Major Changes

Security hardening

• Bound repository archive handling: limit downloaded archives and extracted members to 1 GiB or half of the free temporary storage, limit repository metadata to 1 MiB, reject duplicate members
• Bound repository signature extraction: limit the sandbox callback response to 8 MiB, reject archives with more than eight signature entries or an entry larger than 1 MiB
• Bound vulnerability database handling: fixed maxima for the remote download and decompressed output, build a temporary database and atomically replace the existing one on success
• Enforce signed package size while fetching: keep the trusted expected size separate from response metadata and cap the stream at that size
• Reject invalid repository signature types: only accept pubkey, fingerprints and none
• Drop privileges in sandboxed callbacks: drop to nobody before entering Capsicum

rwhich

• Store the filesite as a compressed archive parsed in memory, removing the pkg_files and file_dirs tables from the repo SQLite database (~96% of the DB size)
• rwhich: verify signature and store as a raw compressed file
• rwhich: add a global configuration and a per-repository configuration

Repository

• repo: keep file lists out of the data catalog (data.pkg), fixing a ballooning catalog (e.g. a full i386 repo grew from ~60MB to ~2GB)
• repo: open the catalogue read-only when checking validity
• compression: respect compression_level for the file database and the metadata

Minor Changes

• pkg_jobs: fix doubled (added)/(removed) reinstall reasons
• pkg_jobs: fix use-after-free during an additional SAT cycle
• feat: add PKG_EVENT_RC_SCRIPT for rc.d script actions
• fix: fix deferred rc script execution
• fetch: fix SRV/mirror server failover
• pkg_repo: fix incompatible pointer breaking Linux builds
• utils: always print signature_type
• plug multiple memory leaks