkgdir
+	cleanup tmpdir
 }
 
 # cleanup fetched sources
@@ -597,19 +604,25 @@ subpkg_set() {
 	subpkgarch=${_splitarch#*:}
 	if [ "$subpkgarch" = "$_splitarch" -o -z "$subpkgarch" ]; then
 		case "$subpkgname" in
-		*-doc | *-openrc | *-lang | *-lang-* | *sh-completion) subpkgarch="noarch" ;;
+		*-doc | *-openrc | *-lang | *-lang-* | *sh-completion | *-pyc) subpkgarch="noarch" ;;
 		*) subpkgarch="$pkgarch" ;;
 		esac
 	fi
 }
 
+arch2dir() {
+	local arch="$1"
+	[ "$arch" = "noarch" -o "$arch" = "all" ] && arch="$CARCH"
+	printf '%s\n' "$arch"
+}
+
 cleanpkg() {
 	local i
 	msg "Cleaning built packages..."
 	rm -f "$REPODEST/$repo/src/$pkgname-$pkgver-r$pkgrel.src.tar.gz"
 	for i in $allpackages; do
 		subpkg_set "$i"
-		rm -f "$REPODEST/$repo/${subpkgarch/noarch/$CARCH}/$subpkgname-$pkgver-r$pkgrel.apk"
+		rm -f "$REPODEST/$repo/$(arch2dir "$subpkgarch")/$subpkgname-$pkgver-r$pkgrel.apk"
 	done
 	subpkg_unset
 
@@ -657,7 +670,7 @@ mkusers() {
 # helper to update config.sub to a recent version
 update_config_sub() {
 	find . -name config.sub | (local changed=false; while read f; do
-		if ! ./$f riscv64-alpine-linux-musl 2>/dev/null; then
+		if ! ./$f loongarch64-alpine-linux-musl 2>/dev/null; then
 			msg "Updating $f"
 			cp "$sharedir"/${f##*/} "$f" || return 1
 			changed=true
@@ -670,7 +683,7 @@ update_config_sub() {
 # helper to update config.guess to a recent version
 update_config_guess() {
 	find . -name config.guess | (local changed=false; while read f; do
-		if grep -q aarch64 "$f" && grep -q ppc64le "$f" && grep -q riscv64 "$f"; then
+		if grep -q aarch64 "$f" && grep -q ppc64le "$f" && grep -q riscv64 "$f" && grep -q loongarch64 "$f"; then
 			msg "No update needed for $f"
 		else
 			msg "Updating $f"
@@ -689,7 +702,17 @@ runpart() {
 			prepare|build|package|check)
 				# exclude aports from git repo discovery
 				export GIT_CEILING_DIRECTORIES="$startdir"
-				cd "$builddir";;
+
+				# prevent using global cache directories
+				if [ -n "$MOVE_CACHES" ]; then
+					export GOCACHE="${GOCACHE:-"$tmpdir/go"}"
+					export GOMODCACHE="${GOCACHE:-"$tmpdir/gomod"}"
+					export GOTMPDIR="${GOTMPDIR:-"$tmpdir"}"
+					export CARGO_HOME="${CARGO_HOME:-"$tmpdir/cargo"}"
+				fi
+
+				cd "$builddir"
+				;;
 		esac
 	fi
 	$part
@@ -755,15 +778,18 @@ targz() {
 }
 
 postcheck() {
-	local dir="$1" name="$2" i= e=0
+	local dir="$1" name="$2" i= j= e=0
 	msg "Running postcheck for $name"
 	# checking for FHS compat
 	if ! options_has "!fhs"; then
-		for i in "$dir"/srv/* "$dir"/usr/local/* "$dir"/opt/*; do
-			if [ -e "$i" ]; then
-				error "Packages must not put anything under /srv, /usr/local or /opt"
-				e=1
-			fi
+		for i in srv usr/local opt tmp var/tmp var/lock var/empty home sys proc mnt dev; do
+			for j in "$dir"/"$i"/* "$dir"/"$i"/.[!.]* "$dir"/"$i"/..?*; do
+				if [ -L "$j" ] || [ -e "$j" ]; then
+					error "Packages must not put anything under /$i"
+					e=1
+					break
+				fi
+			done
 		done
 		if [ -d "$dir"/usr/var ]; then
 			error "Found /usr/var, localstatedir is most likely wrong"
@@ -817,13 +843,21 @@ postcheck() {
 			warning "Found /usr/share/man but package name doesn't end with -doc"
 		fi
 		# check for uncompressed man pages
-		i=$(find "$dir"/usr/share/man -name '*.[0-8]' -type f | sed "s|^$dir|\t|")
+		i=$(find "$dir"/usr/share/man -name '*.[0-8]' -type f | sed -e 's/^/\t/')
 		if [ -n "$i" ]; then
 			error "Found uncompressed man pages:"
 			echo "$i"
 			e=1
 		fi
 	fi
+	# look for pycache
+	# wildcard should always get the system python dir, and this is faster than
+	# trying to calculate the python version.
+	local pycache="$(find "$dir"/usr/lib/python* \( -type d -a -name "__pycache__" \) 2>/dev/null )"
+	if [ -n "$pycache" ] && [ "${name%-pyc}" = "$name" ]; then
+		warning "Found __pycache__ but package name doesn't end with -pyc"
+	fi
+
 	# check that we don't have any files names with newline
 	i=$(find "$dir" -name $'*\n*')
 	if [ -n "$i" ]; then
@@ -832,7 +866,7 @@ postcheck() {
 		e=1
 	fi
 	# check directory permissions
-	i=$(find "$dir" -type d -perm -777 | sed "s|^$dir|\t|")
+	i=$(find "$dir" -type d -perm -777 | sed -e 's/^/\t/')
 	if [ -n "$i" ]; then
 		warning "World writeable directories found:"
 		echo "$i"
@@ -840,7 +874,7 @@ postcheck() {
 	# check so we dont have any suid root binaries that are not PIE
 	i=$(find "$dir" -type f -perm /6000 \
 		| xargs scanelf --nobanner --etype ET_EXEC \
-		| sed "s|ET_EXEC $dir|\t|")
+		| sed -e 's/ET_EXEC /\t/')
 	if [ -n "$i" ]; then
 		warning "Found non-PIE files that have SUID:"
 		echo "$i"
@@ -856,6 +890,20 @@ postcheck() {
 			e=1
 		fi
 	fi
+	# test capabilities on executables
+	# see: https://gitlab.alpinelinux.org/alpine/tsc/-/issues/45
+	getcap -r "$dir" | (local r=true; while read -r line; do
+		local filename="${line% *}"
+		if ! options_has "setcap"; then
+			error "Found binary with extra capabilities: $filename"
+			r=false
+		fi
+
+		local execothers="$(find "$filename" -perm -o+x)"
+		if [ -n "$execothers" ]; then
+			warning "Found setcap binary executable by others: $filename"
+		fi
+	done; $r) || e=1
 
 	# test for textrels
 	if ! options_has "textrels"; then
@@ -904,6 +952,10 @@ prepare_subpackages() {
 		warning2 "Add \$pkgname-zsh-completion to subpackages"
 	fi
 	if [ -d "$pkgdir"/usr/share/fish/completions ]; then
+		warning "Found /usr/share/fish/completions"
+		warning2 "fish completions for programs should be located in /usr/share/fish/vendor_completions.d"
+	fi
+	if [ -d "$pkgdir"/usr/share/fish/vendor_completions.d ]; then
 		warning "Found /usr/share/fish/completions"
 		warning2 "Add \$pkgname-fish-completion to subpackages"
 	fi
@@ -912,6 +964,7 @@ prepare_subpackages() {
 default_lang() {
 	pkgdesc="Languages for package $pkgname"
 	install_if="$pkgname=$pkgver-r$pkgrel lang"
+	depends="$depends_lang"
 
 	local dir
 	for dir in ${langdir:-/usr/share/locale}; do
@@ -994,12 +1047,12 @@ check_maintainer() {
 check_license() {
 	local ret=0
 	local license_list=/usr/share/spdx/license.lst
-	local exclude="AND OR WITH ( )"
 	if options_has "!spdx" || ! [ -f "$license_list" ]; then
 		return 0
 	fi
+	local IFS="$IFS()"
 	local i; for i in $license; do
-		list_has "$i" $exclude && continue
+		list_has "$i" AND OR WITH && continue
 		if ! grep -q -x -F "$i" "$license_list"; then
 			ret=1
 			warning "\"$i\" is not a known license"
@@ -1044,7 +1097,7 @@ check_depends_dev() {
 check_provides() {
 	local i
 	for i in $provides; do
-		if [ "${i%%[<>=]*}" = "$pkgname" ]; then
+		if [ "${i%%[<>=~]*}" = "$pkgname" ]; then
 			return 1
 		fi
 	done
@@ -1105,7 +1158,6 @@ prepare_metafiles() {
 	if [ -n "$FAKEROOTKEY" ]; then
 		echo "# using $($FAKEROOT -v)" >> "$pkginfo"
 	fi
-	echo "# $(date -u -d @$SOURCE_DATE_EPOCH)" >> "$pkginfo"
 	cat >> "$pkginfo" <<-EOF
 		pkgname = $name
 		pkgver = $pkgver-r$pkgrel
@@ -1244,9 +1296,16 @@ prepare_command_provides() {
 	options_has "!tracedeps" && return 0
 	cd "$dir" || return 1
 	for i in bin/* sbin/* usr/bin/* usr/sbin/*; do
-		if ! [ -x "$i" ]; then
+		if ! [ -x "$i" ] || ! [ -f "$i" ]; then
 			continue
 		fi
+		# exclude any provides: lines for commands that has '@' because '@'
+		# is used as seperator between command name and repository. This
+		# avoids potential conflicts
+		# ref: https://gitlab.alpinelinux.org/alpine/abuild/-/issues/10074
+		case "$i" in
+			*@*) continue;;
+		esac
 		local f=${i##*/}
 		echo $f >> "$controldir"/.provides-command
 	done
@@ -1439,14 +1498,6 @@ trace_apk_deps() {
 		autodeps="$autodeps pkgconfig"
 	fi
 
-	# special case for libpthread: we need depend on libgcc
-	if [ "$CLIBC" = "uclibc" ] && [ -f "$dir"/.needs-so ] \
-			&& grep -q -w '^libpthread.so.*' "$dir"/.needs-so \
-			&& ! grep -q -w "^depend = libgcc" "$dir"/.PKGINFO; then
-		autodeps="$autodeps libgcc"
-		msg "  added libgcc (due to libpthread)"
-	fi
-
 	[ -f "$dir"/.needs-so ] && for i in $(cat "$dir"/.needs-so); do
 		# first check if its provided by same apkbuild
 		grep -q -w "^$sonameprefix$i" "$dir"/.provides-so 2>/dev/null && continue
@@ -1481,6 +1532,11 @@ trace_apk_deps() {
 		autodeps="$autodeps $i"
 	done
 
+	# python3 dependencies
+	for i in $(sort -u "$dir"/.python3-needs 2>/dev/null); do
+		autodeps="$autodeps $i"
+	done
+
 	# pkg-config depends
 	for i in $(sort -u "$dir"/.needs-pc 2>/dev/null); do
 		# first check if its provided by same apkbuild
@@ -1622,8 +1678,8 @@ scan_shared_objects() {
 	fi
 
 	# now find the so dependencies
-	scanelf --nobanner --recursive --needed "$datadir"  | tr ' ' ':' \
-		| awk -F ":" '$2 != "" && ($1 == "ET_DYN" || $1 == "ET_EXEC") {print $2}'  \
+	scanelf --nobanner --recursive --needed  --etype ET_DYN,ET_EXEC "$datadir"  | tr ' ' ':' \
+		| awk -F ":" '$2 != "" {print $2}'  \
 		| sed 's:,:\n:g' | sort -u \
 	| while read soname; do
 		# only add files that are not self provided
@@ -1674,6 +1730,30 @@ scan_symlink_targets() {
 	done
 }
 
+# check if python3 site packages are installed and depend on a compatible version
+scan_python3_dependency() {
+	local controldir="$2" datadir="$3"
+	local dir_count=0
+	local site_pkg_dir
+	for site_pkg_dir in "$datadir"/usr/lib/python3*/site-packages; do
+		if ! [ -d "$site_pkg_dir" ]; then
+			# empty iteration
+			continue
+		fi
+		dir_count=$((dir_count + 1))
+		if [ "$dir_count" -gt 1 ]; then
+			error "package contains python3 modules for conflicting python3 versions"
+			return 1
+		fi
+		local pyver="${site_pkg_dir##*usr/lib/python}"
+		pyver="${pyver%%/*}"
+		if [ -n "$pyver" ] && [ "${subpkgname:-$pkgname}" != python3 ]; then
+			echo "python3~$pyver" \
+				>> "$controldir"/.python3-needs
+		fi
+	done
+}
+
 #find pkg-config dependencies
 scan_pkgconfig_depends() {
 	local provides_pc="$1" controldir= name= datadir=
@@ -1707,12 +1787,14 @@ human_size() {
 create_apks() {
 	local file= dir= name= ver= apk= datadir= size=
 	local gzip=$(command -v pigz || echo gzip)
-	rmdir "$pkgdir"/usr/lib \
-		"$pkgdir"/usr/bin \
-		"$pkgdir"/usr/share \
-		"$pkgdir"/usr \
-		"$pkgdir"/etc/ \
-		2>/dev/null || :
+	if ! options_has "keepdirs"; then
+		rmdir "$pkgdir"/usr/lib \
+			"$pkgdir"/usr/bin \
+			"$pkgdir"/usr/share \
+			"$pkgdir"/usr \
+			"$pkgdir"/etc/ \
+			2>/dev/null || :
+	fi
 	if ! options_has "!tracedeps"; then
 		for file in "$pkgbasedir"/.control.*/.PKGINFO; do
 			dir="${file%/.PKGINFO}"
@@ -1721,6 +1803,7 @@ create_apks() {
 			subpkgname=$name
 			scan_shared_objects "$name" "$dir" "$datadir"
 			scan_symlink_targets "$name" "$dir" "$datadir"
+			scan_python3_dependency "$name" "$dir" "$datadir"
 		done
 		for file in "$pkgbasedir"/.control.*/.provides-pc; do
 			scan_pkgconfig_depends "$file"
@@ -1731,14 +1814,19 @@ create_apks() {
 		local dir="${file%/.PKGINFO}"
 		local name=$(pkginfo_val pkgname "$file")
 		local ver=$(pkginfo_val pkgver "$file")
-		local size=$(pkginfo_val size "$file" | human_size)
+		local size=$(pkginfo_val size "$file")
 		local apk=$name-$ver.apk
 		local datadir="$pkgbasedir"/$name
 		local subpkgname=$name
 		local subpkgarch=$(pkginfo_val arch "$file")
 
+		# See https://gitlab.alpinelinux.org/alpine/tsc/-/issues/16
+		if ! options_has "bigdocs" && is_doc_pkg "$name" && [ "$size" -gt "$doc_threshold" ]; then
+			warning "The -doc subpackage is unusually large, consider splitting it"
+		fi
+
 		trace_apk_deps "$name" "$dir" "$subpkgarch" || return 1
-		msg "Package size: ${size}"
+		msg "Package size: $(echo "$size" | human_size)"
 		msg "Compressing data..."
 		(
 		cd "$datadir"
@@ -1778,8 +1866,8 @@ create_apks() {
 		abuild-sign -q control.tar.gz || exit 1
 
 		msg "Create $apk"
-		mkdir -p "$REPODEST"/$repo/${subpkgarch/noarch/$CARCH}
-		cat control.tar.gz data.tar.gz > "$REPODEST"/$repo/${subpkgarch/noarch/$CARCH}/$apk
+		mkdir -p "$REPODEST/$repo/$(arch2dir "$subpkgarch")"
+		cat control.tar.gz data.tar.gz > "$REPODEST/$repo/$(arch2dir "$subpkgarch")/$apk"
 		)
 	done
 }
@@ -1796,7 +1884,7 @@ build_abuildrepo() {
 		# check early if we have abuild key
 		abuild-sign --installed
 		logcmd "building $repo/$pkgname-$pkgver-r$pkgrel"
-		local _starttime=$(date --utc +%s)
+		local _starttime=$(date -u +%s)
 		msg "Building $repo/$pkgname $pkgver-r$pkgrel (using $program $program_version) started $(date -R)"
 
 		# make sure SOURCE_DATE_EPOCH is set
@@ -1806,7 +1894,7 @@ build_abuildrepo() {
 				$_check rootpkg; do
 			runpart $part
 		done
-		local _endtime=$(date --utc +%s)
+		local _endtime=$(date -u +%s)
 		local _difftime=$((_endtime - _starttime))
 		msg "Build complete at $(date -R) elapsed time $((_difftime/3600))h $((_difftime/60%60))m $((_difftime%60))s"
 		cleanup $CLEANUP
@@ -1821,9 +1909,9 @@ update_abuildrepo_index() {
 		##NOARCH: These packages are really in $CARCH and do not need their
 		# own repository. --rewrite-arch is used below to make sure the index
 		# thinks they are for $CARCH and apk-tools will fetch them from
-		# correct URL path. Remainder of the script uses ${subpkgarch/noarch/$CARCH}
+		# correct URL path. Remainder of the script uses $(arch2dir "$subpkgarch")
 		# when expanding to the target repository path.
-		[ "$subpkgarch" = "noarch" ] && subpkgarch="$CARCH"
+		[ "$subpkgarch" = "noarch" -o "$subpkgarch" = "all" ] && subpkgarch="$CARCH"
 		list_has "$subpkgarch" "$allarch" || allarch="$allarch $subpkgarch"
 	done
 	subpkg_unset
@@ -2109,13 +2197,34 @@ default_fishcomp() {
 	install_if="$pkgname=$pkgver-r$pkgrel fish"
 
 	cd "$pkgdir" || return 0
-	amove usr/share/fish/completions
+
+	if [ -d usr/share/fish/vendor_completions.d ]; then
+		amove usr/share/fish/vendor_completions.d
+	fi
+
+	if [ -d usr/share/fish/completions ]; then
+		warning "fish completions for programs should be in /usr/share/fish/vendor_completions.d"
+		amove usr/share/fish/completions
+	fi
 }
 
 fishcomp() {
 	default_fishcomp
 }
 
+default_pyc() {
+	pkgdesc="Precompiled Python bytecode for ${subpkgname%-pyc}"
+	install_if="${subpkgname%-pyc}=$pkgver-r$pkgrel pyc"
+
+	cd "$pkgdir" || return 0
+	local IFS=$'\n'
+	amove $(find usr/lib/python* -type d -name __pycache__)
+}
+
+pyc() {
+	default_pyc
+}
+
 is_function() {
 	type "$1" 2>&1 | head -n 1 | grep -E -q "is a (shell )?function"
 }
@@ -2194,17 +2303,12 @@ check_arch() {
 	return $ret
 }
 
-# return true if libc is not masked in options
-check_libc() {
-	! options_has "!libc_$CLIBC"
-}
-
 # check if package is up to date
 apk_up2date() {
 	local i s
 	for i in $allpackages; do
 		subpkg_set "$i"
-		if [ ! -f "$REPODEST/$repo/${subpkgarch/noarch/$CARCH}/$subpkgname-$pkgver-r$pkgrel.apk" ]; then
+		if [ ! -f "$REPODEST/$repo/$(arch2dir "$subpkgarch")/$subpkgname-$pkgver-r$pkgrel.apk" ]; then
 			subpkg_unset
 			return 1
 		fi
@@ -2219,7 +2323,7 @@ apk_up2date() {
 		else
 			s="$startdir/${i##*/}"
 		fi
-		if [ "$s" -nt "$REPODEST/$repo/${pkgarch/noarch/$CARCH}/$pkgname-$pkgver-r$pkgrel.apk" ]; then
+		if [ "$s" -nt "$REPODEST/$repo/$(arch2dir "$pkgarch")/$pkgname-$pkgver-r$pkgrel.apk" ]; then
 			return 1
 		fi
 	done
@@ -2231,7 +2335,7 @@ abuildindex_up2date() {
 
 	for i in $allpackages; do
 		subpkg_set "$i"
-		local dir="$REPODEST"/$repo/${subpkgarch/noarch/$CARCH}
+		local dir="$REPODEST/$repo/$(arch2dir "$subpkgarch")"
 		local idx="$dir"/APKINDEX.tar.gz
 		local file="$dir"/$subpkgname-$pkgver-r$pkgrel.apk
 
@@ -2249,7 +2353,6 @@ abuildindex_up2date() {
 
 up2date() {
 	check_arch || return 0
-	check_libc || return 0
 	apk_up2date && abuildindex_up2date
 }
 
@@ -2263,17 +2366,17 @@ calcdeps() {
 			builddeps="$builddeps $i"
 		done
 		for i in $EXTRADEPENDS_HOST $EXTRADEPENDS_TARGET $makedepends_host; do
-			[ "$pkgname" = "${i%%[<>=]*}" ] && continue
+			[ "$pkgname" = "${i%%[<>=~]*}" ] && continue
 			list_has $i $hostdeps && continue
-			subpackages_has ${i%%[<>=]*} || hostdeps="$hostdeps $i"
+			subpackages_has ${i%%[<>=~]*} || hostdeps="$hostdeps $i"
 		done
 	else
 		[ -z "$makedepends" ] && makedepends="$makedepends_build $makedepends_host"
 		want_check && makedepends="$makedepends $checkdepends"
 		for i in $EXTRADEPENDS_BUILD $EXTRADEPENDS_HOST $1 $depends $makedepends; do
-			[ "$pkgname" = "${i%%[<>=]*}" ] && continue
+			[ "$pkgname" = "${i%%[<>=~]*}" ] && continue
 			list_has $i $builddeps && continue
-			subpackages_has ${i%%[<>=]*} || builddeps="$builddeps $i"
+			subpackages_has ${i%%[<>=~]*} || builddeps="$builddeps $i"
 		done
 		hostdeps="$EXTRADEPENDS_TARGET"
 	fi
@@ -2388,7 +2491,7 @@ rootbld_actions() {
 	if ! want_check; then
 		_check=true
 	fi
-	for part in symlinksrc unpack prepare mkusers build $_check rootpkg; do
+	for part in symlinksrc unpack prepare build $_check rootpkg; do
 		runpart $part
 	done
 }
@@ -2411,11 +2514,20 @@ rootbld() {
 		return
 	fi
 
-	apk info -eq abuild-rootbld || die "rootbld: abuild-rootbld package not installed"
+	$APK info -eq abuild-rootbld || die "rootbld: abuild-rootbld package not installed"
 
 	[ $CBUILD = $CHOST ] || die "rootbld: set CBUILD=$CHOST to build for $CHOST"
-	[ $CBUILD_ARCH = "$(apk --print-arch)" -o -f "/proc/sys/fs/binfmt_misc/qemu-$(rootbld_qemu_arch)" ] || \
-		die "rootbld: binfmt registration missing for $(rootbld_qemu_arch) binaries"
+
+	local cachedir=/etc/apk/cache
+	if ! [ $CBUILD_ARCH = "$($APK --print-arch)" ]; then
+		# cross-building, so check for binfmt registration
+		local qarch="$(rootbld_qemu_arch)"
+		if ! [ -f "/proc/sys/fs/binfmt_misc/qemu-$qarch" ]; then
+			warning "rootbld: binfmt registration missing for $qarch binaries"
+		fi
+		# Old versions of apk have cache conflicts
+		$APK info -eq 'cmd:apk>=2.14.1' || cachedir=""
+	fi
 
 	logcmd "chroot building building $repo/$pkgname-$pkgver-r$pkgrel"
 
@@ -2433,6 +2545,13 @@ rootbld() {
 
 	msg "Preparing build chroot..."
 
+	# Unfortunately, we can't create the users inside the chroot.
+	# Hence, we need to do it on the host which is not optimal as it
+	# pollutes the host's /etc/group and /etc/passwd file.
+	#
+	# See https://gitlab.alpinelinux.org/alpine/abuild/-/issues/10094
+	mkusers
+
 	BUILD_ROOT=$(mktemp -d /var/tmp/abuild.XXXXXXXXXX)
 
 	mkdir -p "$BUILD_ROOT/proc" "$BUILD_ROOT/etc/apk/keys" \
@@ -2455,7 +2574,7 @@ rootbld() {
 	fi
 
 	local version="edge" buildhost="edge" gitref
-	if gitref="$(expr "$(git symbolic-ref --short HEAD)" : '\([0-9]\+\(\.[0-9]\+\)*\)-')"; then
+	if gitref="$(expr "$($git symbolic-ref --short HEAD)" : '\([0-9]\+\(\.[0-9]\+\)*\)-')"; then
 		version=v${gitref}
 		buildhost=${gitref/./-}
 	fi
@@ -2481,7 +2600,7 @@ rootbld() {
 	$SUDO_APK add --initdb --update \
 		--arch $CBUILD_ARCH \
 		--root "$BUILD_ROOT" \
-		--cache-dir /etc/apk/cache \
+		${cachedir:+--cache-dir $cachedir} \
 		abuild alpine-base build-base git $hostdeps $builddeps \
 		${USE_CCACHE:+ccache}
 
@@ -2503,8 +2622,13 @@ rootbld() {
 		--hostname "build-$buildhost-$CARCH" \
 		--chdir "$startdir" \
 		--clearenv \
+		--setenv CARCH "$CARCH" \
 		--setenv HOME "$HOME" \
+		--setenv REPODEST "$REPODEST" \
+		--setenv SRCDEST "$SRCDEST" \
+		--setenv ABUILD_USERDIR "$ABUILD_USERDIR" \
 		${ABUILD_BOOTSTRAP:+--setenv ABUILD_BOOTSTRAP "$ABUILD_BOOTSTRAP"} \
+		${APORTS_BOOTSTRAP:+--setenv APORTS_BOOTSTRAP "$APORTS_BOOTSTRAP"} \
 		--setenv SOURCE_DATE_EPOCH "$SOURCE_DATE_EPOCH" \
 		--setenv ABUILD_LAST_COMMIT "$ABUILD_LAST_COMMIT" \
 		--setenv PATH ${USE_CCACHE:+/usr/lib/ccache/bin:}/bin:/usr/bin:/sbin:/usr/sbin \
@@ -2598,7 +2722,7 @@ deplist_has() {
 	local i
 	shift
 	for i in $@; do
-		i=${i%%[<>=]*}
+		i=${i%%[<>=~]*}
 		[ "$needle" = "$i" ] && return 0
 		[ "$needle" = "!$i" ] && return 1
 	done
@@ -2654,12 +2778,9 @@ uninstalldeps() { undeps; }
 index() { update_abuildrepo_index; }
 
 all() {
-	if ! [ -n "$force" ]; then
-		if ! check_arch; then
-			echo "Package not available for the target architecture ($CARCH). Aborting."
-			return 0
-		fi
-		check_libc || return 0
+	if ! [ -n "$force" ] && ! check_arch; then
+		echo "Package not available for the target architecture ($CARCH). Aborting."
+		return 0
 	fi
 	if up2date && [ -z "$force" ]; then
 		msg "Package is up to date"
@@ -2722,7 +2843,7 @@ usage() {
 		 -c  Enable colored output
 		 -d  Disable dependency checking
 		 -D  Set APKINDEX description (default: \$repo \$(git describe))
-		 -f  Force specified cmd (skip checks: apk up to date, arch, libc)
+		 -f  Force specified cmd (skip checks: apk up to date, arch)
 		 -F  Force run as root
 		 -h  Show this help
 		 -k  Keep built packages, even if APKBUILD or sources are newer
@@ -2730,7 +2851,7 @@ usage() {
 		 -m  Disable colors (monochrome)
 		 -P  Set REPODEST as the repository location for created packages
 		 -q  Quiet
-		 -r  Install missing dependencies from system repository (using sudo)
+		 -r  Install missing dependencies from system repository (using \$SUDO_APK)
 		 -s  Set source package destination directory
 		 -v  Verbose: show every command as it is run (very noisy)
 
@@ -2746,7 +2867,7 @@ usage() {
 		  fetch       Fetch sources to \$SRCDEST (consider: 'abuild fetch verify')
 		  index       Regenerate indexes in \$REPODEST
 		  listpkg     List target packages
-		  package     Install project into $pkgdir
+		  package     Install project into \$pkgdir
 		  prepare     Apply patches
 		  rootbld     Build package in clean chroot
 		  rootpkg     Run 'package', the split functions and create apks as fakeroot
@@ -2767,7 +2888,7 @@ usage() {
 }
 
 APKBUILD="${APKBUILD:-./APKBUILD}"
-unset force
+unset color_opt force forceroot install_deps keep keep_build nodeps quiet verbose
 while getopts ":AcdD:fFhkKmnP:qrRs:uvV" opt; do
 	case $opt in
 		'A') echo "$CARCH"; exit 0;;
@@ -2814,12 +2935,13 @@ APKBUILD=$(readlink -f "$APKBUILD")
 startdir="${APKBUILD%/*}"
 srcdir=${srcdir:-"$startdir/src"}
 pkgbasedir=${pkgbasedir:-"$startdir/pkg"}
+tmpdir=${tmpdir:-"$startdir/tmp"}
 
 repo=${startdir%/*}
 repo=${repo##*/}
 
 aportsgit=${APORTSDIR:-${startdir}}
-repo_template=$aportsgit/$repo/.rootbld-repositories
+repo_template=$startdir/../.rootbld-repositories
 
 SRCDEST=${SRCDEST:-$startdir}
 

abump.1.scd

@@ -0,0 +1,53 @@
+abump(1)
+
+# NAME
+
+*abump* - bump pkgver in an APKBUILD file
+
+# SYNOPSIS
+
+*abump* [-s _CVE-1_,...] [-f _ISSUE_] [-k|--keep] _PKGNAME-1.2.3_
+
+# DESCRIPTION
+
+*abump* updates the *pkgver* in an APKBUILD file, updates its checksums,
+rebuilds it, and finally creates a new commit commit with the changes resulting.
+
+*abump* operates looks for the specified package in nested directories inside
+the current working, assuming a layout like that of the aports repository.
+
+# OPTIONS
+
+*-s, --security CVE1,...*
+	Include CVE in the *secfixes* comment section.
+
+*-f, --fixes ISSUE*
+	Include *Fixes #ISSUE* in the commit message. This will close the upstream
+	issue when the commit is merged into the aports master branch.
+
+*-k, --keep*
+	Keep existing packages.
+
+*-h, --help*
+	Print help information and exit.
+
+# ENVIRONMENT
+
+APORTSDIR
+	Force operating on an alternate directory.
+
+# EXAMPLES
+
+```
+abump mml-1.0.0
+abump glibmm2.68-2.78.0
+abump telegram-desktop-4.11.8
+```
+
+# SEE ALSO
+
+abuild(1), apkgrel(1), newapkbuild(1), APKBUILD(5), apk(8).
+
+# AUTHORS
+
+Natanael Copa <_ncopa@alpinelinux.org_> and open source contributors.

abump.in

@@ -73,8 +73,8 @@ fixes #${fixes#\#}
 		fi
 		msg "$message"
 
-		sed -i -e "s/^pkgver=.*/pkgver=$ver/" \
-			-e "s/^pkgrel=.*/pkgrel=0/" \
+		sed -i -e "s/^pkgver=[^ ]*/pkgver=$ver/" \
+			-e "s/^pkgrel=[^ ]*/pkgrel=0/" \
 			APKBUILD
 
 		$ABUILD $abuild_opts checksum all
@@ -96,7 +96,7 @@ fixes #${fixes#\#}
 usage() {
 	cat <<-__EOF__
 		$program $program_version - bump pkgver in APKBUILDs
-		Usage: $program [-s CVE-1,CVE-2,...] [-f ISSUE] [-R|--recursive] [-k|--keep] PKGNAME-1.2.3 ...
+		Usage: $program [-s CVE-1,CVE-2,...] [-f ISSUE] [-k|--keep] PKGNAME-1.2.3 ...
 		Options:
 		  -s, --security CVE1,CVE-2,...  Security update
 		  -f, --fixes ISSUE              Fixes ISSUE

apkbuild-pypi.in

@@ -4,50 +4,52 @@ use strict;
 use warnings;
 use autodie qw(:all);
 use feature qw(:5.14);
-use experimental 'switch';
 use LWP::UserAgent;
 use LWP::ConnCache;
 use JSON;
+use URI;
+use Text::Wrap qw(wrap $columns);
+use File::Basename qw(dirname);
 
 our $packager = '';
 my %pkgmap = ();
 my %licenses = ();
 
 my $template = <<'EOF';
-# Automatically generated by apkbuild-pypi, template 3
+# Automatically generated by apkbuild-pypi, template 4
 [% authors %]
 pkgname=[% pkgname %]
-#_pkgreal is used by apkbuild-pypi to find modules at PyPI
-_pkgreal=[% pkgreal %]
 pkgver=[% pkgver %]
 pkgrel=[% pkgrel %]
+#_pkgreal is used by apkbuild-pypi to find modules at PyPI
+_pkgreal=[% pkgreal %]
 pkgdesc="[% pkgdesc %]"
-provides="[% provides %]"
-replaces="[% replaces %]"
-url="http://packages.python.org/pypi/[% pkgreal %]"
+url="[% url %]"
 arch="noarch"
 license="[% license %]"
-depends="python3"
-checkdepends="python3-dev"
-makedepends="py3-setuptools"
-subpackages=""
+depends=""
+makedepends="py3-gpep517 py3-setuptools py3-wheel"
+checkdepends="py3-pytest"
+subpackages="$pkgname-pyc"
 source="[% source %]"
-builddir="$srcdir/$_pkgreal-$pkgver"
-
+builddir="[% builddir %]"
+options="[% options %]"[% options_comment %]
+[% compatibility %]
 build() {
-	python3 setup.py build
+	gpep517 build-wheel \
+		--wheel-dir .dist \
+		--output-fd 3 3>&1 >&2
 }
 
 check() {
-	python3 setup.py test
+	python3 -m venv --clear --without-pip --system-site-packages .testenv
+	.testenv/bin/python3 -m installer .dist/*.whl
+	.testenv/bin/python3 -m pytest
 }
 
 package() {
-	PYTHONPATH=$pkgdir`python3 -c "import site; print(site.getsitepackages()[0])"` \
-	python3 setup.py install \
-		--prefix=/usr \
-		--root="$pkgdir" \
-		--single-version-externally-managed
+	python3 -m installer -d "$pkgdir" \
+		.dist/*.whl
 }
 
 EOF
@@ -73,14 +75,31 @@ sub read_assignments_from_file {
     my %mline = $text =~ /^(\w+)\s*=\s*\"([^\"]*)\".*$/mg;
     my %hash = ( %sline, %mline );
 
-    my $authors = join("\n", $text =~ /^# Contributor: .*$/mg, $text =~ /^# Maintainer: .*$/mg);
+    return \%hash if $filename ne 'APKBUILD';
+    my $authors = join( "\n",
+        $text =~ /^# Contributor: .*$/mg,
+        $text =~ /^# Maintainer: .*$/mg );
     $hash{'authors'} = $authors if length($authors) > 1;
 
-    my $provides = $text =~ m/provides=\"(.*)\"".*/mg;
-    $hash{'provides'} = $1 if length($provides) >= 1;
+    if ($text =~ m/^provides=\"(.*)\"(.*)$/m) {
+        $hash{'provides'} = $1;
+        $hash{'provides_comment'} = $2;
+    }
 
-    my $requires = $text =~ m/^requires=\"(.*)\"".*$/mg;
-    $hash{'requires'} = $1 if length($requires) >= 1;
+    if ($text =~ m/^replaces=\"(.*)\"(.*)$/m) {
+        $hash{'replaces'} = $1;
+        $hash{'replaces_comment'} = $2;
+    }
+
+    # workaround for `builddir="$srcdir"/$_pkgname-$pkgver`
+    if ($text =~ m/^builddir=\"(.*)\"([^\s]*)/m) {
+        $hash{'builddir'} = $1 . $2;
+    }
+
+    if ($text =~ m/^options=\"(.*)\"(.*)$/m) {
+        $hash{'options'} = $1;
+        $hash{'options_comment'} = $2;
+    }
 
     return \%hash;
 }
@@ -94,6 +113,7 @@ sub map_pypi_to_apk {
 sub map_license {
     my ($license) = @_;
 
+    $license //= '';
     $license =~ s/ or / /g;
 
     return $license;
@@ -101,48 +121,131 @@ sub map_license {
 
 sub get_source {
     my ($distdata) = @_;
+    my $pkgname = $distdata->{info}{name};
 
+    my $source;
     for my $url (@{$distdata->{urls}}) {
-        return $url->{url} if $url->{python_version} eq 'source'
+        if ($url->{python_version} eq 'source') {
+            $source = URI->new($url->{url});
+            last;
+        }
+    }
+    die "Unable to locate sources for $pkgname.\n" unless $source;
+
+    my $filename = ($source->path_segments)[-1];
+    my $pretty_path = substr($pkgname, 0, 1) . "/$pkgname";
+    my $pretty_url = $source->clone;
+    $pretty_url->path("/packages/source/$pretty_path/$filename");
+
+    my $response = $ua->head($pretty_url);
+    if ($response->is_success) {
+        return $pretty_url->as_string;
+    } else {
+        return $source->as_string;
     }
-    die "Unable to locate sources for $distdata->{name}.\n";
 }
 
 sub read_apkbuild {
     return read_assignments_from_file('APKBUILD');
 }
 
+sub format_line {
+    my $line = shift;
+    return "\t" . $line . "\n";
+}
+
+sub format_source {
+    my $srcurl   = shift;
+    my $orig_src = shift;
+
+    $orig_src =~ s/^\s+//mg;
+    $orig_src =~ s/\s+/ /g;
+
+    my @sources = split (/\s/, $orig_src);
+
+    return $srcurl if @sources <= 1;
+
+    shift @sources if $sources[0] =~ m/pkgver/;
+    my $patches;
+    for my $patch (@sources) {
+        next if $patch eq "";
+        $patches .= format_line($patch);
+    }
+
+    return $srcurl . "\n" . ($patches // '') . "\t";
+}
+
 sub write_apkbuild {
     my ($distdata, $apkbuild) = @_;
 
     my $replaces = undef;
     my $provides = undef;
     my $authors = undef;
+    my $license = undef;
+    my $url = undef;
+    my $pkgname = undef;
+    my $pkgdesc = undef;
     my $pkgrel = 0;
+    my $builddir = undef;
+    my $options = undef;
+    my $options_comment = undef;
+    my $orig_source = "";
+
+    if (our $use_homepage) {
+        $url =
+          $distdata->{info}{project_urls}{Homepage}
+          || $distdata->{info}{home_page};
+    }
 
     if (defined $apkbuild) {
         $authors = $apkbuild->{authors};
         $provides = $apkbuild->{provides};
         $replaces = $apkbuild->{replaces};
+        $license = $apkbuild->{license};
+        $url = $apkbuild->{url};
+        $pkgname = $apkbuild->{pkgname};
+        $pkgdesc = $apkbuild->{pkgdesc};
         $pkgrel = $apkbuild->{pkgrel};
+        $builddir = $apkbuild->{builddir};
+        $options  = $apkbuild->{options} if defined $apkbuild->{options};
+        $options_comment  = $apkbuild->{options_comment} if defined $apkbuild->{options_comment};
+        $orig_source      = $apkbuild->{source};
 
 	if ($apkbuild->{pkgver} eq $distdata->{info}{version}) {
 	    $pkgrel++;
 	}
     }
 
+    my $pkgreal = $distdata->{info}{name};
+    my $srcurl = get_source($distdata);
+
     my %repl = (
 	authors  => ($authors or "# Contributor: $packager\n# Maintainer: $packager"),
-        pkgname  => map_pypi_to_apk($distdata->{info}{name}),
-        pkgreal  => $distdata->{info}{name},
+        pkgname  => ($pkgname or map_pypi_to_apk($pkgreal)),
+        pkgreal  => $pkgreal,
         pkgver   => $distdata->{info}{version},
         pkgrel	 => $pkgrel,
-        source   => get_source($distdata),
-        license  => map_license($distdata->{info}{license}),
-        pkgdesc  => $distdata->{info}{summary},
-        provides => ($provides or ''),
-        replaces => ($replaces or ''),
+        source   => format_source($srcurl, $orig_source),
+        license  => ($license or map_license($distdata->{info}{license})),
+        url      => ($url or "https://pypi.org/project/${pkgreal}/"),
+        pkgdesc  => ($pkgdesc or $distdata->{info}{summary} or "Python module for $pkgreal"),
+        builddir => ($builddir or ''),
+        options  => ($options or ''),
+        options_comment => ($options_comment or ''),
     );
+
+    $repl{compatibility} = "";
+    if ($replaces) {
+        my $comment = $apkbuild->{'replaces_comment'} // '';
+        $repl{compatibility} .= "\nreplaces=\"$replaces\"" . $comment;
+    }
+    if ($provides) {
+        my $comment = $apkbuild->{'provides_comment'} // '';
+        $repl{compatibility} .= "\nprovides=\"$provides\"" . $comment;
+    }
+    $repl{compatibility} .= "\n" if $replaces or $provides;
+
+    $repl{source} =~ s/-$repl{pkgver}/-\$pkgver/g;
     $template =~ s/\[% (.*?) %\]/$repl{$1}/g;
 
     open my $fh, '>:utf8', 'APKBUILD';
@@ -154,8 +257,15 @@ sub write_apkbuild {
     return \%repl;
 }
 
+sub unpack_source {
+    system('abuild checksum unpack');
+}
+
 sub prepare_tree {
-    system('abuild checksum unpack prepare');
+    my %options = @_;
+
+    unpack_source if $options{unpack};
+    system('abuild prepare');
 }
 
 sub find_package_name {
@@ -188,42 +298,172 @@ sub find_package_name {
 
 sub get_data {
     my ($package) = @_;
-    my $response = $ua->get("https://pypi.python.org/pypi/$package/json");
+    my $response = $ua->get("https://pypi.org/pypi/$package/json");
     $response->is_success or die $response->status_line;
     my $distdata = $json->decode($response->decoded_content);
 
     return $distdata;
 }
 
-sub get_deps {
-    my ($data) = @_;
+sub parse_requires_dist {
+    my $reqs = shift;
 
-    chdir "src/$data->{pkgreal}-$data->{pkgver}";
-    my $reqs = `python3 ./setup.py --requires`;
+    # Valid PyPI regex: https://peps.python.org/pep-0508/#names
+    my $pypi_regex = qr/(?i)([A-Z0-9][A-Z0-9][A-Z0-9._-]*[A-Z0-9])/;
 
-    my @reqs = split /\n/, $reqs;
+    my @depends =
+        map { m/$pypi_regex/; $1 || () }
+        grep { $_ !~ m/; extra ==/ }
+        @$reqs;
 
-    foreach my $i (0 .. $#reqs) {
-        $reqs[$i] =~ s/(\(|\s+).*$//;
-        $reqs[$i] = map_pypi_to_apk($reqs[$i]);
+    my @checkdeps =
+        map { m/$pypi_regex/; $1 || () }
+        grep { m/; extra == ["'](tests|pytest)["']/ }
+        @$reqs;
+
+    my %reqs = (
+	depends    => \@depends,
+	checkdeps  => \@checkdeps,
+    );
+
+    return \%reqs;
+}
+
+sub format_depends {
+    my $deps = shift;
+
+    $columns = 102;
+
+    $deps =~ s/ {2,}/ /g;
+    $deps =~ s/^\s//g;
+    $deps =~ s/\s$//g;
+
+    if ( length($deps) >= $columns ) {
+        $deps = wrap( "\t", "\t", $deps );
     }
+    $deps =~ s/\s$//g;
 
-    chdir '../..';
+    if ( length($deps) >= $columns ) {
+        $deps = "\n" . $deps . "\n\t";
+    }
+    return $deps;
+}
+
+sub get_deps {
+    my ($distdata, $data) = @_;
+
+    my $reqs = parse_requires_dist($distdata->{info}{requires_dist});
+    my %depends = ('py3-pytest' => 'py3-pytest');
+
+    my @depends =
+        map {
+            my $apkname = map_pypi_to_apk($_);
+            if (exists $depends{$apkname}) { () }
+            else { $depends{$apkname} = $apkname }
+        }
+        @{$reqs->{depends}};
+
+    my @checkdeps =
+        map {
+            my $apkname = map_pypi_to_apk($_);
+            exists($depends{$apkname}) ? () : $apkname
+        }
+        @{$reqs->{checkdeps}};
 
     my $apk = read_file('APKBUILD');
 
-    $reqs = join ' ', @reqs;
+    my $depends = format_depends(join ' ', @depends);
 
-    $apk =~ s/pymakedepends=""/pymakedepends="$reqs"/;
+    $apk =~ s/^depends=""/depends="$depends"/m;
+
+    unshift @checkdeps, 'py3-pytest';
+    my $checkdeps = format_depends(join ' ', @checkdeps);
+
+    $apk =~ s/^checkdepends="py3-pytest"/checkdepends="$checkdeps"/m;
 
     # remove empty variables
-    $apk =~ s/.*=""\n//g;
+    $apk =~ s/.*="".{0,}\n//g;
 
     open my $fh, '>:utf8', 'APKBUILD';
 
     print $fh $apk;
 
-    say "Requires: $reqs";
+    say "Requires: @depends\n\nCheckDepends: @checkdeps";
+}
+
+sub write_old_deps {
+    my ($data, $apkbuild) = @_;
+
+    my $apk = read_file('APKBUILD');
+
+    if (my $depends = $apkbuild->{depends}) {
+        $apk =~ s/^depends=".*"/depends="$depends"/m;
+    }
+
+    if (my $makedeps = $apkbuild->{makedepends}) {
+        if ($makedeps =~ m/py3-gpep517/) {
+           $apk =~ s/^makedepends=".*"/makedepends="$makedeps"/m;
+        } else {
+           $apk =~ s/^makedepends="(.*)"/makedepends="$1 $makedeps"/m;
+        }
+    }
+
+    if (my $checkdeps = $apkbuild->{checkdepends}) {
+        if ($checkdeps =~ m/py3-pytest/) {
+            $apk =~ s/^checkdepends=".*"/checkdepends="$checkdeps"/m;
+        } else {
+            $apk =~ s/^checkdepends="(.*)"/checkdepends="$1 $checkdeps"/m;
+        }
+    }
+
+    # remove empty variables
+    $apk =~ s/.*="".{0,}\n//g;
+
+    open my $fh, '>:utf8', 'APKBUILD';
+
+    print $fh $apk;
+}
+
+sub update_builddir {
+    my $apkbuild = read_apkbuild;
+    my $pkgreal = $apkbuild->{'_pkgreal'};
+    my $pkgname = $apkbuild->{pkgname};
+    my $pkgver = $apkbuild->{pkgver};
+    my $oldbuilddir = $apkbuild->{builddir};
+
+    my $build_path = glob("
+      src/*${pkgver}/pyproject.toml
+      src/*${pkgver}/setup.py
+    ");
+
+    if ($build_path) {
+        my $newbuilddir = dirname($build_path);
+
+        $newbuilddir =~ s/src/\$srcdir/;
+        $newbuilddir =~ s/$pkgreal/\$_pkgreal/;
+        $newbuilddir =~ s/$pkgver/\$pkgver/;
+
+        my $apk = read_file('APKBUILD');
+
+        if ($pkgname eq $pkgreal and
+          $newbuilddir eq '$srcdir/$_pkgreal-$pkgver') {
+            # this will be deleted by the remove empty
+            # variables regex in get_deps/write_old_deps
+            $apk =~ s/^builddir=".*"/builddir=""/m;
+
+            $newbuilddir = '<same as default, deleted>';
+        } elsif ($newbuilddir eq $oldbuilddir) {
+            return;
+        } else {
+            $apk =~ s/^builddir=".*"/builddir="$newbuilddir"/m;
+        }
+
+        print "\n\$builddir redefined:\n\t",
+            "OLD: $oldbuilddir, NEW: $newbuilddir\n\n";
+
+        open my $fh, '>:utf8', 'APKBUILD';
+        print $fh $apk;
+    }
 }
 
 my $abuild_conf = read_assignments_from_file('/etc/abuild.conf');
@@ -234,95 +474,104 @@ $packager = $user_abuild_conf->{PACKAGER} if $user_abuild_conf->{PACKAGER};
 
 sub usage {
     say <<'EOF';
-Usage: apkbuild-pypi [create <package> | check | recreate | upgrade | update]
+Usage: apkbuild-pypi [create <package> [homepage] | check | recreate [deps] | upgrade | update]
 
 In the repository root:
     create <package>: Creates an APKBUILD for <package>
+    create <package> homepage: Creates an APKBUILD for <package> with url= field set to project homepage, if available
 
 In the package root:
     check           : Reports current & latest version of the package
-    recreate        : Recreates the APKBUILD
+    recreate [deps] : Recreates the APKBUILD [also recalculate dependencies]
     upgrade         : Upgrades to the latest version of the package
     update          : Updates APKBUILD metadata
 EOF
 }
 
-given ($ARGV[0]) {
-    when ('create') {
-        my $package = $ARGV[1];
-        $package or die usage;
+if (! defined $ARGV[0]) {
+    die usage;
+} elsif ($ARGV[0] eq 'create') {
+    my $package = $ARGV[1];
+    $package or die usage;
 
-        my $distdata = get_data($package);
-        my $apkname = map_pypi_to_apk($package);
+    my $distdata = get_data($package);
+    my $apkname = map_pypi_to_apk($package);
 
-        mkdir $apkname;
-        chdir $apkname;
+    mkdir $apkname;
+    chdir $apkname;
 
-        my $data = write_apkbuild($distdata, undef);
-        prepare_tree;
+    if ($ARGV[2] and $ARGV[2] eq 'homepage') { our $use_homepage = 1; }
 
-        get_deps($data);
-    } when ('recreate') {
-        my $apkbuild = read_apkbuild;
-        if (! defined $apkbuild->{_pkgreal}) {
-	     $apkbuild->{_pkgreal} = find_package_name($apkbuild);
-        }
-        my $distdata = get_data($apkbuild->{_pkgreal});
-	my $pkgver = $distdata->{info}{version} =~ s/^[^0-9]+//r;
-	if ($pkgver ne $apkbuild->{pkgver}) {
-		#Reset pkgrel on upgrade on recreate
-		say "Upgrading PyPI module from $apkbuild->{pkgver} to $pkgver";
-		$apkbuild->{pkgrel}=0;
-	}
-	my $data = write_apkbuild($distdata, $apkbuild);
+    my $data = write_apkbuild($distdata, undef);
+    unpack_source;
+    update_builddir;
 
-        prepare_tree;
-        get_deps($data);
-    } when ('upgrade') {
-        my $apkbuild = read_apkbuild;
-
-        if (! defined $apkbuild->{_pkgreal}) {
-	     $apkbuild->{_pkgreal} = find_package_name($apkbuild);
-        }
-
-        my $distdata = get_data($apkbuild->{_pkgreal});
-
-        my $pkgver = $distdata->{info}{version};
-
-        if ($pkgver ne $apkbuild->{pkgver}) {
-            say "Upgrading PyPI package from $apkbuild->{pkgver} to $pkgver";
-
-            my $text = read_file('APKBUILD');
-
-            $text =~ s/^(pkgver)=.*$/$1=$pkgver/mg or
-                die "Can't find pkgver line in APKBUILD";
-            $text =~ s/^(pkgrel)=.*$/$1=0/mg or
-                die "Can't find pkgrel line in APKBUILD";
-
-            open my $fh, '>:utf8', 'APKBUILD';
-            print $fh $text;
-            close $fh;
-        } else {
-            say "Already up to date with PyPI";
-        }
-    } when ('check') {
-        my $apkbuild = read_apkbuild;
-
-        if (! defined $apkbuild->{_pkgreal}) {
-	     $apkbuild->{_pkgreal} = find_package_name($apkbuild);
-        }
-        my $distdata = get_data($apkbuild->{_pkgreal});
-
-        my $pkgver = $distdata->{info}{version};
-
-
-        say "$apkbuild->{pkgname}: Latest version: $pkgver Packaged version: $apkbuild->{pkgver}";
-        if ($pkgver ne $apkbuild->{pkgver}) {
-            exit(1);
-        }
-    } when ('update') {
-        prepare_tree;
-    } default {
-        die usage;
+    get_deps($distdata, $data);
+    prepare_tree( unpack => 0 );
+} elsif ($ARGV[0] eq 'recreate') {
+    my $apkbuild = read_apkbuild;
+    if (! defined $apkbuild->{_pkgreal}) {
+        $apkbuild->{_pkgreal} = find_package_name($apkbuild);
     }
+    my $distdata = get_data($apkbuild->{_pkgreal});
+    my $pkgver = $distdata->{info}{version} =~ s/^[^0-9]+//r;
+    if ($pkgver ne $apkbuild->{pkgver}) {
+        #Reset pkgrel on upgrade on recreate
+        say "Upgrading PyPI module from $apkbuild->{pkgver} to $pkgver";
+        $apkbuild->{pkgrel}=0;
+    }
+
+    my $data = write_apkbuild($distdata, $apkbuild);
+    unpack_source;
+    update_builddir;
+
+    if ($ARGV[1] and $ARGV[1] eq 'deps') { get_deps($distdata, $data); }
+    else { write_old_deps($data, $apkbuild); }
+    prepare_tree( unpack => 0 );
+} elsif ($ARGV[0] eq 'upgrade') {
+    my $apkbuild = read_apkbuild;
+
+    if (! defined $apkbuild->{_pkgreal}) {
+        $apkbuild->{_pkgreal} = find_package_name($apkbuild);
+    }
+
+    my $distdata = get_data($apkbuild->{_pkgreal});
+
+    my $pkgver = $distdata->{info}{version};
+
+    if ($pkgver ne $apkbuild->{pkgver}) {
+        say "Upgrading PyPI package from $apkbuild->{pkgver} to $pkgver";
+
+        my $text = read_file('APKBUILD');
+
+        $text =~ s/^(pkgver)=.*$/$1=$pkgver/mg or
+            die "Can't find pkgver line in APKBUILD";
+        $text =~ s/^(pkgrel)=.*$/$1=0/mg or
+            die "Can't find pkgrel line in APKBUILD";
+
+        open my $fh, '>:utf8', 'APKBUILD';
+        print $fh $text;
+        close $fh;
+    } else {
+        say "Already up to date with PyPI";
+    }
+} elsif ($ARGV[0] eq 'check') {
+    my $apkbuild = read_apkbuild;
+
+    if (! defined $apkbuild->{_pkgreal}) {
+        $apkbuild->{_pkgreal} = find_package_name($apkbuild);
+    }
+    my $distdata = get_data($apkbuild->{_pkgreal});
+
+    my $pkgver = $distdata->{info}{version};
+
+
+    say "$apkbuild->{pkgname}: Latest version: $pkgver Packaged version: $apkbuild->{pkgver}";
+    if ($pkgver ne $apkbuild->{pkgver}) {
+        exit(1);
+    }
+} elsif ($ARGV[0] eq 'update') {
+    prepare_tree( unpack => 1 );
+} else {
+    die usage;
 }

checkapk.in

@@ -17,21 +17,41 @@ fi
 
 
 usage() {
-	cat >&2 <<-__EOF__
+	cat <<-__EOF__
 		$program $program_version - find ABI breakages in package upgrades
-		Usage: $program
+		Usage: $program [-h|--help]
 
 		Run in the directory of a built package.
 
+		Options:
+		  -h, --help  Print this help
+
 	__EOF__
 }
 
+args=$(getopt -o h --long help \
+	-n "$program" -- "$@")
+
+if [ $? -ne 0 ]; then
+	usage >&2
+	exit 2
+fi
+eval set -- "$args"
+while true; do
+	case $1 in
+		-h|--help) usage; exit 0;;
+		--) shift; break;;
+		*) exit 1;; # getopt error
+	esac
+	shift
+done
+
 if [ $# -gt 0 ]; then
-	usage
+	usage >&2
 	exit 2
 fi
 
-if ! [ -f "$ABUILD_CONF" ] && ! [ -f "$ABUILD_USERCONF" ]; then
+if ! [ -f "$ABUILD_CONF" ] && ! [ -f "$ABUILD_USERCONF" ] && ! [ -f "$ABUILD_DEFCONF" ]; then
 	die "no abuild.conf found"
 fi
 
@@ -47,9 +67,15 @@ fi
 
 startdir="$PWD"
 tmpdir=$(mktemp -d -t checkpkg-script.XXXXXX)
-trap "rm -rf '$tmpdir'" INT EXIT
+trap "rm -rf '$tmpdir'; exit" INT EXIT
 cd "$tmpdir" || die "failed to create temp dir"
 
+# storage for downloaded/copied apks
+mkdir -p apks
+
+# default to pigz for unpacking
+gunzip="$(command -v pigz || echo gzip) -d"
+
 for i in $pkgname $subpackages; do
 	_pkgname=${i%%:*}
 	pkg=${_pkgname}-$pkgver-r$pkgrel
@@ -65,18 +91,24 @@ for i in $pkgname $subpackages; do
 	[ -f "$filepath" ] || die "can't find $pkgfile"
 
 	# generate a temp repositories file with only the http(s) repos
-	grep -E "^https?:" /etc/apk/repositories > $tmpdir/repositories
+	grep -E "^https?:" /etc/apk/repositories > "$tmpdir"/repositories
 
-	oldpkg=$(apk fetch --repositories-file $tmpdir/repositories --simulate $_pkgname 2>&1 | sed 's/^Downloading //')
+	oldpkg=$(apk fetch --repositories-file "$tmpdir"/repositories --simulate $_pkgname 2>&1 | sed 's/^Downloading //')
 	if [ "${oldpkg}" = "${pkg}" ]; then
 		die "the built package ($_pkgname) is already in the repo"
 	fi
 
 	# For our local repo (newsize) apk info might return multiple packages, e.g. if different
-	# version of the package where build previously. Filter out this specific pkgver using awk.
-	newsize=$(apk info --repositories-file /dev/null --repository "$REPODEST"/$repo --size $_pkgname | \
-		awk "/^$pkg/ { found = 1 } /^[0-9]+/ { if (found) { print \$0; exit } }")
-	oldsize=$(apk info --repositories-file $tmpdir/repositories --size $_pkgname | awk '/^[0-9]+/ { print $0 }' | head -1)
+	# version of the package where built previously. However, for a repo only one of pkgname=pkgver-rpkgrel can exist.
+	# Filter out this specific pkgver with grep, as it can have only one match, then take the second line:
+	#  7zip-23.01-r0 installed size:
+	#  1668 KiB
+	newsize="$(apk info --repositories-file /dev/null --repository "$REPODEST"/$repo --size $_pkgname | \
+		grep -F "$pkg" -A1 | \
+		tail -n1)"
+	oldsize="$(apk info --repositories-file "$tmpdir"/repositories --size "$_pkgname" | \
+		grep -F "$_pkgname" -A1 | \
+		tail -n1)"
 
 	if [ "$oldsize" = "$newsize" ]; then
 		msg "No size differences for $_pkgname."
@@ -84,22 +116,42 @@ for i in $pkgname $subpackages; do
 		msg "Size difference for $_pkgname: $oldsize -> $newsize"
 	fi
 
-	apk fetch --quiet --repositories-file $tmpdir/repositories --stdout $_pkgname \
-		| tar -zt | grep -v '^\.SIGN\.' | sort > filelist-$_pkgname-old \
-		|| die "failed to download old pkg, maybe run 'apk update'?"
+	apk fetch --quiet --repositories-file "$tmpdir"/repositories --stdout "$_pkgname" > apks/old.apk \
+		|| msg2 "Old apk for $_pkgname missing. (new package/arch? broken internet?)"
 
-	tar -ztf "$filepath" | grep -v '^\.SIGN\.' | sort > "filelist-$_pkgname"
+	# pre-uncompress to not decompress twice
+	# we do a decompression + tar -t for the file list, but then later we might do a full extraction for sodiff.
+	# to not decompress here and then later again, store the intermediate tar
+	$gunzip -c 2>/dev/null < apks/old.apk > apks/old.tar &
+	$gunzip -c "$filepath" < "$filepath" > apks/new.tar &
+	wait
+	tar -t -f apks/old.tar 2>/dev/null | grep -v '^\.SIGN\.' | sort > "filelist-$_pkgname-old" &
+	tar -t -f apks/new.tar | grep -v '^\.SIGN\.' | sort > "filelist-$_pkgname-new" &
+	wait
 
-	diff -u "filelist-$_pkgname-old" "filelist-$_pkgname"
+	diff -U3 "filelist-$_pkgname-old" "filelist-$_pkgname-new"
 
-	if diff "filelist-$_pkgname-old" "filelist-$_pkgname" | grep '\.so' > /dev/null 2>&1; then
-		mkdir -p pkg
-		cd pkg
-		tar -zxf "$filepath" > /dev/null
-		diff "../filelist-$_pkgname-old" "../filelist-$_pkgname" | awk '/>.*\.so/{$1 = ""; print $0}' | while read i; do
-			echo "${i}: " "$(objdump -p "$i" | grep SONAME)"
+	if diff -U0 "filelist-$_pkgname-old" "filelist-$_pkgname-new" | grep -q '\.so'; then
+		echo "SODIFF:"
+
+		mkdir -p "$_pkgname-pkg-old" "$_pkgname-pkg-new"
+		tar -C "$_pkgname-pkg-old" 2>/dev/null -x -f apks/old.tar > /dev/null &
+		tar -C "$_pkgname-pkg-new" -x -f apks/new.tar > /dev/null &
+		wait
+
+		# filter to things that start with -+ but strip the header (---/+++)
+		diff -U0 "filelist-$_pkgname-old" "filelist-$_pkgname-new" | grep -E '^(\+|-)[A-Za-z0-9]+' | grep '\.so' | while read -r diff_sofile; do
+			case "$diff_sofile" in
+			-*) path="$_pkgname-pkg-old"; sofile="${diff_sofile#\-}" ;;
+			+*) path="$_pkgname-pkg-new"; sofile="${diff_sofile#\+}" ;;
+			esac
+
+			# skip symlinks (only adds duplicate output or is dangling), and things that aren't valid elfs
+			# matching .so above matches anything with .so in the name, e.g. xyz.sourceforge
+			if ! [ -L "$path"/"$sofile" ] && readelf -h "$path"/"$sofile" >/dev/null 2>&1; then
+				echo "$diff_sofile: " "$(objdump -p "$path"/"$sofile" | grep SONAME)"
+			fi
 		done
-		cd ..
 	else
 		msg "No soname differences for $_pkgname."
 	fi

default.conf

@@ -1,6 +1,6 @@
-export CFLAGS="-Os -fomit-frame-pointer -Wformat -Werror=format-security -Werror=int-conversion"
-export CXXFLAGS="-Os -fomit-frame-pointer -Wformat -Werror=format-security"
-export CPPFLAGS="-Os -fomit-frame-pointer -Wformat -Werror=format-security"
+export CFLAGS="-Os -fstack-clash-protection -Wformat -Werror=format-security"
+export CXXFLAGS="-Os -fstack-clash-protection -Wformat -Werror=format-security"
+export CXXFLAGS="$CXXFLAGS -D_GLIBCXX_ASSERTIONS=1 -D_LIBCPP_ENABLE_THREAD_SAFETY_ANNOTATIONS=1 -D_LIBCPP_ENABLE_HARDENED_MODE=1"
 export LDFLAGS="-Wl,--as-needed,-O1,--sort-common"
 export GOFLAGS="-buildmode=pie -modcacherw -trimpath -buildvcs=false"
 # Do note that these should work with at least GDC and LDC
@@ -18,15 +18,8 @@ export CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1
 export CARGO_PROFILE_RELEASE_LTO="true"
 export CARGO_REGISTRIES_CRATES_IO_PROTOCOL="sparse"
 
-# remove line below to disable colors
-USE_COLORS=1
-
-# uncomment line below to enable ccache support.
-#USE_CCACHE=1
-
 SRCDEST=/var/cache/distfiles
 
-# uncomment line below to store built packages in other location
 # The package will be stored as $REPODEST/$repo/$pkgname-$pkgver-r$pkgrel.apk
 # where $repo is the name of the parent directory of $startdir.
 REPODEST=$HOME/packages/
@@ -41,3 +34,6 @@ CLEANUP="srcdir bldroot pkgdir deps"
 
 # what to cleanup after a failed build
 ERROR_CLEANUP="bldroot deps"
+
+# uncomment to prevent using global cache directories for Go and Cargo
+#MOVE_CACHES=1

functions.sh.in

@@ -1,6 +1,7 @@
 # /usr/share/abuild/functions.sh
 
 sysconfdir=@sysconfdir@
+sharedir=@sharedir@
 program=${0##*/}
 
 arch_to_hostspec() {
@@ -77,7 +78,7 @@ readconfig() {
 	[ -n "${SRCDEST+x}" ] && _SRCDEST=$SRCDEST
 	[ -n "${CC+x}" ] && _CC=$CC
 	[ -n "${CXX+x}" ] && _CXX=$CXX
-	[ -n "${LD+x}" ] && _LD=$LD	
+	[ -n "${LD+x}" ] && _LD=$LD
 	[ -n "${CARCH+x}" ] && _CARCH=$CARCH
 	[ -n "${CHOST+x}" ] && _CHOST=$CHOST
 	[ -n "${CTARGET+x}" ] && _CTARGET=$CTARGET
@@ -96,10 +97,12 @@ readconfig() {
 	[ -n "${PACKAGER+x}" ] && _PACKAGER=$PACKAGER
 	[ -n "${USE_COLORS+x}" ] && _USE_COLORS="$USE_COLORS"
 	[ -n "${USE_CCACHE+x}" ] && _USE_CCACHE="$USE_CCACHE"
+	: ${ABUILD_DEFCONF:=${ABUILD_SHAREDIR:-$sharedir}/default.conf}
+	[ -f "$ABUILD_DEFCONF" ] && . "$ABUILD_DEFCONF"
 	: ${ABUILD_CONF:=$sysconfdir/abuild.conf}
+	[ -f "$ABUILD_CONF" ] && . "$ABUILD_CONF"
 	: ${ABUILD_USERDIR:=$HOME/.abuild}
 	: ${ABUILD_USERCONF:=$ABUILD_USERDIR/abuild.conf}
-	[ -f "$ABUILD_CONF" ] && . "$ABUILD_CONF"
 	[ -f "$ABUILD_USERCONF" ] && . "$ABUILD_USERCONF"
 	APORTSDIR=${_APORTSDIR-$APORTSDIR}
 

newapkbuild.1.scd

@@ -2,12 +2,12 @@ newapkbuild(1)
 
 # NAME
 
-	*newapkbuild* - generate a new APKBUILD
+*newapkbuild* - generate a new APKBUILD
 
 
 # SYNOPSIS
 
-	*newapkbuild* _options_... [_pkgname_[-_pkgver_] | _source_url_]
+*newapkbuild* _options_... [_pkgname_[-_pkgver_] | _source_url_]
 
 
 # DESCRIPTION
@@ -43,6 +43,11 @@ the generated APKBUILD file will not contain any build instructions.
 *-d* _DESC_
 	Specifies the description (pkgdesc=) for the new package.
 
+*-e*
+	Specifies that the package uses a Python PEP517 build
+	system. Python's gpep517, setuptools and wheel will be added
+	to the makedepends.
+
 *-f*
 	Forces *newapkbuild* to overwrite an existing APKBUILD, if one
 	already exists in the package directory.

newapkbuild.in

@@ -32,7 +32,7 @@ is_github_url() {
 
 prepare_rust() {
 	cat >>APKBUILD<<__EOF__
-	cargo fetch --locked
+	cargo fetch --target="\$CTARGET" --locked
 __EOF__
 }
 
@@ -65,14 +65,14 @@ build_cmake() {
 
 	cat >>APKBUILD<<__EOF__
 	if [ "\$CBUILD" != "\$CHOST" ]; then
-		CMAKE_CROSSOPTS="-DCMAKE_SYSTEM_NAME=Linux -DCMAKE_HOST_SYSTEM_NAME=Linux"
+		local crossopts="-DCMAKE_SYSTEM_NAME=Linux -DCMAKE_HOST_SYSTEM_NAME=Linux"
 	fi
-	cmake -B build \\
+	cmake -B build -G Ninja \\
 		-DCMAKE_INSTALL_PREFIX=/usr \\
 		-DCMAKE_INSTALL_LIBDIR=lib \\
-		-DBUILD_SHARED_LIBS=True \\
+		-DBUILD_SHARED_LIBS=ON \\
 		-DCMAKE_BUILD_TYPE=None \\
-		\$CMAKE_CROSSOPTS .
+		\$crossopts
 	cmake --build build
 __EOF__
 }
@@ -81,12 +81,11 @@ build_meson() {
 # References:
 # http://mesonbuild.com/Reference-manual.html
 # http://mesonbuild.com/Cross-compilation.html
-# TODO For cross compilation a cross_file needs to be created.
 
 	cat >>APKBUILD<<__EOF__
 	abuild-meson \\
 		. output
-	meson compile \${JOBS:+-j \${JOBS}} -C output
+	meson compile -C output
 __EOF__
 }
 
@@ -103,9 +102,17 @@ build_python() {
 __EOF__
 }
 
+build_python_gpep517() {
+	cat >>APKBUILD<<__EOF__
+	gpep517 build-wheel \\
+		--wheel-dir .dist \\
+		--output-fd 3 3>&1 >&2
+__EOF__
+}
+
 build_rust() {
 	cat >>APKBUILD<<__EOF__
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 __EOF__
 }
 
@@ -125,8 +132,7 @@ __EOF__
 
 check_cmake() {
 	cat >>APKBUILD<<__EOF__
-	cd build
-	CTEST_OUTPUT_ON_FAILURE=TRUE ctest
+	ctest --test-dir build --output-on-failure
 __EOF__
 }
 
@@ -136,6 +142,14 @@ check_python() {
 __EOF__
 }
 
+check_python_gpep517() {
+	cat >>APKBUILD<<__EOF__
+	python3 -m venv --clear --without-pip --system-site-packages .testenv
+	.testenv/bin/python3 -m installer .dist/*.whl
+	.testenv/bin/python3 -m pytest
+__EOF__
+}
+
 check_empty() {
 	cat >>APKBUILD<<__EOF__
 	# Replace with proper check command(s)
@@ -191,6 +205,13 @@ package_python() {
 __EOF__
 }
 
+package_python_gpep517() {
+	cat >>APKBUILD<<__EOF__
+	python3 -m installer -d "\$pkgdir" \\
+		.dist/*.whl
+__EOF__
+}
+
 package_empty() {
 	cat >>APKBUILD<<__EOF__
 	# Replace with proper package command(s)
@@ -209,7 +230,7 @@ __EOF__
 newaport() {
 	local newname="${1##*/}"
 	local pn=${newname%[-_][0-9]*}
-	local pv
+	local prearchive postarchive pv
 	local source=
 	is_url "$1" && source="$1"
 
@@ -220,6 +241,10 @@ newaport() {
 		fi
 		pv=${newname%.t*} #strip .tar.gz .tgz .tar.bz2 etc
 		pv=${pv#*[a-z]}
+		prearchive=${source%/archive/*}
+		postarchive=${source#*/archive/}
+		postarchive=${postarchive#refs/tags/}
+		source="${prearchive}/archive/${postarchive}"
 		source="${source%.t*}/$pkgname-$pv.tar.gz"
 	elif [ "$pn" != "$newname" ]; then
 		pv=${newname#$pn[-_]}
@@ -239,23 +264,20 @@ newaport() {
 		source="https://downloads.sourceforge.net/$pn/$pn-$pv.tar.gz"
 	fi
 
-	if [ -z "$depends" ] && [ "$buildtype" = "python" ]; then
-		depends="python3"
-	fi
-
 	if [ -z "$depends" ] && [ "$buildtype" = "perl" ]; then
 		depends="perl"
 	fi
 
-	if [ -z "$checkdepends" ] && [ "$buildtype" = "python" ]; then
+	if [ -z "$checkdepends" ] && [ "$buildtype" = "python"* ]; then
 		checkdepends="py3-pytest"
 	fi
 
 	case "$buildtype" in
 	python) makedepends="py3-setuptools";;
-	cmake)  makedepends="cmake";;
+	python_gpep517) makedepends="py3-gpep517 py3-setuptools py3-wheel";;
+	cmake)  makedepends="cmake samurai";;
 	meson)  makedepends="meson";;
-	rust)   makedepends="cargo";;
+	rust)   makedepends="cargo cargo-auditable";;
 	*)      makedepends="\$depends_dev";;
 	esac
 
@@ -329,6 +351,8 @@ __EOF__
 			buildtype="make"
 		elif [ -r "$sdir"/setup.py ] || [ "${pn#py[0-9]-}" != "$pn" ]; then
 			buildtype="python"
+		elif [ -r "$sdir"/pyproject.toml ] || [ "${pn#py[0-9]-}" != "$pn" ]; then
+			buildtype="python_gpep517"
 		elif [ -r "$sdir"/Cargo.toml ]; then
 			buildtype="rust"
 		fi
@@ -367,6 +391,8 @@ __EOF__
 		build_perl;;
 	python)
 		build_python;;
+	python_gpep517)
+		build_python_gpep517;;
 	rust)
 		build_rust;;
 	*)
@@ -392,6 +418,8 @@ __EOF__
 		check_meson;;
 	python)
 		check_python;;
+	python_gpep517)
+		check_python_gpep517;;
 	rust)
 		check_rust;;
 	*)
@@ -421,6 +449,8 @@ __EOF__
 		package_perl;;
 	python)
 		package_python;;
+	python_gpep517)
+		package_python_gpep517;;
 	rust)
 		package_rust;;
 	*)
@@ -461,7 +491,8 @@ usage() {
 		  -C  Create CMake package (Assume cmake/ is there)
 		  -m  Create meson package (Assume meson.build is there)
 		  -p  Create perl package (Assume Makefile.PL is there)
-		  -y  Create python package (Assume setup.py is there)
+		  -y  Create python setuptools package (Assume setup.py is there)
+		  -e  Create python gpep517 package (Assume pyproject.toml is there)
 		  -r  Create rust package (Assume Cargo.toml is there)
 		  -s  Use sourceforge source URL
 		  -c  Copy a sample init.d, conf.d, and install script
@@ -498,7 +529,7 @@ check_arguments() {
 	fi
 }
 
-while getopts "acCmd:fhl:n:pyu:sr" opt; do
+while getopts "acCmd:fhl:n:pyeu:sr" opt; do
 	case $opt in
 		'a') set_buildtype "autotools";;
 		'c') cpinitd=1;;
@@ -511,6 +542,7 @@ while getopts "acCmd:fhl:n:pyu:sr" opt; do
 		'n') pkgname="$OPTARG";;
 		'p') set_buildtype "perl";;
 		'y') set_buildtype "python";;
+		'e') set_buildtype "python_gpep517";;
 		'r') set_buildtype "rust";;
 		'u') url="$OPTARG";;
 		's') sourceforge=1;;

sample.confd

@@ -1,7 +1,10 @@
-# Sample conf.d file for alpine linux
+# Configuration for /etc/init.d/<SERVICE>
 
-#
-# Specify daemon options here.
-#
+# User (and group) to run <SERVICE> as.
+#command_user="<USER>"
 
-sample_opts=""
+# Additional arguments for <SERVICE> daemon.
+#command_args=
+
+# Comment out to disable process supervisor.
+supervisor=supervise-daemon

sample.initd

@@ -1,14 +1,14 @@
 #!/sbin/openrc-run
 
-# Sample init.d file for alpine linux.
+name="SampleService"
+description="Sample init.d file for Alpine Linux"
 
-name=
-command="/usr/sbin/$name"
-command_args="$sample_opts"
+: ${command_user:="<USER>"}
+
+command="/usr/sbin/<SERVICE>"
+command_args="$command_args"
 command_background="yes"
-
-start_stop_daemon_args="--user $sample_user:$sample_group"
-pidfile="/run/$name.pid"
+pidfile="/run/$RC_SVCNAME.pid"
 
 depend() {
 	need net

tests/abuild_fetch_test

@@ -141,7 +141,7 @@ abuild_fetch_locking_body() {
 		pid1=\$!
 
 		# give enough time for abuild-fetch to call curl
-		sleep 0.2
+		sleep 0.5
 
 		# the first stamp should not exist, second instance should block the retry
 		if [ -e stamp3 ]; then

tests/abuild_keygen_test

@@ -11,7 +11,8 @@ init_tests \
 	abuild_keygen_install_without_sudo \
 	abuild_keygen_install_interactive \
 	abuild_keygen_install_non_interactive \
-	abuild_keygen_install_doas
+	abuild_keygen_install_doas \
+	abuild_keygen_kernel \
 
 export ABUILD_SHAREDIR="$SRCDIR"/..
 export GIT=false
@@ -103,3 +104,14 @@ abuild_keygen_install_doas_body() {
 		abuild-keygen --install -n
 }
 
+abuild_keygen_kernel_body() {
+	atf_check -s exit:0 \
+		-e match:"(Generating|writing) RSA" \
+		-e match:"signing key was created:.*kernel_signing_key.pem" \
+		-e match:"KERNEL_SIGNING_KEY=.*was added to.*abuild.conf" \
+		abuild-keygen --kernel
+	grep '^KERNEL_SIGNING_KEY=.*' "$HOME"/.abuild/abuild.conf \
+			|| atf_fail 'KERNEL_SIGNING_KEY not set in abuild.conf'
+	test -f "$HOME"/.abuild/kernel_signing_key.pem \
+			|| atf_fail '$HOME/.abuild/kernel_signing_key.pem was not created'
+}

tests/abuild_test

@@ -16,16 +16,24 @@ init_tests \
 	abuild_checksum_duplicates \
 	abuild_subpkg_dep_leak \
 	abuild_py_providers_creation \
+	abuild_py_dependency_scan \
+	abuild_py_dependency_scan_conflict \
 	abuild_reject_init_with_improper_shebang \
 	abuild_valid_pkgnames \
 	abuild_invalid_pkgnames \
 	abuild_invalid_subpkgnames \
 	abuild_invalid_subpkg_version \
-	abuild_warn_pkgver_patch_version \
+	abuild_provide_pkgname \
+	abuild_subpackage_arch \
+	abuild_large_doc_subpackage \
+	abuild_bigdocs \
+	abuild_pkgver_digit_letter_digit \
 	abuild_multiline_license \
+	abuild_license_spdx \
 	abuild_git_ceiling \
 	abuild_package_size_zero \
 	abuild_package_size_nonzero \
+	abuild_keepdirs \
 	abuild_amove \
 	abuild_doc \
 	abuild_dev \
@@ -33,7 +41,16 @@ init_tests \
 	abuild_devhelp \
 	abuild_check_maintainer \
 	abuild_cleanoldpkg \
-	abuild_path_with_spaces
+	abuild_path_with_spaces \
+	abuild_pyc_warn \
+	abuild_pyc \
+	abuild_setcap_binary \
+	abuild_setcap_binary_with_option \
+	abuild_command_provides \
+	abuild_gocache_dir \
+	abuild_cargo_home_dir \
+	abuild_fish_comp_split \
+	abuild_deps
 
 export ABUILD_SHAREDIR=$(atf_get_srcdir)/..
 export ABUILD_CONF=/dev/null
@@ -331,13 +348,32 @@ abuild_subpkg_dep_leak_body() {
 abuild_py_providers_creation_body() {
 	init_keys
 	cp -ra "$testrepo" .
-	cd testrepo/py3-foo-and-bar
+	cd testrepo/py3\ foo\ and\ bar
 	abuild rootpkg || atf_fail "abuild failed"
 	atf_check -s exit:0 \
 		-o match:"provides = py3.9:foo=1.0.0-r0" \
 		cat pkg/.control.py3-foo-and-bar/.PKGINFO
 }
 
+abuild_py_dependency_scan_body() {
+	init_keys
+	cp -ra "$testrepo" .
+	cd testrepo/py3\ foo\ and\ bar
+	abuild rootpkg || atf_fail "abuild failed"
+	atf_check -s exit:0 \
+		-o match:"depend = python3~3.9" \
+		cat pkg/.control.py3-foo-and-bar/.PKGINFO
+}
+
+abuild_py_dependency_scan_conflict_body() {
+	init_keys
+	cp -ra "$testrepo" .
+	cd testrepo/py3-conflicting-python-versions
+	atf_check -s exit:1 \
+		-e match:"ERROR.*package contains python3 modules for conflicting python3 versions" \
+		abuild rootpkg
+}
+
 abuild_reject_init_with_improper_shebang_body() {
 	mkdir invalid-initd
 	cd invalid-initd
@@ -380,6 +416,9 @@ abuild_valid_pkgnames_body() {
 	TESTSUBNAME=foo atf_check -s exit:0 \
 		-e match:"Checking sanity" \
 		abuild sanitycheck
+	TESTNAME="more_+-2.0-complicated" atf_check -s exit:0 \
+		-e match:"Checking sanity" \
+		abuild sanitycheck
 }
 
 abuild_invalid_pkgnames_body() {
@@ -395,6 +434,12 @@ abuild_invalid_pkgnames_body() {
 	TESTNAME="foo with spaces" atf_check -s exit:1 \
 		-e match:"Checking sanity" \
 		abuild sanitycheck
+	TESTNAME="width@at" atf_check -s exit:1 \
+		-e match:"Checking sanity" \
+		abuild sanitycheck
+	TESTNAME="width=equal" atf_check -s exit:1 \
+		-e match:"Checking sanity" \
+		abuild sanitycheck
 }
 
 abuild_invalid_subpkgnames_body() {
@@ -418,14 +463,65 @@ abuild_invalid_subpkg_version_body() {
 		abuild all
 }
 
-abuild_warn_pkgver_patch_version_body() {
+abuild_provide_pkgname_body() {
+	init_keys
 	cp -ra "$testrepo"/test-pkgname .
 	cd test-pkgname
-	TESTPKGVER=1.0_p1 atf_check -s exit:0 \
-		-e not-match:'WARNING' \
+	TESTNAME=provided atf_check -s exit:1 \
+		-e match:"provides must not contain" \
 		abuild sanitycheck
-	TESTPKGVER=1.0p1 atf_check -s exit:0 \
-		-e match:'WARNING.*1.0_p1' \
+	TESTNAME=test TESTPROVIDES='test~1' atf_check -s exit:1 \
+		-e match:"provides must not contain" \
+		abuild sanitycheck
+	TESTNAME=test TESTPROVIDES='test=1' atf_check -s exit:1 \
+		-e match:"provides must not contain" \
+		abuild sanitycheck
+	TESTNAME=test TESTPROVIDES='test>1' atf_check -s exit:1 \
+		-e match:"provides must not contain" \
+		abuild sanitycheck
+	TESTNAME=test TESTPROVIDES='test<=1' atf_check -s exit:1 \
+		-e match:"provides must not contain" \
+		abuild sanitycheck
+}
+
+abuild_subpackage_arch_body() {
+	init_keys
+	cp -ra "$testrepo" .
+	cd testrepo/subpackage-arch
+	arch="$(abuild -A)"
+
+	for i in noarch all "$arch"; do
+		TESTSUBARCH="$i" abuild all
+
+		[ -f "$REPODEST/testrepo/$arch/test-pkgname-$i-1.0-r0.apk" ] || \
+			atf_fail "Failed to place $i arch subpackage correctly"
+		rm -rf "$REPODEST/testrepo"
+	done
+}
+
+abuild_large_doc_subpackage_body() {
+	init_keys
+	cp -ra "$testrepo"/large-doc-subpkg .
+	cd large-doc-subpkg
+	atf_check -s exit:0 \
+		-e match:"-doc subpackage is unusually large" \
+		abuild all
+}
+
+abuild_bigdocs_body() {
+	init_keys
+	cp -ra "$testrepo"/large-doc-subpkg .
+	cd large-doc-subpkg
+	options=bigdocs atf_check -s exit:0 \
+		-e not-match:"-doc subpackage is unusually large" \
+		abuild all
+}
+
+abuild_pkgver_digit_letter_digit_body() {
+	cp -ra "$testrepo"/test-pkgname .
+	cd test-pkgname
+	TESTPKGVER=1.0p1 atf_check -s exit:1 \
+		-e match:'ERROR.*version' \
 		abuild sanitycheck
 }
 
@@ -433,10 +529,18 @@ abuild_multiline_license_body() {
 	cp -ra "$testrepo"/test-licenses .
 	cd test-licenses
 	abuild rootpkg
-	atf_check -o match:'^license = MIT AND GPL-3.0-only OR GPL-3.0-or-later AND BSD-Clause-4$' \
+	atf_check -o match:'^license = MIT AND \(GPL-3.0-only OR GPL-3.0-or-later AND BSD-Clause-4\)$' \
 		cat pkg/.control.test-licenses/.PKGINFO
 }
 
+abuild_license_spdx_body() {
+	cp -ra "$testrepo"/test-licenses .
+	cd test-licenses
+	TESTPKGVER=1.0_p1 atf_check -s exit:0 \
+		-e not-match:'WARNING' \
+		abuild sanitycheck
+}
+
 abuild_git_ceiling_body() {
 	init_keys
 	git init
@@ -467,7 +571,6 @@ abuild_git_ceiling_body() {
 		abuild
 }
 
-
 create_fake_du() {
 	mkdir -p bin
 	cat > bin/du <<-EOF
@@ -539,6 +642,32 @@ abuild_package_size_nonzero_body() {
 		cat pkg/.control.test-size/.PKGINFO
 }
 
+abuild_keepdirs_body() {
+	init_keys
+	mkdir -p test-amove
+
+	cd test-amove
+	cat > APKBUILD <<-EOF
+		# Maintainer: Test User 123 <123@example.com>
+
+		# test package
+		pkgname="test-keepdirs"
+		pkgver="1.0"
+		pkgrel=0
+		pkgdesc='Dummy test package - keepdirs'
+		url='https://gitlab.alpinelinux.org/alpine/aports'
+		arch='noarch'
+		license='MIT'
+		options='keepdirs'
+
+		package() {
+			mkdir -p "\$pkgdir"/usr/bin
+		}
+	EOF
+	abuild rootpkg || atf_fail "abuild rootpkg failed"
+	test -d pkg/test-keepdirs/usr/bin || atf_fail "$i failed"
+}
+
 abuild_amove_body() {
 	init_keys
 	mkdir -p test-amove
@@ -560,7 +689,8 @@ abuild_amove_body() {
 			\$pkgname-bin:_bin
 			\$pkgname-sbin:_sbin
 			\$pkgname-var:_var
-			\$pkgname-usr:_usr"
+			\$pkgname-usr:_usr
+			\$pkgname-space:_space"
 
 		package() {
 			mkdir -p "\$pkgdir"/etc \
@@ -572,6 +702,7 @@ abuild_amove_body() {
 				"\$pkgdir"/etc/\$pkgname.conf \
 				"\$pkgdir"/bin/hello \
 				"\$pkgdir"/sbin/shello \
+				"\$pkgdir"/sbin/space' ' \
 				"\$pkgdir"/var/lib/\$pkgname/testfile \
 				"\$pkgdir"/usr/share/a \
 				"\$pkgdir"/usr/share/b
@@ -599,6 +730,10 @@ abuild_amove_body() {
 			# glob *
 			amove usr/share/*
 		}
+		_space() {
+			# with space
+			amove sbin/space' '
+		}
 
 	EOF
 	abuild rootpkg || atf_fail "abuild rootpkg failed"
@@ -610,8 +745,9 @@ abuild_amove_body() {
 			test-amove-var/var/lib/test-amove/testfile \
 			test-amove-usr/usr/share/a \
 			test-amove-usr/usr/share/b \
+			test-amove-space/sbin/space' ' \
 			; do \
-		test -f pkg/$i || atf_fail "$i failed"
+		test -f pkg/"$i" || atf_fail "$i failed"
 	done
 }
 
@@ -782,7 +918,7 @@ abuild_cleanoldpkg_body() {
 					mkdir -p "\$pkgdir"
 				}
 			EOF
-			CARCH=$arch atf_check -e not-empty abuild
+			CARCH=$arch atf_check -e not-empty abuild clean unpack rootpkg
 		done
 	done
 
@@ -824,3 +960,286 @@ abuild_path_with_spaces_body() {
 		-e match:"Build complete" \
 		abuild
 }
+
+abuild_pyc_warn_body() {
+	init_keys
+
+	mkdir -p pycachetest
+	cd pycachetest
+	cat >APKBUILD <<-EOF
+		# Maintainer: Joe User <juser@example.com>
+		pkgname="pycachetest"
+		pkgver="1.0"
+		pkgrel=0
+		pkgdesc="Dummy test package"
+		url="https://gitlab.alpinelinux.org/alpine/aports"
+		arch="noarch"
+		license="MIT"
+		source=""
+
+		package() {
+			mkdir -p "\$pkgdir"/usr/lib/python3.11/site-packages/test/__pycache__/
+			touch "\$pkgdir"/usr/lib/python3.11/site-packages/test/__pycache__/main.cpython-311.pyc
+		}
+	EOF
+
+	atf_check -e match:"WARNING.*pyc*" abuild rootpkg
+}
+
+abuild_pyc_body() {
+	init_keys
+
+	mkdir -p foo
+	cd foo
+	cat >APKBUILD <<-EOF
+		# Maintainer: Joe User <juser@example.com>
+		pkgname="foo"
+		pkgver="1.0"
+		pkgrel=0
+		pkgdesc="Dummy test package"
+		url="https://gitlab.alpinelinux.org/alpine/aports"
+		arch="noarch"
+		license="MIT"
+		source=""
+		subpackages="\$pkgname-pyc"
+
+		package() {
+			mkdir -p "\$pkgdir"/usr/lib/python3.11/site-packages/test/__pycache__/
+			touch "\$pkgdir"/usr/lib/python3.11/site-packages/test/__pycache__/main.cpython-311.pyc
+		}
+	EOF
+
+	atf_check -o match:"->" -e not-match:"WARNING.*pyc*" abuild rootpkg
+	atf_check -o match:"__pycache__" find pkg/foo-pyc -name '__pycache__'
+	# verify install_if is correct
+	atf_check -o match:"foo=1.0-r0" -o match:"pyc" \
+		grep install_if pkg/.control.foo-pyc/.PKGINFO
+}
+
+abuild_setcap_binary_body() {
+	init_keys
+	cp -ra "$testrepo"/setcap .
+	cd setcap
+	atf_check -s exit:1 \
+		-e match:"Found binary with extra capabilities" \
+		-e match:"Found setcap binary executable by others" \
+		abuild all
+}
+
+abuild_setcap_binary_with_option_body() {
+	init_keys
+	cp -ra "$testrepo"/setcap .
+	cd setcap
+	options=setcap atf_check -s exit:0 \
+		-e not-match:"Found binary with extra capabilities" \
+		-e match:"Found setcap binary executable by others" \
+		abuild all
+}
+
+abuild_command_provides_body() {
+	init_keys
+	mkdir testprovides
+	cd testprovides
+	cat >APKBUILD<<-EOF
+		# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+		pkgname=testprovides
+		pkgver=1.0
+		pkgrel=0
+		pkgdesc="Dummy test package that installs a file and directory in path"
+		url="https://gitlab.alpinelinux.org/alpine/aports"
+		arch="noarch"
+		license="MIT"
+		prepare() { mkdir -p "\$builddir"; }
+		build() { true; }
+		check() { true; }
+		package() {
+			mkdir -p "\$pkgdir/usr/bin"
+			printf "%s\n" '#!/bin/sh' >"\$pkgdir/usr/bin/foo"
+			chmod +x "\$pkgdir/usr/bin/foo"
+			cp -a "\$pkgdir/usr/bin/foo" "\$pkgdir/usr/bin/foo@"
+			mkdir -p "\$pkgdir/usr/bin/dir/"
+		}
+	EOF
+	abuild rootpkg
+
+	atf_check \
+		-o match:"provides = cmd:foo=1.0-r0" \
+		-o not-match:"provides = cmd:foo@=1.0-r0" \
+		-o not-match:"provides = cmd:dir=1.0-r0" \
+		grep '^provides = ' pkg/.control.testprovides/.PKGINFO
+}
+
+abuild_gocache_dir_body() {
+	init_keys
+	mkdir gocache-dir
+	cd gocache-dir
+	cat >APKBUILD<<-EOF
+		# Maintainer: Joe User <juser@example.com>
+		pkgname="gocache-dir"
+		pkgver="1.0"
+		pkgrel=0
+		pkgdesc="Dummy test package"
+		url="https://gitlab.alpinelinux.org/alpine/aports"
+		arch="noarch"
+		license="MIT"
+		prepare() {
+			mkdir -p "\$builddir"
+		}
+		build() {
+			echo "dir:\$GOCACHE"
+		}
+		package() {
+			:
+		}
+	EOF
+
+	unset GOCACHE
+	MOVE_CACHES=1 \
+	atf_check -s exit:0 \
+		-o match:"dir:.*/tmp/go" \
+		abuild prepare build
+}
+
+abuild_cargo_home_dir_body() {
+	init_keys
+	mkdir cargo-home-dir
+	cd cargo-home-dir
+	cat >APKBUILD<<-EOF
+		# Maintainer: Joe User <juser@example.com>
+		pkgname="cargo-home-dir"
+		pkgver="1.0"
+		pkgrel=0
+		pkgdesc="Dummy test package"
+		url="https://gitlab.alpinelinux.org/alpine/aports"
+		arch="noarch"
+		license="MIT"
+		prepare() {
+			mkdir -p "\$builddir"
+		}
+		build() {
+			echo "dir:\$CARGO_HOME"
+		}
+		package() {
+			:
+		}
+	EOF
+
+	unset CARGO_HOME
+	MOVE_CACHES=1 \
+	atf_check -s exit:0 \
+		-o match:"dir:.*/tmp/cargo" \
+		abuild prepare build
+}
+
+abuild_fish_comp_split_body() {
+	init_keys
+	mkdir fish-split-dir
+	cd fish-split-dir
+	cat >APKBUILD<<-EOF
+		# Maintainer: Joe User <juser@example.com>
+		pkgname="fish-split-dir"
+		pkgver="1.0"
+		pkgrel=0
+		pkgdesc="Dummy test package"
+		url="https://gitlab.alpinelinux.org/alpine/aports"
+		arch="noarch"
+		license="MIT"
+		prepare() {
+			mkdir -p "\$builddir"
+		}
+		package() {
+			mkdir -p "\$pkgdir"/usr/share/fish/completions/
+			mkdir -p "\$pkgdir"/usr/share/fish/vendor_completions.d/
+			echo "comp" > "\$pkgdir"/usr/share/fish/completions/comp.fish
+			echo "comp" > "\$pkgdir"/usr/share/fish/vendor_completions.d/comp.fish
+		}
+	EOF
+	# test that there is a warning for the legacy dir existing
+	atf_check -s exit:0 \
+		-e match:"fish completions for programs should be located in /usr/share/fish/vendor_completions.d" \
+		abuild prepare build rootpkg
+
+	# now add the correct subpackage
+	echo 'subpackages="$pkgname-fish-completion"' >> APKBUILD
+	abuild clean prepare build rootpkg
+
+	if ! [ -d pkg/fish-split-dir-fish-completion/usr/share/fish/completions ]; then
+		echo "missing old dir"
+		exit 1
+	fi
+	if ! [ -d pkg/fish-split-dir-fish-completion/usr/share/fish/vendor_completions.d ]; then
+		echo "missing new dir"
+		exit 1
+	fi
+}
+
+create_mock_apk() {
+	mkdir -p bin
+	cat > bin/apk <<-EOF
+		#!/bin/sh
+		if [ "\$1" = "--print-arch" ]; then
+			echo 'aarch64'
+			exit 0
+		fi
+		echo apk "\$@" >&2
+	EOF
+	chmod +x bin/apk
+	ln -s apk bin/abuild-apk
+	PATH="$PWD/bin:$PATH"
+}
+
+abuild_deps_body() {
+	create_mock_apk
+	mkdir testdeps
+	cd testdeps
+	cat >APKBUILD <<-EOF
+		# Maintainer: Joe User <juser@example.com>
+		pkgname="testdeps"
+		pkgver="1.0"
+		pkgrel=0
+		pkgdesc="Dummy test package"
+		url="https://gitlab.alpinelinux.org/alpine/aports"
+		arch="noarch"
+		license="MIT"
+		depends="foo"
+		makedepends="bar"
+		checkdepends="checkdep"
+		makedepends_host="hostdep"
+		makedepends_build="builddep"
+	EOF
+
+	# native build. pull in both depends and makedepends
+	# do not install in any --root
+	atf_check \
+		-e match:'Installing for build: foo bar checkdep$' \
+		-e match:'apk add .*--virtual .makedepends-testdeps foo bar checkdep' \
+		-e not-match:'apk add .*--root' \
+		abuild deps
+
+	# dont install checkdep with ABUILD_BOOTSTRAP
+	ABUILD_BOOTSTRAP=1 atf_check \
+		-e not-match:"apk add.*checkdep" \
+		abuild deps
+
+	# crosscompile:
+	#   install makedepends_build without --root
+	#   install makedepends_host with --root
+	CTARGET='s390x' CHOST='ppc64le' CBUILDROOT="$PWD/root" atf_check \
+		-e match:'Installing for build: builddep' \
+		-e match:'Installing for host: hostdep' \
+		-e match:'apk add .*--virtual .makedepends-testdeps builddep' \
+		-e not-match:'apk add.*--root.*builddep' \
+		-e match:'apk add .*--root.*hostdep' \
+		-e match:'apk add .*--arch s390x.*hostdep' \
+		-e not-match:'apk add.*checkdep' \
+		abuild deps
+
+	# crosscompile, set only CHOST
+	CHOST='armhf' atf_check \
+		-e match:'apk add.*builddep' \
+		-e not-match:'apk add.*--root.*builddep' \
+		-e match:'apk add.*--root.*--arch armhf.*hostdep' \
+		-e not-match:'apk add.*--arch armhf.*builddep' \
+		abuild deps
+
+}

tests/bin/openssl

@@ -3,9 +3,13 @@
 # fake openssl
 while [ $# -gt 0 ]; do
 	case "$1" in
-		genrsa|rsa)
+		genrsa|rsa|req)
 			cmd="$1"
 			;;
+		-config)
+			shift
+			config="$1"
+			;;
 		-out)
 			shift
 			outfile="$1"
@@ -25,5 +29,16 @@ case "$cmd" in
 		echo "writing RSA key" >&2
 		cat "$FAKEKEYPUB" > "$outfile"
 		;;
+	req)
+		echo "Using configuration from $config" >&2
+		echo "Generating RSA key with 4096 bits" >&2
+		echo "Writing private key to '$outfile'" >&2
+		cat "$FAKEKEY" "$FAKEKEYPUB" > "$outfile"
+		;;
+	*)
+		echo "unimplemented fake openssl command: $cmd" >&2
+		exit 1
+		;;
+
 esac
 

tests/checkapk_test

@@ -0,0 +1,40 @@
+#!/usr/bin/env atf-sh
+
+. $(atf_get_srcdir)/test_env.sh
+init_tests \
+	checkapk_help \
+	checkapk_invalid_opt \
+	checkapk_missing_abuild_conf \
+	checkapk_missing_apkbuild
+
+DATADIR=$(atf_get_srcdir)/testdata
+
+export ABUILD_SHAREDIR=$(atf_get_srcdir)/..
+export ABUILD_CONF=/dev/null
+export ABUILD_USERCONF=/dev/null
+
+checkapk_help_body() {
+	atf_check -s exit:0 \
+		-o match:"Usage:" \
+		checkapk --help
+}
+
+checkapk_invalid_opt_body() {
+	atf_check -s not-exit:0 \
+		-e match:"Usage:" \
+		checkapk --invalid
+}
+
+checkapk_missing_abuild_conf_body() {
+	ABUILD_DEFCONF=/dev/null atf_check \
+		-s not-exit:0 \
+		-e match:"no abuild.conf found" \
+		checkapk
+}
+
+checkapk_missing_apkbuild_body() {
+	atf_check \
+		-s not-exit:0 \
+		-e match:"must be run in the directory of a built package" \
+		checkapk
+}

tests/functions_test

@@ -6,7 +6,8 @@ init_tests \
 	funcs_check_missing_gcc \
 	funcs_check_missing_apk \
 	funcs_check_missing_git \
-	funcs_check_env_set_but_empty
+	funcs_check_env_set_but_empty \
+	funcs_check_defconfig
 
 FUNCS=$(atf_get_srcdir)/../functions.sh
 
@@ -53,3 +54,34 @@ funcs_check_env_set_but_empty_body() {
 		done
 	done
 }
+
+funcs_check_defconfig_body() {
+	echo "CFLAGS=defcflags" > def.conf
+	echo "CFLAGS=syscflags" > etc.conf
+	echo "CFLAGS=usercflags" > user.conf
+
+	unset CFLAGS
+
+	# test /usr/share/abuild/default.conf
+	ABUILD_DEFCONF="$PWD"/def.conf ABUILD_CONF=/dev/null ABUILD_USERCONF=/dev/null \
+		atf_check -o match:"defcflags" \
+		sh -e -c " . $FUNCS; echo \"\$CFLAGS\""
+
+	# test /etc/abuild.conf
+	ABUILD_DEFCONF=/dev/null ABUILD_CONF="$PWD"/etc.conf ABUILD_USERCONF=/dev/null \
+		atf_check \
+		-o match:"syscflags" \
+		sh -e -c " . $FUNCS; echo \"\$CFLAGS\""
+
+	# user config ($HOME/.abuild/abuild.conf) wins over /etc/abuild.conf
+	ABUILD_DEFCONF="$PWD"/def.conf ABUILD_CONF="$PWD/etc.conf" ABUILD_USERCONF="$PWD/user.conf" \
+	atf_check \
+		-o match:"usercflags" \
+		sh -e -c " . $FUNCS; echo \"\$CFLAGS\""
+
+	# environment wins
+	ABUILD_DEFCONF="$PWD"/def.conf ABUILD_CONF="$PWD/etc.conf" ABUILD_USERCONF="$PWD/user.conf" \
+		CFLAGS="envcflags" atf_check \
+		-o match:"envcflags" \
+		sh -e -c " . $FUNCS; echo \"\$CFLAGS\""
+}

tests/testrepo/large-doc-subpkg/APKBUILD

@@ -0,0 +1,35 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+
+# test package
+pkgname="large-doc-subpkg"
+pkgver="1.0"
+pkgrel=0
+pkgdesc="Dummy test package to check if large doc subpackages cause a warning to be emitted"
+url="https://gitlab.alpinelinux.org/alpine/aports"
+arch="noarch"
+license="MIT"
+subpackages="$pkgname-doc"
+source=""
+
+prepare() {
+	mkdir -p "$builddir"
+}
+
+build() {
+	true
+}
+
+check() {
+	true
+}
+
+package() {
+	mkdir -p "$pkgdir/usr/bin"
+	cat >"$pkgdir/usr/bin/foo" <<EOF
+	#!/bin/sh
+EOF
+
+	mkdir -p "$pkgdir/usr/share/doc/$pkgname"
+	dd bs=1024 count=$((3 * 1024)) if=/dev/random \
+		of="$pkgdir/usr/share/doc/$pkgname/large-file"
+}

tests/testrepo/py3-conflicting-python-versions/APKBUILD

@@ -0,0 +1,17 @@
+# Maintainer: Test user <user@example.com>
+pkgname=py3-conflicting-python-versions
+pkgver=1.0.0
+pkgrel=0
+pkgdesc="dummy package for test"
+url="https://alpinelinux.org"
+license="MIT"
+builddir="$srcdir"
+
+package() {
+	for pyver in 3.9 3.42; do
+		local sitedir="usr/lib/python$pyver/site-packages"
+		mkdir -p "$pkgdir"/$sitedir/foo
+		touch "$pkgdir"/$sitedir/foo/__init__.py
+		touch "$pkgdir"/$sitedir/bar.py
+	done
+}

tests/testrepo/setcap/APKBUILD

@@ -0,0 +1,33 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+
+# test package
+pkgname=setcap
+pkgver="1.0"
+pkgrel=0
+pkgdesc="Dummy test package that has an setcap binary but no setcap option"
+url="https://gitlab.alpinelinux.org/alpine/aports"
+arch="noarch"
+license="MIT"
+source=""
+
+prepare() {
+	mkdir -p "$builddir"
+}
+
+build() {
+	true
+}
+
+check() {
+	true
+}
+
+package() {
+	mkdir -p "$pkgdir/usr/bin"
+	cat >"$pkgdir/usr/bin/foo" <<EOF
+	#!/bin/sh
+EOF
+	chmod +x "$pkgdir/usr/bin/foo"
+	setcap cap_net_bind_service=+ep "$pkgdir/usr/bin/foo"
+}
+

tests/testrepo/subpackage-arch/APKBUILD

@@ -0,0 +1,24 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+
+# test package
+pkgname=${TESTNAME-test-pkgname}
+pkgver="${TESTPKGVER-1.0}"
+pkgrel=0
+pkgdesc="Dummy subpackage arch"
+url="https://gitlab.alpinelinux.org/alpine/aports"
+arch="noarch"
+license="MIT"
+subpackages="$pkgname-$TESTSUBARCH:_sub:$TESTSUBARCH"
+options="!archcheck"
+
+check() {
+	true
+}
+
+package() {
+	mkdir -p "$pkgdir"
+}
+
+_sub() {
+	mkdir -p "$subpkgdir"
+}

tests/testrepo/test-licenses/APKBUILD

@@ -8,10 +8,10 @@ pkgdesc='Dummy test package that has multi-line licenses'
 url='https://gitlab.alpinelinux.org/alpine/aports'
 arch='noarch'
 license='MIT AND
-         GPL-3.0-only OR  
+         (GPL-3.0-only OR  
   
  GPL-3.0-or-later AND   
-		 BSD-Clause-4
+		 BSD-Clause-4)
 '
 
 prepare() {

tests/testrepo/test-pkgname/APKBUILD

@@ -8,6 +8,7 @@ pkgdesc="Dummy test package that fails to build"
 url="https://gitlab.alpinelinux.org/alpine/aports"
 arch="noarch"
 license="MIT"
+provides="${TESTPROVIDES-provided}"
 subpackages="${TESTSUBNAME-$pkgname-sub}:_sub"
 
 prepare() {