May 2025 - Arch-general - lists.archlinux.org

Pacman lite?
by Pocket 14 Jun '25

14 Jun '25

Is it possible to build a neutered version of pacman? A pacman lite if you will.... I need to cut down on the dependencies pacman requires. Without key signing and package signing. I would like to only have package building and package management and pull from an http respository. This is for a custom built OS that I would like to use pacman on an ARM SBC. it currently uses rpm as a package manager. I would also like to build them using makepkg. -- Hindi madali ang maging ako

5 6

stable-repos Newsfeed Never Showed linux 6.14.7.arch2-1 x86_64 after it left core-testing?
by David C Rankin 25 May '25

25 May '25

Arch Admins, I use the newsfeeds extensively to keep track of what packages are coming for server updates. This past cycle with linux 6.14.7.arch2-1, it appeared in core-testing (https://archlinux.org/feeds/packages/x86_64/core-testing/) on 5/22, but I never show it reaching: https://archlinux.org/feeds/packages/all/stable-repos/ This is really just to pass this along in case there is a problem with the feeds. However, if anyone knows why this occurred, I'm curious about that fact as well. -- David C. Rankin, J.D.,P.E.

1 0

[ANNOUNCE] Proposed fix for dnssec-anchors package (outdated trust anchors + unused makedepends)
by meowmeowbeanz 24 May '25

24 May '25

Hi arch-dev-public, I'm announcing a proposed moderate change to the dnssec-anchors package per the developer manual guidelines. ## Summary Fix for 5+ year old DNSSEC trust anchors and unused makedepends in the dnssec- anchors package. ## Issues Addressed - GitLab Issue: #2 (outdated trust anchors) - Existing Bug: #77100 (unused makedepends, assigned to jelly) ## Proposed Changes - Restore dynamic trust anchor generation in build() function - Filter for KSK records (flag 257) to eliminate DNSSEC warnings - Update package version to 20250523-1 - Remove dependency on static 2019 files ## Testing - Verified DNSSEC validation works correctly - Eliminated knot-resolver warnings - Confirmed proper ad flag behavior with drill/kdig ## Merge Request Available at: https://gitlab.archlinux.org/archlinux/packaging/packages/ dnssec-anchors/-/merge_requests/1 The change preserves the established purpose (providing DNSSEC trust anchors) while updating to current practices and fixing confirmed bugs. Comments and feedback welcome. Thanks, meowmeowbeanz

1 0

openSUSE removes Deepin from official distro on security grounds - Arch have similar concerns?
by David C Rankin 14 May '25

14 May '25

Devs, The Register posted an article about openSUSE removing the Deepin desktop based on dbus abuse and other security and packaging violations. The issues are documented and linked in the article: https://go.reg.cx/tdml/dfd67/684a187f/7019d634/4gJn Has Arch done a similar analysis or have similar concerns? openSUSE have removed it from the distro, but left the package available in the community packager's repoo (similar to AUR setup). Not sure whether that is something to consider here. The concern being that by providing official packages openSUSE gave Deepin the aura of being up to the distros security standards where apparently that isn't something that was warranted. -- David C. Rankin, J.D.,P.E.

2 1

Bash [[ foo =~ regex ]] behavior changed with last update, gentoo patches?
by David C Rankin 09 May '25

09 May '25

Arch devs, I have a script that parses IP and CIDR notation using the following to capture IPs: [[ $1 =~ ^([^.]{1,3})[.]([^.]{1,3})[.]([^.]{1,3})[.]([^.]{1,3})$ ]] # validate 5 elements in BASH_REMATCH array if [ "${#BASH_REMATCH[@]}" -eq 5 ]; then ... (yes, I can improve it -- but that's not the point here) Then to capture CIDR: [[ $1 =~ ^([^.]{1,3})[.]([^.]{1,3})[.]([^.]{1,3})[.]([^.]{1,3})/(.*)$ ]] # validate 6 elements in BASH_REMATCH array if [ "${#BASH_REMATCH[@]}" -eq 6 ]; then ... This script was used to automatically update ipset lists and save /etc/ipset.conf. It has worked for years. Today after update to bash-5.2.037-3-x86_64 I get: $ ipsa 38.0.0.0/8 /home/david/scr/adm/ipset_add.sh: line 6: [: 0/8: integer expression expected /home/david/scr/adm/ipset_add.sh: line 6: [: 0/8: integer expression expected valid IP: 38.0.0.0/8 ipset v7.23: Hash is full, cannot add more elements The problem being for the first time ever, the regex in: [[ $1 =~ ^([^.]{1,3})[.]([^.]{1,3})[.]([^.]{1,3})[.]([^.]{1,3})$ ]] parsed the IP as 38 0 0 0/8 (with the "/8") instead of 38 0 0 0 filling the ipset blocklist completely with sequential 38.x.x.x IPs. Technically this regex matching is correct as the final character list [^.] doesn't preclude inclusion of '/', but this is a definite change from all prior bash versions. Is this the intended result of the gentoo patches change to the package? I've since fixed the regex with [^./] as the final list. Are there any other known changes to regex parsing with the changes to the bash PKGBUILD and patches? -- David C. Rankin, J.D.,P.E.

3 3

Package building and signing
by Pocket 06 May '25

06 May '25

I am building packages using makepkg for the raspberry pi 4 platform I changed the CFLAGS adding -march=armv8-a -mtune=cortex-a72 (makepkg.conf). I started to build all the packages that make up the "Building in a clean chroot" following the building in a claen chroot on the wiki. All when well. I will then build all the "base" package followed by all the packages I use on a "desktop" system. I would now like to make a custom repository for those packages and then have pacman install from there, eventually to remove the core extra etc repositories. I know how to create the custom repository (from the various wiki docs) using repo-add. I have a nginx web server on a remote raspberry pi and it will serve those packages from /etc/pacman.conf [custom] SigLevel = Optional TrustAll Server = http://www.home.arpa/Repository So my questions are as follows 1. How to get pacman to pull the packages from the custom repository first 2. I would like to sign the packages in the custom repository. I have looked at some of the information regarding signing packages(maybe missing some of them). It was totally confusing. I need guidance in the form of Step 1, step 2 etc. Is there such docs in existance? -- Hindi madali ang maging ako

5 8

Stop makepkg from running gpg on .sig files
by Sebastian Wiesner 06 May '25

06 May '25

Hello, apparently makepkg automatically attempts to verify .sig files in the SOURCES array with gpg. Can I somehow stop this behaviour? I have .sig URLs but these aren't GPG signatures, but SSH signatures I'd like to validate in a custom verify() function. Currently, I'm working around this by renaming the upstream .sig files to .sigssh in SOURCES, but that's rather inconvenient. Cheers, Basti

2 4

Building in a clean chroot
by Pocket 05 May '25

05 May '25

I am getting this error when running is there a way to fix this? Using makechrootpkg -c -r "$CHROOT" -- --ignorearch --skippgpcheck works fine $ arch-nspawn $CHROOT/root pacman -Syy :: Synchronizing package databases... custom 11.5 KiB 261 KiB/s 00:00 [#############################################] 100% core.db failed to download extra 9.5 MiB 15.9 MiB/s 00:01 [#############################################] 100% alarm.db failed to download aur.db failed to download error: failed retrieving file 'aur.db' from mirror.archlinuxarm.org : The requested URL returned error: 404 error: failed retrieving file 'alarm.db' from mirror.archlinuxarm.org : The requested URL returned error: 404 error: failed retrieving file 'core.db' from mirror.archlinuxarm.org : The requested URL returned error: 404 warning: too many errors from mirror.archlinuxarm.org, skipping for the remainder of this transaction error: failed to synchronize all databases (failed to retrieve some files) -- Hindi madali ang maging ako

3 6

Refreshing pacman database
by Pocket 05 May '25

05 May '25

pacman -Syy refreshes all db for all repositories Is there a way to have pacman only refresh a single repository db? Ie pacman -Syy custom only refreshes custom withou refreshing core extra etc -- Hindi madali ang maging ako

2 1

Arrogant reply on forums
by Qtra Gabriex 03 May '25

03 May '25

Guy with 63,000+ forum posts replies arrogantly over me asking for actual deletion to be implemented. Brings up multiple tragedies. This upsets me because I once donated $20 to the Software in the Public Interest and wish for positivity and inclusion. https://bbs.archlinux.org/viewtopic.php?id=305290

12 13