- Arch-dev-public - lists.archlinux.org

Announcing pacquery
by Jelle van der Waa 03 Mar '24

03 Mar '24

Hi all, One of the things I've been missing for a long time is the ability to easily query package information. Pacman -S --print-format lacks some options and more importantly does not support json output. I've had a small rust utility locally which helped a lot with getting ready for the pacman rebuild. This weekend I spend some time refining it and releasing it to the repos as pacquery. An example, finding all packages which have make/check/depends on python-tomli [jelle@natrium][~/projects/pacquery]%pacquery python-tomli | jq -r '.[].required_by | join(" ")' python-flake8-black python-ipdb python-setuptools-gettext python-setuptools python-responses python-tomli-w python-fsspec sip mdformat repod mypy autopep8 python-diff-cover python-pep621 python-versioningit python-pylint python-pdm-pep517 python-sphinx-theme-builder python-pytest-cov towncrier python-isort Note that this tool uses the syncdb's so these need to be up to date and it defaults to core,extra,multilib. Greetings, Jelle van der Waa

1 0

GHC 9.2.8 enters [extra-testing]
by Felix Yan 26 Feb '24

26 Feb '24

Hi all, The long delayed GHC 9.2.x updates have been done and moved to [extra-testing]. There are a few notable changes regarding our GHC packaging: - Codegen backend has been switched back to NCG for multiple reasons: = GHC doesn't support latest LLVM and was using llvm14 in Arch. This adds up to our maintenance burden of LLVM. (IIRC LLVM 15 support was fixed only recently.) = LLVM backend actually generates slower code. We have evaluated the changes during the past years and noticed as large as 50% slower results in some benchmarks. I also got similar information from other distribution people. = LLVM backend sometimes deadlocks on compile-time. I hit this from time to time and it's not easy to reproduce reliably. (There are similar issues that are always reproducible, but got fixed already.) All `--ghc-option=-fllvm` has been removed from PKGBUILDs during the rebuild. - Build system of GHC itself has been switched to Hadrian. - Some obsolete packages have been retired from the distribution, and will be removed once the batch enters [extra]: haskell-bytestring-show haskell-random-source haskell-brittany haskell-hls-brittany-plugin haskell-hls-tactics-plugin haskell-hls-haddock-comments-plugin A lot of thanks to @Vekhir who helped me a lot for preparing this so that it's done much earlier and smoother than I expected :) As always, please report any issues and have fun! -- Regards, Felix Yan

1 0

RFC: Distribution Developer Manual
by Levente Polyak 24 Feb '24

24 Feb '24

A new RFC (request for comment) has been opened here: https://gitlab.archlinux.org/archlinux/rfcs/-/merge_requests/21 Please visit the above link for discussion. Summary: This RFC proposes the migration of Arch Linux's operational distro specifications from existing ArchWiki and other sources to a dedicated GitLab Developer Manual repository. The intention is to document how to run the distribution while leveraging GitLab's collaboration features and streamlined workflows for maintaining and evolving the resulting specifications. This change aims to centralize and enhance the efficiency of specification management while preserving the integrity of the community-contributed content in the Wiki. This request for comments is superseding `RFC-0005 <https://gitlab.archlinux.org/archlinux/rfcs/-/merge_requests/5>`_ by extending its scope to handle all distro specifications coherently instead of handling a single sub section (packaging guidelines) differently to others.

1 0

Arch Linux in January 2024
by Levente Polyak 13 Feb '24

13 Feb '24

## Staff We would like to welcome [Vladimir LAVALLADE (Erus Iluvatar)][0] to their new role as ArchWiki Administrator. ## Infrastructure The DevOps team has recently provisioned a new EPYC 9454P build server for Arch Linux packaging. This high-performance server is meant to streamline the packaging process, ensuring more efficient building of resource hungry package builds. ## mkinitcpio mkinitcpio [v37.2][1] and [v37.3][2] have been released. These releases include numerous bug fixes, such as patches addressing inflated initramfs sizes and resolving issues with kernel images located in non-standard locations. ## RFC An [RFC has been proposed][3] to add ``-fno-omit-frame-pointer`` and ``-mno-omit-leaf-frame-pointer`` to the default compilation flags to improve the effectiveness of profiling and debugging tools. Additionally, an [RFC has been proposed][4] to define new mirror administration routines and mirror requirements. This RFC outlines the requirements, definitions and guidelines surrounding not only becoming but also maintaining and decommissioning a mirror. ## Packaging ### Firefox The [firefox][5] and [firefox-developer-edition][6] packages have been updated to include regular debug packages. As part of this update, symbols are no longer submitted to Mozilla at the end of the build process. Instead, [Mozilla retrieves all symbols from our end][7]. This change enables local debugging of Firefox while still allowing the submission of useful crash reports to Mozilla and leveraging their profiling service. ### Statistics In this month, we've successfully rolled out 11068 package updates addressing various enhancements and rebuilds, including 2777 package upgrades. Additionally, we've received 204 new package issues, while resolving a total of 258 issues. [0]: https://wiki.archlinux.org/title/ArchWiki:News#2024/01/07_-_New_administrat… [1]: https://gitlab.archlinux.org/archlinux/mkinitcpio/mkinitcpio/-/releases/v37… [2]: https://gitlab.archlinux.org/archlinux/mkinitcpio/mkinitcpio/-/releases/v37… [3]: https://gitlab.archlinux.org/archlinux/rfcs/-/merge_requests/26 [4]: https://gitlab.archlinux.org/archlinux/rfcs/-/merge_requests/29/diffs [5]: https://gitlab.archlinux.org/archlinux/packaging/packages/firefox/-/commit/… [6]: https://gitlab.archlinux.org/archlinux/packaging/packages/firefox-developer… [7]: https://github.com/mozilla/symbol-scrapers/pull/41

1 0

dropping opera
by Ike Devolder 07 Feb '24

07 Feb '24

Hi, Since I have not really used opera for years, I'm finally going to drop it from the repo's. If someone wants it, feel free to adopt it. Else I will drop it to AUR in 2 weeks. --Ike

1 1

RFC Final Comment Period: Add -fno-omit-frame-pointer and -mno-omit-leaf-frame-pointer to default compilation flags
by Morten Linderud 06 Feb '24

06 Feb '24

An RFC has now entered its Final Comment Period. In 14 days, discussion will end and the proposal will either be accepted, rejected or withdrawn https://gitlab.archlinux.org/archlinux/rfcs/-/merge_requests/26 Please visit the above link for the discussion. Summary: Add ``-fno-omit-frame-pointer`` and ``-mno-omit-leaf-frame-pointer`` to the default compilation flags to improve the effectiveness of profiling and debugging tools. -- Morten Linderud PGP: 9C02FF419FECBE16

1 2

Forensic tool release: archlinux-userland-fs-cmp (reproducible pre-compiled binary available)
by kpcyrd 31 Jan '24

31 Jan '24

hello, I released a tool recently that I'd like to share with this list: https://github.com/kpcyrd/archlinux-userland-fs-cmp It's supposed to be used from a rescue image (any Linux) with an Arch install mounted to e.g. /mnt. It does the following: - Open /mnt/var/lib/pacman and extract the list of (allegedly) installed packages. - Instead of trusting the `mtree` files from the mounted file system, the %NAME% and %VERSION% values from the `desc` files are used to start a download stream from archive.archlinux.org. - From the download stream it's decompressing and inspecting the content on-the-fly, since the .MTREE file is near the beginning of the package we can abort the remaining package download after the mtree has been received (saving a lot of time and traffic). - All files in /mnt that are part of a package are hashed and compared with the sha256 hashes in the MTREE files downloaded from the archive. - Finally, it's printing a report of all files that either mismatched or are not a part of any package. This can be redirected to a file using the -o flag. At no point is any file from the mounted filesystem eval'd or otherwise executed. Parsers are written in a memory safe language. Although it's integrating with pacman, the integration with archive.archlinux.org makes this Arch Linux specific, files from AUR, Manjaro or SteamOS packages are all going to be flagged for manual inspection. The authenticity of the .MTREE files is assumed through the https connection they are downloaded from (which is supposed to be sufficient for the use-case it's built for). The release page on github has a pre-compiled, statically linked binary that can trivially be reproduced from source code. The dependency tree is documented in Cargo.lock, the build environment is documented in repro-env.lock. The binary has been tested to be working correctly on a Debian bookworm installer busybox rescue shell. There's a gif in the README showing how the tool looks like in action. --- I also printed reproducible builds stickers with a new and unique design that I'm planning to hand out at FOSDEM (along with some 37c3 leftovers), if you have read this far, feel free to ask me about stickers if you see me there. The print cost geht auf mein Nacken. cheers, kpcyrd

1 0

FOSDEM 2024 Dinner
by Morten Linderud 26 Jan '24

26 Jan '24

Yo! The previous years at FOSDEM we have held a dinner with around 15-20 people. Some maintainers from Arch, and some users that wanted to join. It has been great events and with FOSDEM 2024 happening I thought it was a good idea to do it again :) The dinner will be held Saturday, 3rd of February, around 20:00. The dinner is sponsored by the Arch Linux and should cover a drink and a main course. We will cap the attendees to 25 people. Priority for members of the Arch team (developers, packagers and support staff). Any free spots after this can be taken by anyone interested. Send me an email *offlist* if you want to attend. The users requesting spots will get a heads up the week before FOSDEM to give all staff a chance to reply. Please ask me if you have any questions :) I also plan to announce a pub closer to the FOSDEM weekend, so anyone unable to join the dinner can still come and grab a drink with the rest of us. Cheers! -- Morten Linderud PGP: 9C02FF419FECBE16

1 1

Arch Linux in December 2023
by Levente Polyak 23 Jan '24

23 Jan '24

## Staff We would like to welcome [Jakub Klinkovský (lahwaacz)][0] as part of the Arch Linux Package Maintainer team. ## User meetup During the [37th Chaos Communication Congress (37C3)][1], we hosted a user meetup. At this event, we presented our latest achievements and developments. Additionally, we held an open Q&A session to engage and connect with our community. ## dbscripts We performed a thorough cleanup of the codebase, removing all legacy SVN functionality that is no longer necessary. Furthermore, a critical locking issue was resolved, which previously allowed the same file descriptor to be reused multiple times. This correction ensures that each lock is properly maintained, addressing concurrency locking issues and preventing inconsistent states. ## Infrastructure We have rolled out [Keycloak 23][2], to utilize the latest features and fixes for our central Single Sign-On (SSO) system at [accounts.archlinux.org][3]. Additionally, we've activated the Account Console version 3, which grants us access to its custom field support, specifically designed in conjunction with the 'User Profile' feature. ## RFC We [proposed and accepted an RFC][4] to make dbus-broker our default D-Bus daemon, while still allowing the venerable dbus-daemon to be used and minimizing the disruption of existing installations. Furthermore an [RFC has been proposed][5] to add ``-fno-omit-frame-pointer`` and ``-mno-omit-leaf-frame-pointer`` to the default compilation flags to improve the effectiveness of profiling and debugging tools. [0]: https://lists.archlinux.org/hyperkitty/list/aur-general@lists.archlinux.org… [1]: https://events.ccc.de/category/37c3/ [2]: https://www.keycloak.org/2023/11/keycloak-2300-released.html [3]: https://accounts.archlinux.org [4]: https://gitlab.archlinux.org/archlinux/rfcs/-/merge_requests/25 [5]: https://gitlab.archlinux.org/archlinux/rfcs/-/merge_requests/26

1 0

New checks for SPDX license identifiers with namcap >= 3.5.0
by David Runge 14 Jan '24

14 Jan '24

Hi all! With RFC0016 [1] we have worked out a way to reason about SPDX license identifiers [2] in the context of PKGBUILDs and packages. Over the past months I have worked on the licenses package [3], as well as namcap [4] to create the integration for all packagers. This mail serves as a refresher and general overview of what this means for packagers. TL;DR: Namcap now emits more specific error messages and there are probably a few things in this mail that you will want to learn about! :) To be able to be more specific in the below text, I will use this mini-glossary to explain what some words refer to: * *known* licenses and exceptions - Licenses and license exceptions *known* to SPDX (i.e. they are in the lists [2][5]). * *unknown* licenses and exceptions - Licenses and license exceptions *not known* to SPDX (i.e. they are *not* in the lists [2][5]). License identifiers prefixed with "LicenseRef-" are not considered. * *common* licenses and exceptions - Licenses and license exceptions that are packaged in the context of the licenses package [3] and can be shared *commonly*. * *uncommon* licenses and exceptions - Licenses and license exceptions that are *known*, but are *not common* (i.e. they are in the lists [2][5] but not in the licenses package [3]). License identifiers prefixed with "LicenseRef-" are always considered *uncommon*. For packagers a few things change when it comes to handling license information for packages. * It is encouraged to have a look at the list of *known* license identifiers [2] and exceptions [5] to familiarize yourself with how identifiers look like. The *common* licenses can be found in /usr/share/licenses/spdx/ and the *common* license exceptions in /usr/share/licenses/spdx/exceptions/. * The `license` array in PKGBUILDs should now start to contain valid SPDX license identifiers [2][5] or custom license identifiers, that are prefixed with "LicenseRef-" (e.g. "LicenseRef-Custom-License-1.0"). To keep complex scenarios maintainable and readable, each entry in the `license` array may be interpreted as being concatenated by the `AND` license expression [6]. * We now distinguish between various versions of some identifiers (e.g. previously we were okay with simple identifiers such as "GPL3" but now we have "GPL-3.0-only" and "GPL-3.0-or-later", which are separate from one another). If you are unsure about what applies, either contact upstream or reach out over mail, IRC, Matrix to ask other packagers. * If in doubt, rather be more specific than less specific! * To aide in documenting copyright and attribution, many upstreams rely on SPDX License IDs [7], which are added as comments at the top of each source file. These often help a great deal in figuring out which specific licenses apply and help in finding out whether there are any license files missing. To help you with figuring things out, namcap gained a few more features with > 3.5.0 (although some issues had to be ironed out up until 3.5.2 and I seriously hope I didn't introduce even more bugs ;-)). Please remember that namcap does not take away the work of investigating and providing the correct license identifiers for you! * Namcap now emits errors on all *unknown* license identifiers [2] and license exceptions [5]. * Namcap now lists all *uncommon* licenses and license exceptions while providing an overview about how many license files it found for the amount of *uncommon* identifiers (each *uncommon* identifier requires a separate file). * Namcap now emits errors with suggestions on formatting issues of license expressions (e.g. `MIT and Apache-2.0` -> `MIT AND Apache-2.0`). * Namcap now emits errors on license strings that can not be parsed. * Namcap now emits errors when the license directory is a symlink to a location in another package, that is not in `depends`. * Namcap now emits errors when the license directory is a symlink to a location in another package and license files are missing for *uncommon* identifiers. * Namcap now emits warnings if it detects symlinks for the license directory or single license files to another package. This is done because it is *very* cumbersome and error-prone to detect files in other packages reliably (e.g. those could in turn be symlinks to non-existent files, etc.). It is encouraged to package license files per package! Symlinks in the same package are fine! I hope this summary was not too overwhelming and will help you to get through the licensing jungle! Please do note, that the Arch Wiki section on license identifiers in the PKGBUILD article [8] still needs to be adapted. If there are any questions, please reach out! Many thanks to everyone who worked on the RFC and helped with testing the implementation! Best, David [1] https://rfc.archlinux.page/0016-spdx-license-identifiers/ [2] https://spdx.org/licenses/ [3] https://archlinux.org/packages/core/any/licenses/ [4] https://gitlab.archlinux.org/pacman/namcap/ [5] https://spdx.org/licenses/exceptions-index.html [6] https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/ [7] https://spdx.dev/learn/handling-license-info/ [8] https://wiki.archlinux.org/title/PKGBUILD#license -- https://sleepmap.de

1 0