[ArchLinux] Arrays and dependencies handled incorrectly

[Ppjet6]

Not entirely sure how to title this issue, feel free to change it.

Consider the example below, which is a stripped down version of the following real world example (chromium)

pkgname=foo
pkgver=1.0
pkgrel=1
pkgdesc="Bar"
arch=('any')
url="https://foo.bar"
license=('MIT')
depends=('baz')

_foo=(
  'qxx'
)
depends+=(${foo[@]})

package() {
  touch foo
}

OBS doesn't see the dependency on qxx, and makepkg is then called with -s (--syncdeps, build-recipe-arch#L44), which detects it and fails to ask for a password.

If OBS gets fixed, dropping the -s would certainly be reasonable, since it is not supposed(?) to have to install dependencies in the first place. Let alone the fact that it fails anyway. If keeping -s then proper permissions should be given to makepkg.

In anycase, removing the > /dev/null on that line was helpful for debug purposes.

[Martchus]

Wouldn't it make sense to rely on parser-friendly .SRCINFO files? I don't think users will complain that they have to provide an additional file because that's how the AUR already works. Trying to parse a Bash script without sourcing/executing on the other hand is a bad idea because it will always lead to issues like that.