- Arch-dev-public - lists.archlinux.org

RFC: Merge package repositories
by Levente Polyak 01 Sep '22

01 Sep '22

A new RFC (request for comment) has been opened here: https://gitlab.archlinux.org/archlinux/rfcs/-/merge_requests/14 Please visit the above link for discussion. Summary: Merge the pacman repository [community] into [extra] as well as the packaging VCS location `community` into `packages`. The [core] repository remains limited to Developers.

1 0

Dropping Cura from the repositories
by Jelle van der Waa 01 Sep '22

01 Sep '22

Hi, I've maintained Cura (3d printing slicer) for a while but I no longer find the energy to maintain it and keep it updated. If anyone is interested in adopting it feel free, otherwise I will drop it to the AUR in 2 weeks. Note that there is a flatpak available as alternative https://flathub.org/apps/details/com.ultimaker.cura Greetings, Jelle

1 1

Konstantin Gizdov is now a developer
by Sven-Hendrik Haase 31 Aug '22

31 Aug '22

Hey everyone, I internally proposed Konstantin Gizdov to become a developer for his sustained good work on Arch Linux and the need to touch some [extra] packages sometimes. I'm pleased to announce that he has now become a full developer. All the relevant steps have been completed and he should now already be fully onboarded. Welcome aboard, Konstantin! Sven

4 3

repod 0.2.0 release - call for testing and participation
by David Runge 22 Aug '22

22 Aug '22

Hi all, I've just released repod 0.2.0 [1] (it is available as "repod" in our repositories). There are some significant changes in this release which allow for rudimentary handling of binary package repositories in configurable directory structures. For further information please refer to the documentation [2]. I would like to take the time and invite *everyone* (people involved with any distribution making use of pacman as well as their users - especially those with private package repositories) to participate in testing and improving repod. The project is actively maintained (although admittedly currently I am the main developer working on it and additional contributions - although present and valuable - are rare) and does bi-weekly meetings. Repod aims at generically offering the ability to maintain binary package repositories of alpm based packages. As such it transcends Arch Linux as its only client - the software is meant for Arch Linux, downstream distributions and private users alike! TL;DR: Please help the development of repod and associated tooling as it is important for all pacman based distributions and their users. Historically we have had quite a few distribution driven projects which allow us to do the things we do today (e.g. mkinitcpio, archiso, archweb, aurweb, dbscripts, arch-install-scripts, devtools, etc.). All of them have in common, that they lack dedicated development from time to time or are so large/old/deep that they require more than one person to "have the hat on". This being said: I do not feel comfortable being the only/ main person currently developing repod. The project is entwined with our pursuit of moving our packaging infrastructure to a more modern, git based setup in which package sources are separated from the binary packages that are built from them (opposite to how it is currently handled with dbscripts). This process is a gradual one in which we try to decouple the source repositories from the binary package repository state, while offering certain stability guarantees when consuming and handling packages. Upcoming work will entail dealing with necessary checks required for basic movement operations, which will consolidate a lot of (partially unused) code in the dbscripts project. For a more detailed overview for further topics, please have a look at the milestones [3]. Working on the upcoming features could use many more eyes and helping hands! Another piece of the puzzle when looking at moving to a git based workflow and improving our tooling, is the automation for builds/rebuilds (the road between our package source repositories and the binary package repository management software - e.g. repod). For this some solutions exist, some of which are VCS agnostic and some of which we use in larger rebuilds all the time. Morten has started to look at a buildbot based system which could be used for rebuild scenarios and also for building different architectures in the future. To my knowledge this is still very much a WIP, but if you are interested, idle in #archlinux-projects on libera.chat to get exposed to more information (this is also the case for repod btw!). I hope I was able to give a brief overview of what is the current state of things, where we want to go from here and spark some enthusiam about the above projects. There is still a lot of work left to be done for us and any help is much appreciated! :) Best, David [1] https://gitlab.archlinux.org/archlinux/repod/-/tags/0.2.0 [2] https://repod.archilnux.page [3] https://gitlab.archlinux.org/archlinux/repod/-/milestones -- https://sleepmap.de

1 0

Away till end of August
by Leonidas Spyropoulos 12 Aug '22

12 Aug '22

Hello, I will be off till the end of August traveling and taking some time off. While I will have matrix on my phone for IRC communication I won't be having resonably stable internet and easy access to the key for packaging updates. Feel free to update any of my packages along with the ones below which have no co-maintainers except myself. # Packages $ pkgsearch -m artafinde -l 1 corectrl freeplane gdu gitlab-exporter keycloak-archlinux-theme makedumpfile memray polybar prometheus-systemd-exporter vulture Thank you, -- Leonidas Spyropoulos PGP: 59E43E106B247368

1 0

Arch Linux in July 2022
by Levente Polyak 09 Aug '22

09 Aug '22

## archlinux-keyring The archlinux-keyring package gained a systemd service and timer unit which updates existing PGP keys used by pacman on user systems by default on a weekly basis from Arch Linux's web key directory (WKD)[0]. This service is meant to remove the necessity for most cases of "first upgrade your archlinux-keyring and then do a system upgrade" until pacman itself will be able to deal with this scenario natively. A new main signing key 75BD80E4D834509F6E740257B1B73B02CC52A02A was added to the keyring. Efforts to sign all active packager keys with it are ongoing, currently around 85% of the existing keys have been signed already. ## pacman Extend --print-format with all expac format strings which can be easily added without conversions and through a simple C macro. ## Wiki After almost three years, the Lockdown extension is finally disabled and the recent changes page, page history and others are once again visible without having to log in. [1] ## repod A first release has been made, which supports rudimentary validation, inspection of package files and is available in the official repositories (see this blog post [2] for an overview). Help with the development of the project would be much appreciated. [0] https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/commit/e5a2665a4… [1] https://gitlab.archlinux.org/archlinux/infrastructure/-/merge_requests/597 [2] https://sleepmap.de/2022/managing-binary-package-repositories/

1 0

TU resignation
by Nicola Squartini 09 Aug '22

09 Aug '22

Dear all, Due to my involvement in other projects I'm unable to dedicate the time it deserves to Arch Linux, therefore I decided to resign from my role of Trusted User. I thank György Balló for sponsoring me 6 years ago, and everybody else who supported me during this time. It's been an honor and pleasure for me working with you. Best regards, Nicola

2 1

Configure mailing lists to automatically reject mails by non-members
by David Runge 09 Aug '22

09 Aug '22

Hi all, I'm currently partly moderating mailing lists for Arch Linux. Since we've switched to mailman3 I receive *a lot* of info from the system, that mails are being held in the moderation queue due to being sent by non-members of the respective lists. IMHO, we should configure all of our mailing lists to be subscription only (i.e. automatically reject all mail by non-members). It makes no sense for anyone to moderate these emails and is a huge waste of time for people dealing with the moderation of the lists (I get enough spam everyday as it is... ;-)). While at it: To my knowledge, we are currently still allowing HTML emails to be sent to the lists and I think those should be automatically rejected as well, as it is unnecessary bloat and is not fitting our context at all (we are not trying to click-track users on a commercial info list). Best, David -- https://sleepmap.de

5 6

Postponing August ISO due to kernel bug
by Pierre Schmitz 05 Aug '22

05 Aug '22

Hi all, nl6720 informed me about a recent kernel bug that prevents some older CPU models to boot*. While a simple workaround exists, I agree that this issue might be quite unexpected and frustrating for users. Especially since releasing a new install media on the 1st each month is more a tradition than an actual need. Therefore I'll wait for a fixed linux package. (the July ISO is still pretty recent :-)) Greetings, Pierre *) https://bugs.archlinux.org/task/75478 -- Pierre Schmitz, https://pierre-schmitz.com

3 5

Systemd service and timer for refreshing archlinux-keyring keys via WKD
by David Runge 26 Jul '22

26 Jul '22

Hi all, I currently have a MR open against archlinux-keyring [1], that adds a systemd service and timer, which would automatically refresh valid and existing keys on user systems. For people without access to the repository's ticket and merge request features, it is possible to browse the commits in question on the respective branch [2]. To quote from the accompanying ticket [3]: ``` For situations in which we do have new signatures which have been released, we may want a service on user systems that update existing keys via WKD to have an updated set of keys before updating archlinux-keyring. Rationale: Keys are updated in WKD after a release of archlinux-keyring (currently this is still done in the https://gitlab.archlinux.org/archlinux/wkd repo). User systems may upgrade any time after that and pacman will pull new keys from WKD automatically, however it will not pull updates for existing keys. Packages that are signed with a key that still had marginal trust in release A (and therefore already existed on the user system since release A) and gained full trust in release B will not be updated before the user does a system upgrade. This leads to the requirement of installing archlinux-keyring before doing a system upgrade, as otherwise the key will still have marginal trust on the user system and the signatures of other updated packages using the key in question will fail to validate. To remedy this situation I think it would be helpful to have a service update existing keys from WKD twice daily on a timer. I am not 100% sure whether this has side-effects in regards to revocations, but as we only ever update WKD after issuing a release and not when updating the default branch, this should be fine(?). ``` In short: The service in question will update any valid keys in the pacman keyring on user systems, that use Arch Linux's relevant domains as UID to retrieve updated keys (e.g. extended expiration, additional signatures). Invalid keys and those of other domains are ignored. This feature is implemented to circumvent (some, but not all) cases of "update archlinux-keyring before doing a system upgrade". Cases not covered are (in no particular order): * *long* outdated system is updated * new main signing key is required for a packager key to gain full trust for the packages about to be updated * local system's archlinux-keyring does not yet offer this feature * local system's pacman does not yet offer the feature of downloading package signatures for new keys from WKD * packager key on local system does not yet have any main key signatures and would gain full trust with an update of archlinux-keyring Currently the timer which triggers this service is supposed to be vendor enabled (i.e. symlink in /usr/lib/systemd/system/timers.target.wants/) and run daily with a deviation of up to 12h. Members of the DevOps team have raised concerns about the interval as we do not really have a clear picture about how many Arch Linux installations there are world-wide to get numbers on expected median load for this. If you have ideas for improvement or general questions, please direct them at the merge request. Best, David [1] https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/merge_requests/1… [2] https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/tree/wkd_sync_se… [3] https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/issues/184 -- https://sleepmap.de

8 13