April 2013 - Arch-general - lists.archlinux.org

Re: [arch-general] Integrating Virus Scanning for Packages Handled by Pacman (Mark Lee)
by Mark E. Lee 24 Apr '13

24 Apr '13

On Wed, 2013-04-24 at 12:57 -0400, arch-general-request(a)archlinux.org wrote: > On Tuesday, April 23, 2013 06:56:56 PM Daniel Micay wrote: > > On Tue, Apr 23, 2013 at 1:10 PM, Mark E. Lee <mark(a)markelee.com> > wrote: > > > While building packages on the AUR, I was wondering that except > for > > > manual user intervention (by reading the code), I didn't have any > other > > > methods of knowing if a package had malware or viruses. Hence, I > was > > > wondering if virus scanning via clamav should be called before > pacman > > > installs packages. > > > > > > -- > > > Mark E. Lee <mark(a)markelee.com> > > > > The PKGBUILD itself is a bash script. If you're running them without > > reading the code and checking that the sources are from an upstream > > you trust, you're gonna have a bad time. > > > > There are plenty of packages in the AUR that touch outside of > $pkgdir > > - but most seem to be beginner mistakes in good faith. ClamAV pretty > > much just detects very common win32 viruses, because it's used on > mail > > servers to *reduce* the number of spread viruses. > > > > If you really feel like scanning the package contents after you've > > already trusted the PKGBUILD and build scripts, just don't use > makepkg > > -i. > > I'd have to agree here, I don't feel much as if it is the duty of the > package > manager to check for viruses. Furthermore, reinforcing what Daniel > said, > ClamAV's primary function is to mitigate the spreading of Windows > malware. > While it would be nice to have some system to screen PKGBUILDs for > malicious > activity, it is just out of scope. [core], [extra], [multilib], and > [community] are for the most part screened upon submission (You can't > just > throw a package right upstream and into [community] without having > someone > view it first, thus having an opportunity to spot bad scripts) and the > AUR is > fairly trustworthy in and of itself. It really is just a matter of > trust. > As seen by some malignant Android apps, trust in the developer/maintainer does not always work towards the goals of the end users. Packages downloaded from the main repos or built from the AUR should be scanned for both windows and linux malware to ensure Arch Linux pc's don't become carriers for malware. Pacman would benefit from an additional line of package scanning (not just verifying); it's sort of like a second opinion from another doctor. From, Mark -- Mark E. Lee <mark(a)markelee.com>

5 4

[arch-general] Gnome 3.8 and desktop background
by Magnus Therning 24 Apr '13

24 Apr '13

Gnome 3.8 has now hit the official repos and it looks great. They only thing I can't seem to get to work is the desktop background. I try to set it to a nice image I have, but my desktop background remains a dull grey. The only place I see a change is in window overview mode. The only way to get the background on my ordinary desktop is to turn off "Have file manager handle the desktop" in Tweak Tool, but then I lose the icons from my desktop. Please tell me I'm not forced to chose the lesser of these evils and that there is something I've missed ;) /M -- Magnus Therning OpenPGP: 0xAB4DFBA4 email: magnus(a)therning.org jabber: magnus(a)therning.org twitter: magthe http://therning.org/magnus

7 9

Re: [arch-general] [aur-general] Failure to boot after update yesterday evening (CET)
by Magnus Therning 23 Apr '13

23 Apr '13

On Tue, Apr 23, 2013 at 11:59 AM, Magnus Therning <magnus(a)therning.org> wrote: > On Tue, Apr 23, 2013 at 11:13 AM, Tianyi Wang <wty52133(a)gmail.com> wrote: >> There are many bug reports about this issue on https://bugs.archlinux.org >> >> Tbh, before GNOME 3.8 got moved to stable repo, someone posted this bug on >> the mailing list, but it still got moved to stable without any warnings on >> the website. > > Hmm, the one JoKoT3 mentions, > https://bbs.archlinux.org/viewtopic.php?id=161964, doesn't sound like > my issue at all. As I've mentioned a few times now, my system hangs > before I get to GDM. The last thing that appears on the terminal are > a few messages from systemd (nothing about any errors) and then > everything just freezes, no reaction to any key presses at all. It turns out it was the GDM issue. I've now installed and turned on slim, edited my ~/.xinitrc, turned off GDM temporarily, and now everything works fine again. Thanks for all the help! /M -- Magnus Therning OpenPGP: 0xAB4DFBA4 email: magnus(a)therning.org jabber: magnus(a)therning.org twitter: magthe http://therning.org/magnus

1 0

[arch-general] journalctl equivalent for /var/log/kernel.log
by Paul Gideon Dann 23 Apr '13

23 Apr '13

Hello all, This should have been easy to find, but I haven't had any luck. What's the systemd equivalent to "tail -f /var/log/kernel.log"? I'm trying to slowly start using journalctl instead of syslog... Paul

2 2

Re: [arch-general] XFCE broken with Gnome 3.8?
by Pedro Alejandro López-Valencia 23 Apr '13

23 Apr '13

On Tue, Apr 23, 2013 at 12:01 AM, David Rosenstrauch <darose(a)darose.net>wrote: > > Apparently when I whack my XFCE session cache file > (~/.cache/sessions/xfce4-**session-daroselin:0) the problem goes away and > I can start up XFCE no problem. But as soon as I save the session, > creating a new session cache file, XFCE starts to crap out at startup. > > Instead of saving a session, use the XDG autostart directory ($HOME/.config/ autostart). Copy the .desktop files from /usr/share/applications, log out and log in again. That should work better. -- Only my skepticism keeps me from being an atheist. —Voltaire http://about.me/palopezv

1 0

[arch-general] XFCE broken with Gnome 3.8?
by David Rosenstrauch 23 Apr '13

23 Apr '13

I picked up some Gnome package upgrades last night during a pacman update, and I haven't been able to log into XFCE ever since. It gets most of the way through the login process, then craps out and falls back to the session manager (LXDM). I'm not even able to see any debug information about what's going on. Anyone have a clue / pointer to a fix / workaround? Thanks, DR

7 9

[arch-general] Empathy and Google Talk
by Jayson Rowe 23 Apr '13

23 Apr '13

Greetings all, I've been using Xfce for quite a while as I've been dissatisfied with GNOME-Shell, but since 3.8 made it to the stable repos, I decided to try it out in Classic mode. I really like it. However, I can't seem to add my Google Talk account to Empathy. When the Accounts Window pops up, there is a dialog asking me what type of chat account I have, but there seems to be no options available. Is there a dependency I'm missing? Thanks, Jayson

2 1

[arch-general] Last TeXLive 2012 packages before TeXLive 2013
by Rémy Oudompheng 18 Apr '13

18 Apr '13

Hello, TeXLive 2012 continuous updates have been frozen for TeXLive 2013 preparation. I have uploaded updated versions of the TeXLive 2012 packages to [testing], feel free to report any problems. Regards, Rémy.

1 0

[arch-general] The "new" opensmtpd package
by Hugo Osvaldo Barrera 18 Apr '13

18 Apr '13

Hi, All of a sudden, this morning, after running pacman -Syu, I found myself incapable of sending emails from several of my machines. I had noticed not warnings, or errors, and, after tracking the issue for a while, it turns out the problem was the new opensmtpd package in [community], which had replaced my own one (present in AUR). I've been maintaining an opensmtpd package in AUR for a long time now (it was recently renamed to "opensmtpd", but I had maintaing it under the previous name since it's early development, which I follow very closely). One of the problems with the new package in [community], is that it's build configuration differs SO MUCH from the defaults (and my own package), that their settings are incompatible. I belive this goes against the Arch way, which is to stay as close as possible to upstream. Also, the one in [community] has explicit flags that actually reduce security (for what reason, I wonder?). At first, I though I'd contact the author, but I couldn't find out how. The PKGBUILD does not include the maintainer's email, and he's not listed as a TU or Dev. Finally, I'm a bit surprised as to how this happened. I planned to propose to move my own package from AUR to [community] at some point, but not yet, since it only has 7 votes (way less than what the wiki describes neccesary). Secondly, I'm confused as to how this is done. If there's a package in AUR, isn't that moved into [community] instead of writing a brand new one? Please don't take this as a rant of "You broke my email setup!", but rather as a "Hey, this isn't very transpart to the community; how do these thing happen? How do I contact the maintainer? What was the procedure to get this package into [community]? Is there any way I can participate in it's maintenence?" Thanks, -- Hugo Osvaldo Barrera

5 10

[arch-general] gummiboot kernel panic: unable to mount root fs
by David Benfell 17 Apr '13

17 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I haven't seen this one for a while--a long while. I assume it still means what it used to mean, that is, that I haven't correctly specified the root partition. gummiboot is proving to be a bit of an adventure on this Asus X202E. The gummiboot install command failed to create the boot loader entry, so I was grateful that the Arch Wiki page on UEFI had not yet been updated to eliminate the explanation on how to create the entry using efibootmgr. What gummiboot install *did* do seems a bit strange--particularly as it still works according to the old way as documented in the Arch Wiki page on gummiboot--on my desktop system. It created a loader.conf with a timeout of 3 and a default with a moderately long hex string appended with a '-*'. There are no corresponding entries in the entries subdirectory. The hex string does not appear to correspond to any PARTUUIDs on the system. I commented that out and set it up the old way as documented on the Arch Wiki page, and when that didn't work, discovered that I needed to use efibootmgr. Now the BIOS--or whatever it's supposed to be called these days--sees the Gummiboot option at least as a possible override, but when selected, I get the kernel panic mentioned in the subject. I'm not quite sure what the best way to proceed is at this point. I think I'm awfully close to having it working, but it *is* EFI, and so far, that's always an adventure. Thanks! -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJRaa3nAAoJELJhbl/uPb4S2w8P/2r2fuUa85pXIjNuQ4+XHbJR NoeqjdcwT+/xlaAsLDh4c9hrcdX+5l4hPvMSib8pJAZWTY+AkUZ52w/t02FC5+hH Djw5e/jidbSCgR72xR2sKZzzqkQvv1WjxMwaayPlK8BTCuQprC3cGyhjTSIOKhXN Xs1w5ZWyOt01J6Chb4KLPFyBEKafxb/0BUgJLrG3i8q+X97BoX2nmjhPB5hGCmZx LCamvBG7pVGwMfikEzkcFl7ASc8YZGlHzGiIfey1SjabXA6xLLTdI8rsNJTuEYvq 34rAMkVozNo5rCyTQU7tJTsg8pA42AL+nrAAmNLDDRKUeEkXryP/gCN7WyzA++Dd y5x7MozO6CUiNcLcpc7ktkye7R/3TO0fGT1LDXrHIT8khRgz4vShvUuEJd5lGuUj bC0R2VXxke/wY3oI3KC3/ZEEqty0ceSCMWisoCNgYqRKjSYyJJV77nBWlVRsvmmI KkPIdIUrtjWCkrksQp8arQhuHc56kl+jr6lc3fIrDTXEZ94vf7dadKGWGS0YamyI BUCnNKFWinqblsl5b5uP4h9nIDOXwndy6PM58heJwwOc1U+M4iGEjBREBsQ3wsAK XZrGvc7LN6t+GlbzKL0qmAes2hvd/emlPo+cahgNEdx3q2A9Sds4VMrzbFfAN97l kv/HOERo0mZW1KH3mnwo =W177 -----END PGP SIGNATURE-----

3 9