- Arch-announce - lists.archlinux.org

[arch-announce] Active AUR malicious packages incident
by Arch Linux: Recent news updates: Campbell Jones 12 Jun '26

12 Jun '26

We are currently experiencing a high volume of malicious package adoptions and updates in the Arch User Repository. We are actively working to track down existing malicious commits and attempting to prevent additional malicious commits from being pushed. While this is happening, and while we work to create a more permanent solution, users may see issues with the following: - Creating new accounts on the AUR - Pushing package updates - Adopting or creating new packages We continue to encourage all users of AUR packages to review *all* PKGBUILD and install script changes when updating, especially during this time. If you notice suspicious commits to a package that you use, please reach out to Arch staff via the aur-general mailing list with more information. URL: https://archlinux.org/news/active-aur-malicious-packages-incident/

1 0

[arch-announce] Arch Linux 2026 Leader Election Results
by Arch Linux: Recent news updates: Christian Heusel 04 Jun '26

04 Jun '26

Recently we held our leader elections and after a lively discussion period on the (internal) mailing lists and voting phase with two candidates [**Levente "anthraxx" Polyák**](https://archlinux.org/people/developers/#anthraxx) was re-elected as Arch Linux Project Lead. As per [our election rules][0] he is re-elected with the term lasting two years. The role of of the project lead within Arch Linux is connected to [a bunch of responsibilities][1] regarding decision making (when no consensus can be reached), community leadership, Code of Conduct enforcement, handling financial matters with SPI and overall project management tasks. **Congratulations to Levente, thank you for stepping up to serve this community and all the best wishes for another successful term! 🥳** [0]: https://wiki.archlinux.org/title/DeveloperWiki:Project_Leader#Election [1]: https://wiki.archlinux.org/title/DeveloperWiki:Project_Leader#Roles URL: https://archlinux.org/news/arch-linux-2026-leader-election-results/

1 0

[arch-announce] Breaking changes for all users of `varnish`, which is renamed to `vinyl-cache`
by Arch Linux: Recent news updates: Sven-Hendrik Haase 25 May '26

25 May '26

The Varnish project has [renamed itself to Vinyl Cache][0]. We followed this rename with a [new `vinyl-cache` package][1]. This upgrade results in [breaking changes][2] and users are advised to study these changes and how it affects them before following the replacement. All references to "`varnish`" have been changed to "`vinyl`" in all binaries and directories. At minimum, users will have to: - rename `/etc/varnish` to `/etc/vinyl-cache` - rename `/var/lib/varnish` to `/var/lib/vinyl-cache` - fix up ownership of files inside `/var/lib/varnish` - user `varnish` becomes `vinyl` - group `varnish` becomes `vinyl` - user `varnishlog` becomes `vinyllog` - user `vcache` remains the same - disable the old `varnish.service` and `varnishncsa.service` systemd units - enable the new `vinyl-cache.service` and `vinylncsa.service` systemd units Meanwhile, the `varnish` package has been dropped from `[extra]`. We're not currently planning to maintain a new `varnish` package as it's a different upstream project. [0]: https://vinyl-cache.org/organization/on_vinyl_cache_and_varnish_cache.html#… [1]: https://gitlab.archlinux.org/archlinux/packaging/packages/vinyl-cache [2]: https://vinyl-cache.org/docs/9.0/whats-new/upgrading-9.0.html URL: https://archlinux.org/news/breaking-changes-for-all-users-of-varnish-which-…

1 0

[arch-announce] kea >= 1:3.0.3-6 update requires manual intervention
by Arch Linux: Recent news updates: Robin Candau 07 Apr '26

07 Apr '26

The `kea` package has moved all services to run as a dedicated `kea` user (instead of `root`) for improved security. This change requires permission updates to the runtime files created by the `kea` services. Users upgrading from an existing `kea` installation should therefore run the following commands after the upgrade: `chown kea: /var/lib/kea/* /var/log/kea/* /run/lock/kea/logger_lockfile` `systemctl try-restart kea-ctrl-agent.service kea-dhcp{4,6,-ddns}.service` Accounts that need to interact with `kea` services files (e.g. lease files under `/var/lib/kea`, log files under `/var/log/kea` or configuration files under `/etc/kea`) should be added to the `kea` group. URL: https://archlinux.org/news/kea-1303-6-update-requires-manual-intervention/

1 0

[arch-announce] iptables now defaults to the nft backend
by Arch Linux: Recent news updates: Felix Yan 05 Apr '26

05 Apr '26

The old iptables-nft package name is replaced by iptables, and the legacy backend is available as iptables-legacy. When switching packages (among iptables-nft, iptables, iptables-legacy), check for .pacsave files in /etc/iptables/ and restore your rules if needed: - /etc/iptables/iptables.rules.pacsave - /etc/iptables/ip6tables.rules.pacsave Most setups should work unchanged, but users relying on uncommon xtables extensions or legacy-only behavior should test carefully and use iptables-legacy if required. URL: https://archlinux.org/news/iptables-now-defaults-to-the-nft-backend/

1 0

[arch-announce] NVIDIA 590 driver drops Pascal support; main packages switch to Open Kernel Modules
by Arch Linux: Recent news updates: Peter Jung 20 Dec '25

20 Dec '25

With the update to driver version 590, the NVIDIA driver no longer supports Pascal (GTX 10xx) GPUs or older. We will replace the `nvidia` package with `nvidia-open`, `nvidia-dkms` with `nvidia-open-dkms`, and `nvidia-lts` with `nvidia-lts-open`. **Impact:** Updating the NVIDIA packages on systems with Pascal, Maxwell, or older cards will fail to load the driver, which may result in a broken graphical environment. **Intervention required for Pascal/older users:** Users with GTX 10xx series and older cards must switch to the legacy proprietary branch to maintain support: * Uninstall the official `nvidia`, `nvidia-lts`, or `nvidia-dkms` packages. * Install `nvidia-580xx-dkms` from the AUR Users with Turing (20xx and GTX 1650 series) and newer GPUs will automatically transition to the open kernel modules on upgrade and require no manual intervention. URL: https://archlinux.org/news/nvidia-590-driver-drops-pascal-support-main-pack…

1 0

[arch-announce] .NET packages may require manual intervention
by Arch Linux: Recent news updates: George Rawlinson 11 Dec '25

11 Dec '25

The following packages may require manual intervention due to the upgrade from 9.0 to 10.0: * aspnet-runtime * aspnet-targeting-pack * dotnet-runtime * dotnet-sdk * dotnet-source-built-artifacts * dotnet-targeting-pack pacman may display the following error `failed to prepare transaction (could not satisfy dependencies)` for the affected packages. If you are affected by this and require the 9.0 packages, the following commands will update e.g. aspnet-runtime to aspnet-runtime-9.0: `pacman -Syu aspnet-runtime-9.0` `pacman -Rs aspnet-runtime` URL: https://archlinux.org/news/net-packages-may-require-manual-intervention/

1 0

[arch-announce] waydroid >= 1.5.4-3 update may require manual intervention
by Arch Linux: Recent news updates: George Hu 06 Nov '25

06 Nov '25

The `waydroid` package prior to version `1.5.4-2` (including `aur/waydroid`) creates Python byte-code files (.pyc) at runtime which were untracked by pacman. This issue has been fixed in 1.5.4-3, where byte-compiling these files is now done during the packaging process. As a result, the upgrade may conflict with the unowned files created in previous versions. If you encounter errors like the following during the update: > error: failed to commit transaction (conflicting files) > > waydroid: /usr/lib/waydroid/tools/\__pycache__/\__init__.cpython-313.pyc exists in filesystem > > waydroid: /usr/lib/waydroid/tools/actions/\__pycache__/\__init__.cpython-313.pyc exists in filesystem > > waydroid: /usr/lib/waydroid/tools/actions/\__pycache__/app_manager.cpython-313.pyc exists in filesystem You can safely overwrite these files by running the following command: ``` pacman -Syu --overwrite /usr/lib/waydroid/tools/\*__pycache__/\* ``` URL: https://archlinux.org/news/waydroid-154-3-update-may-require-manual-interve…

1 0

[arch-announce] dovecot >= 2.4 requires manual intervention
by Arch Linux: Recent news updates: Thore Bödecker 31 Oct '25

31 Oct '25

The dovecot 2.4 release branch has made breaking changes which result in it being incompatible with any <= 2.3 configuration file. Thus, the dovecot service will no longer be able to start until the configuration file was migrated, requiring manual intervention. For guidance on the 2.3-to-2.4 migration, please refer to the following upstream documentation: [Upgrading Dovecot CE from 2.3 to 2.4](https://doc.dovecot.org/latest/installation/upgrade/2.3-to-2.4.html) Furthermore, the dovecot 2.4 branch no longer supports their replication feature, it was removed. For users relying on the replication feature or who are unable to perform the 2.4 migration right now, we provide alternative packages available in [extra]: - dovecot23 - pigeonhole23 - dovecot23-fts-elastic - dovecot23-fts-xapian The dovecot 2.3 release branch is going to [receive critical security fixes](https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/threa… from upstream until stated otherwise. URL: https://archlinux.org/news/dovecot-24-requires-manual-intervention/

1 0

Recent service outages
by gromit 22 Aug '25

22 Aug '25

We want to provide an update on the recent [service outages][0] affecting our infrastructure. The Arch Linux Project is currently experiencing an ongoing denial of service attack that primarily impacts our main webpage, the Arch User Repository (AUR), and the Forums. We are aware of the problems that this creates for our end users and will continue to actively work with our hosting provider to mitigate the attack. We are also evaluating DDoS protection providers while carefully considering factors including cost, security, and ethical standards. To improve the communication around this issue we will provide regular updates on our [service status page](https://status.archlinux.org) going forward. As a volunteer-driven project, we appreciate the community's patience as our DevOps team works to resolve these issues. Please bear with us and thank you for all the support you have shown so far. ## Workarounds during service disruption - In the case of downtime for archlinux.org: - **Mirrors**: The mirror list endpoint used in tools like `reflector` is hosted on this site. Please default to the mirrors listed in the `pacman-mirrorlist` package during an outage. - **ISO**: Our installation image is available on a lot of the mirrors, for example the DevOps administered [geomirrors][1]. Please always verify its integrity as [described on the wiki][2] and confirm it is signed by `0x54449A5C` (or other trusted keys that may be used in the future). - In the case of downtime for aur.archlinux.org: - **Packages**: We maintain a [mirror of AUR packages][3] on GitHub. You can retrieve a package using: `$ git clone --branch <package_name> --single-branch https://github.com/archlinux/aur.git <package_name>` ## Additional remarks - Our services may send an initial connection reset due to the TCP SYN authentication performed by our hosting provider, but subsequent requests should work as expected. - We are keeping technical details about the attack, its origin and our mitigation tactics internal while the attack is still ongoing. [0]: https://lists.archlinux.org/archives/list/arch-general@lists.archlinux.org/… [1]: https://geo.mirror.pkgbuild.com/iso/ [2]: https://wiki.archlinux.org/title/Installation_guide#Verify_signature [3]: https://github.com/archlinux/aur

1 0