[rpms/pacman] rawhide: Fix deadlock in fork()ed child with curl 8.20

[Martin Pitt <martin@piware.de>]

            A new commit has been pushed.

            Repo   : rpms/pacman
            Branch : rawhide
            Commit : 65f8a58261bda539a31124e15048b4ec96b8756f
            Author : Martin Pitt <martin@piware.de>
            Date   : 2026-06-04T11:53:09+02:00
            Stats  : +37/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/pacman/c/65f8a58261bda539a31124e15048b4ec96b8756f?branch=rawhide

            Log:
            Fix deadlock in fork()ed child with curl 8.20

Patch taken from Arch:
https://gitlab.archlinux.org/archlinux/packaging/packages/pacman/-/commit/387ebf06060fd5f
proposed upstream at
https://gitlab.archlinux.org/pacman/pacman/-/merge_requests/361.

https://gitlab.archlinux.org/pacman/pacman/-/merge_requests/360 is a
better fix (without memory leaks), but neither has been accepted
upstream yet. But being accepted in Arch is good enough for now, and
avoids the hangs.

See https://github.com/systemd/mkosi/issues/4344 for details.

Reproducer:

cat > /tmp/pacman.conf <<'EOF'
[options]
Architecture = x86_64
SigLevel = Never

[core]
Server = https://geo.mirror.pkgbuild.com/core/os/x86_64
EOF

podman run --rm -v /tmp/pacman.conf:/tmp/pacman.conf:ro registry.fedoraproject.org/fedora:rawhide bash -ec \
    'dnf -q -y install pacman >/dev/null
    mkdir -p /tmp/root/var/lib/pacman
    timeout 120 pacman --config /tmp/pacman.conf --root /tmp/root --noconfirm -Sy glibc'

---
diff --git a/0001-libalpm-invalidate-curl-data-in-child.patch b/0001-libalpm-invalidate-curl-data-in-child.patch
new file mode 100644
index 0000000..7f529b7
--- /dev/null
+++ b/0001-libalpm-invalidate-curl-data-in-child.patch
@@ -0,0 +1,32 @@
+From 21b8d8a21a03e0d44294626f7222adda6b48dfac Mon Sep 17 00:00:00 2001
+From: Christian Hesse <mail@eworm.de>
+Date: Thu, 30 Apr 2026 12:31:13 +0200
+Subject: [PATCH 1/1] libalpm: invalidate curl data in child
+
+Touching that data inside the child makes it crash. So let's invalidate
+and ignore it there.
+
+https://github.com/curl/curl/issues/21466
+
+---
+ lib/libalpm/util.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+Taken from https://gitlab.archlinux.org/archlinux/packaging/packages/pacman/-/commit/387ebf06060fd5f
+
+diff --git a/lib/libalpm/util.c b/lib/libalpm/util.c
+index 6739161b..8a99ef87 100644
+--- a/lib/libalpm/util.c
++++ b/lib/libalpm/util.c
+@@ -673,6 +673,11 @@ int _alpm_run_chroot(alpm_handle_t *handle, const char *cmd, char *const argv[],
+ 			close(cwdfd);
+ 		}
+ 
++#ifdef HAVE_LIBCURL
++		/* invalidate the curl data - we must not touch it in child */
++		handle->curlm = NULL;
++#endif
++
+ 		/* use fprintf instead of _alpm_log to send output through the parent */
+ 		/* don't chroot() to "/": this allows running with less caps when the
+ 		 * caller puts us in the right root */

diff --git a/pacman.spec b/pacman.spec
index 631925e..c838444 100644
--- a/pacman.spec
+++ b/pacman.spec
@@ -14,6 +14,11 @@ Version:        7.1.0
 Release:        %autorelease
 Source0:        https://gitlab.archlinux.org/pacman/pacman/-/archive/v%{version}/pacman-v%{version}.tar.gz
 Source1:        https://www.archlinux.org/mirrorlist/all
+# Fix deadlock in fork()ed child with curl 8.20 threaded resolver
+# https://github.com/curl/curl/issues/21466
+# https://gitlab.archlinux.org/pacman/pacman/-/merge_requests/360 or https://gitlab.archlinux.org/pacman/pacman/-/merge_requests/361
+# https://github.com/systemd/mkosi/issues/4344
+Patch0:         0001-libalpm-invalidate-curl-data-in-child.patch
 URL:            https://gitlab.archlinux.org/pacman/pacman
 License:        GPL-2.0-or-later
 Summary:        Package manager for the Arch distribution