August 2018 - Arch-dev-public - lists.archlinux.org

[arch-dev-public] Can anyone take nvidia-390xx?
by Sven-Hendrik Haase 23 Feb '20

23 Feb '20

I don't run nvidia-390xx on any of my devices. I would appreciate it if somebody could take those drivers. I will continue maintaining the mainline nvidia package.

2 1

[arch-dev-public] Improving overall experience for contributors
by Bartłomiej Piotrowski 06 Feb '19

06 Feb '19

Hi all, Spending some time outside the regular Arch circles, I realized that the way we "outreach" potential contributors is at least imperfect. One of the problems I keep hearing about is that there is no clear place where potential contributors could start. Sure, some things seem obvious to us: take care of some wiki article or adopt orphan AUR packages. It isn't actually that easy. Not everyone is interested in editing or maintaining random packages, and while there is plenty to do, how someone new could know it? We could use help not only with existing projects like archweb, pyalpm or namcap, but also with development of new code (for example a maintainable rebuild automation) and infrastructure side (which is in fact too generic term that could be better described). I am totally in love with What can I do for Mozilla?[1] which is open source, so why not steal this wonderful idea? But it also means we need a way to communicate with people interested in helping us: at least an IRC channel and new mailing list. Another thing that I heard in last few months isthat it is actually hard for potential TU candidates to find a sponsor. While I believe it is perfectly fine to e-mail few potential sponsors to ask for opinion, throwing random messages at people doesn't sound really appealing. In my humble opinion, we should rethink the way we recruit people and probably introduce fine-grained permissions to dbscripts that would allow to limit new maintainers to limited set of packages. We should also lower our expectations towards candidates. At least once we rejected one for some stupid reason (no fingerpointing here, I'm not saint either), leaving packages they wanted to adopt virtually orphan. It's better to help amn inexperienced packager gain experience than voting no, really; to be brutally honest, quite a lot of packaging work we are handling doesn't have much in common with rocket science. I also wanted to touch mailing lists vs GitHub vs Gitlab topic but we will tackle it another time. Your thoughts? Bartłomiej [1] https://whatcanidoformozilla.org/

8 11

[arch-dev-public] Arch Linux Cloud Images (virtualbox and Qemu)
by Christian Rebischke 07 Nov '18

07 Nov '18

Hello everybody, Some months ago Bartlomiej had the awesome idea to generate qemu and virtualbox images as well. Afterwards we had a small discussion about this topic in #archlinux-projects. I would like to refresh this discussion and move it to this mail thread. So, our vagrant boxes are building automatically and without issues for a few months now. I could just generate virtualbox and qemu images as side products monthly, but I have no idea how we would release them. Another big topic is security. The vagrant images are at the moment not signed and seems like vagrantcloud doesn't support this either. This doesn't mean that we shouldn't sign our qemu or virtualbox images. We could just generate an automated cloud image signing key (only for this purpose) of course and automatically sign the images with that key. Problem with this is: If our build server ever get pwned the person will have these keys for signing cloud images as well. Any opinion about this? In my humble opinion I would be fine with a signing key that follows only this particular purpose. Another idea would be to move the whole production process to a physical server behind a firewall that is physical accessible by one or more Arch Linux Developers. I really would like to push this forward. Any comments? Chris

4 4

[arch-dev-public] [RFC] Remove svn propset id's
by Jelle van der Waa 12 Sep '18

12 Sep '18

Most of our PKGBUILDs svn propset's break reproducible builds and the pkgbuild_sha256sum in the BUILDINFO file. When building a package before commiting the PKGBUILD the propset $Id will differ since the $Id is set on commit. This has a few implications, pkgbuild_sha256sum is useless and we can't reproduce packages due to the BUILDINFO not matching. Also the reproduce tool uses ASP to retrieve the PKGBUILD and therefore can't verify that it got the correct PKGBUILD (it relies on pkgbuild_sha256sum). To resolve this issue we could simply remove the propset id's, since for me, although not sure about others they don't seem particulary useful. The proof that the sha256sums's don't match: $ extra-x86_64-build $ grep sha256 .BUILDINFO pkgbuild_sha256sum = 8748d60d2c782f477cb7e692a3dad30be90491cdc13fe8951340da4c0bc7f19e $ $repopkg $ sha256sum PKGBUILD d8ab51a983026dd4a6e2f48e9dc66177eca8cf6c1c0ffefb950b093db299e304 PKGBUILD # The git checkout [jelle@helium][/tmp/bar/community/python-psutil/trunk]%sha256sum PKGBUILD ce7f1e68a3b426412a24f46016817d30721860c8ef6b3d0a2dddac8ff2448b84 PKGBUILD [jelle@helium][/tmp/bar/community/python-psutil/trunk]%diff PKGBUILD /tmp/python-psutil/trunk/PKGBUILD 1c1 < # $Id$ --- > # $Id: PKGBUILD 375007 2018-08-28 17:24:26Z jelle $ -- Jelle van der Waa

6 7

[arch-dev-public] /r/linux AMA
by Morten Linderud 10 Sep '18

10 Sep '18

Yo! The subreddit /r/linux have started organizing AMA threads for relevant projects. Gentoo had one of these a few months ago and is an interesting read. https://www.reddit.com/r/linux/comments/8nsdj0/we_are_gentoo_developers_ama/ https://www.reddit.com/r/linux/comments/93qlow/established_project_develope… I think it's a good idea Arch Linux does an AMA as it's might give users some incentive to help contributing to the project. I have chatted with a subreddit mod at /r/linux, and the AMA should preferably start on any Monday from 27th and onwards. It will also run for a few days, so there is no need to be present all the time, or when it starts. If you are interested participating please reply to the list with the following information: * Reddit username. * What you do. * What Monday fits for you? I have also started handing out flairs on the /r/archlinux subreddit. It's not an official forum, but if developers and team members want flairs for their reddit accounts you can also reply to this mail or poke me on IRC :) -- Morten Linderud PGP: 9C02FF419FECBE16

8 9

[arch-dev-public] Dropping KDE4 libs
by Antonio Rojas 04 Sep '18

04 Sep '18

I think it's time to drop the KDE4 libraries. They were EOL months ago and most stuff that isn't yet ported to KF5 is dead upstream. This would allow dropping a number of qt4 libraries and reduce the qt4 reverse dependencies (qt4 has been EOL for 3 years now). Affected packages are: - recorditnow (there are many alternatives available) - ligthdm-kde-greeter (dead upstream, no signs of KF5 porting) - krecipes (dead upstream, no signs of KF5 porting) - kdiff3 (has been ported to KF5 for a while, just needs a release. Could be updated to a snapshot) - pidgin-kwallet (uses kwallet dbus API, so should work with the KF5 version without any modification) - libreoffice-still (would lose the KDE4 VCL, which is quite buggy anyway. LO-fresh has a new VCL that uses KF5 file dialog) - amarok: it has a WIP KF5 port, but it's not quite ready and development is stalled. IMO we should let it rest in peace - I can keep a KF5 snapshot in kde-unstable for a while but it doesn't look like it's going anywhere any time soon at the current development pace. There are a few alternatives in the repos. Comments?

6 14

[arch-dev-public] Shutting down dragon (backup server)
by Florian Pritz 31 Aug '18

31 Aug '18

Hi, I'll turn off dragon.archlinux.org in 2 weeks unless someone objects. It used to host our backups, but these have since moved to vostok.archlinux.org. Evangelos and me checked if there are any important files left on there, but we couldn't find any. If someone else wants to check, you'll have two weeks to speak up. Otherwise I'll null the disks and cancel the contract. Florian

1 1

[arch-dev-public] Replacing pycrypto with pycryptodome
by Evangelos Foutras 31 Aug '18

31 Aug '18

Antonio suggested on IRC to drop pycrypto in favor of pycryptodome. The latter is "an almost drop-in replacement for the old PyCrypto library" according to its documentation. pycrypto has been unmaintained for several years. [1] Unless someone objects in the next few days, I'll proceed to drop python-crypto and add replaces=() to python-pycryptodome. [1] https://github.com/dlitz/pycrypto/issues/173

1 1

[arch-dev-public] Improving the package guidelines
by Morten Linderud 30 Aug '18

30 Aug '18

Yo! In April there was some discussion regarding how to properly do unit testing in Python PKGBUILDs[1]. Felix had some amazing notes that was super useful. But as pointed out we don't really strive to document these things[2]. To try help and spark some interest in improving the current package guidelines, I have spent a some time restructuring and rewriting parts of the Python and Golang package guidelines. I'd appreciate reviews on them! https://wiki.archlinux.org/index.php/User:Foxboron/Python_packaging_guideli… https://wiki.archlinux.org/index.php/User:Foxboron/Go_packaging_guidelines It really doesn't take that much time to note down what you know about packaging and what the current standards are. I think this helps both fellow maintainers and AUR maintainers in writing better PKGBUILDs and sharing knowledge. If people think editing wikis are annoying, maybe we could setup a github repository with example PKGBUILDs we can work on? [1]: https://lists.archlinux.org/pipermail/arch-dev-public/2018-April/029228.html [2]: https://lists.archlinux.org/pipermail/arch-dev-public/2018-April/029233.html -- Morten Linderud PGP: 9C02FF419FECBE16

4 8

Re: [arch-dev-public] /r/linux AMA
by Alad Wenter 27 Aug '18

27 Aug '18

* /u/AladW * TU, Wiki admin/bureaucrat, IRC operator, being a general nuisance. * 10th september is fine. Alad

1 0