June 2019 - Arch-general - lists.archlinux.org

[arch-general] CVE-2019-11477 (/proc/sys/net/ipv4/tcp_sack)
by David C. Rankin 22 Jun '19

22 Jun '19

After 5.12.1 is there any further mitigation needed for: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11477 related: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11478 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11479 Suggested work-around: echo 0 > /proc/sys/net/ipv4/tcp_sack or iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP Are either needed after latest kernel, or is this resolved? -- David C. Rankin, J.D.,P.E.

2 2

[arch-general] package contents on fresh Arch install, like python etc...
by Ram Kumar 21 Jun '19

21 Jun '19

Dear Archers, A day back, i made a fresh install of Arch on my desktop. It is completely fresh as like it doesnt even have an account other than root. My doubt is, wont basic tools like python come in Arch install? or do we have to install by ourselves? also can anyone give me a brief approximate list of packages that will come pre-installed in Arch, other than gnu tools? Thanks in advance yours fellow newbie Archer Ramkumar

5 6

[arch-general] Is it secure to just sign repository databases?
by Manuel Reimer 17 Jun '19

17 Jun '19

Hello, I run a repository locally that I would like to share to the public. The build is mostly automated. That's why I don't want to sign each individual package. The private key is not stored on the build machine and I want to sign the resulting stuff externally. The easiest way would be actually to just manually sign the database file. As this file includes all checksums of the individual packages, I think this is as secure as signing every package, right? Thanks in advance Manuel

4 7

[arch-general] How to name a package for the drm-openchrome tree?
by Marc Ranolfi 17 Jun '19

17 Jun '19

Hey guys. I'm planning on packaging the linux kernel with OpenChrome DRM support from https://cgit.freedesktop.org/openchrome/drm-openchrome/ to share in the AUR. What should I name the package? 1. linux-drm-openchrome-git 2. linux-drm-openchrome-next-git And what should the description be? Something like "The Linux-drm-openchrome-git kernel and modules" ? Thanks for your input. Marc

4 5

Re: [arch-general] [arch-dev-public] Mkinitcpio replacement with Dracut
by Genes Lists 16 Jun '19

16 Jun '19

Early Microcode and initrd. I notice that the AMD microcode is [1] in the initrd while the intel microcode is not. Booting with option: initrd=/boot/intel-ucode.img to get the microcode installed early works fine with dracut as it always has. Is this something that will remain the same as now or does this potentially change under dracut? thanks gene [1] lsinitrd shows: Early CPIO image ======================================================================== drwxr-xr-x 3 root root 0 May 21 11:48 . -rw-r--r-- 1 root root 2 May 21 11:48 early_cpio drwxr-xr-x 3 root root 0 May 21 11:48 kernel drwxr-xr-x 3 root root 0 May 21 11:48 kernel/x86 drwxr-xr-x 2 root root 0 May 21 11:48 kernel/x86/microcode -rw-r--r-- 1 root root 30546 May 21 11:48 kernel/x86/microcode/AuthenticAMD.bin

8 26

[arch-general] perl update leaves glade-perl unused, but glade-perl still a dependency of qemu-launcher?
by David C. Rankin 13 Jun '19

13 Jun '19

Archdevs, After latest perl update, the following message is displayed: -> Run the following command to get a list of affected packages: pacman -Qqo '/usr/lib/ So we did, and it flagged glade-perl, but checking, glade-perl was still a dependency of qemu-launcher. I don't know if this is just a lucky timing issue in between when qemu-launcher will be updated, but I thought I would pass it along if this presents a problem. -- David C. Rankin, J.D.,P.E.

3 3

[arch-general] perl update leaves glade-perl unused, but glade-perl still a dependency of qemu-launcher?
by David C. Rankin 11 Jun '19

11 Jun '19

Archdevs, After latest perl update, the following message is displayed: -> Run the following command to get a list of affected packages: pacman -Qqo '/usr/lib/ So we did, and it flagged glade-perl, but checking, glade-perl was still a dependency of qemu-launcher. I don't know if this is just a lucky timing issue in between when qemu-launcher will be updated, but I thought I would pass it along if this presents a problem. -- David C. Rankin, J.D.,P.E.

1 0

Re: [arch-general] [arch-dev-public] Mkinitcpio replacement with Dracut
by Damjan Georgievski 11 Jun '19

11 Jun '19

> > I have been looking into dracut for some time now, I copied some stuff > from them on a few of my own > scripts and they also have an actual test suite, that we currently can't > use on Arch, but I plan to > change that. > Is there any support for post hooks in Dracut? ie. I want to sign the uefi image with sbsign, after it's built with `dracut --uefi …` -- damjan

2 1

[arch-general] certbot automatic renewal: why twice a day?
by Łukasz Michalski 11 Jun '19

11 Jun '19

Hi, Looking at timer example at [1]: "Add a timer to check for certificate renewal twice a day and include a randomized delay so that ....." Why try to renew twice a day? I understand that there is 30 days before expiration date to renew. I think weekly check should be enough for a server? Regards, Łukasz [1] https://wiki.archlinux.org/index.php/Certbot#Automatic_renewal

2 1

[arch-general] nfs mountd broken?
by Thomas Langen 09 Jun '19

09 Jun '19

Package nfs-utils-2.3.4-1_x86-64 contains a version of mountd.nfs that core dumps and prevents further usage of nfs (at least for me). nfs- utils-2.3.3-1_x86-64 still works.

2 1