- Aur-dev - lists.archlinux.org

Re: [aur-dev] FS#17109: AUR passwords are not salted
by Linas 26 Jun '10

26 Jun '10

Loui Chang wrote: > Thank you for your suggestions. These are things that are best discussed > on the aur-dev mailing list. > > Seems like you've put some thought into this. Why don't you submit a > patch? > Thanks for your support. Here goes an attempt. I have mixed my suggestions with Denis idea of changing the hash algorithm at the same time plus a few bits I found on the way. Actions performed by this patch: salt to be NULL, in which case it is treated as md5 hashed password. *All entries can be automatically updated by a -to be written- script. *Removes add salt on login code, per above. *Salted passwords now use sha512 instead of md5. *Adds requirement on hash extension (usually bundled as static). *try_login() only performs one query to verify user login instead of 5. *generate_salt now uses mt_rand() *Reject passwords given by GET.

3 10

[aur-dev] Git workflow
by Denis Kobozev 24 Jun '10

24 Jun '10

Is there a suggested workflow for working with AUR git repo? Suppose I do the following: $ git clone git://projects.archlinux.org/aur.git # code/test feature A $ git commit -a # commit feature A to my local branch $ git format-patch origin # create a patch with feature A # send patch with feature A to origin, patch applied to origin with git am Now branches look like this: ---o---o---A' origin/master \ \---A local/master I do a `git pull` from my local branch and get: ---o---o---A'--- origin/master \ \ \---A---M local/master I then work on feature B and commit it to my local branch: ---o---o---A'--- origin/master \ \ \---A---M---o---B local/master Then I do `git format-patch origin` and get two patches, both for A and B, even though A is already in origin as A'. Is there a better way to do this? Best, Denis.

4 5

[aur-dev] [PATCH] remove build function check
by Andrea Scarpino 23 Jun '10

23 Jun '10

--- web/html/pkgsubmit.php | 16 +--------------- 1 files changed, 1 insertions(+), 15 deletions(-) diff --git a/web/html/pkgsubmit.php b/web/html/pkgsubmit.php index 0b9335b..6f7a669 100644 --- a/web/html/pkgsubmit.php +++ b/web/html/pkgsubmit.php @@ -112,10 +112,7 @@ if ($_COOKIE["AURSID"]): fclose($fp); # Now process the lines and put any var=val lines into the - # 'pkgbuild' array. Also check to make sure it has the build() - # function. - # - $seen_build_function = 0; + # 'pkgbuild' array. while (list($k, $line) = each($lines)) { # Neutralize parameter substitution $line = preg_replace('/\${(\w+)#(\w*)}?/', '$1$2', $line); @@ -147,22 +144,11 @@ if ($_COOKIE["AURSID"]): $lparts[1]); } } - else { - # Non variable assignment line. (comment, blank, command, etc) - if (preg_match('/\s*build\s*/', $line)) { - $seen_build_function = 1; - } - } } # some error checking on PKGBUILD contents - just make sure each # variable has a value. This does not do any validity checking # on the values, or attempts to fix line continuation/wrapping. - # - if (!$seen_build_function) { - $error = __("Missing build function in PKGBUILD."); - } - $req_vars = array("url", "pkgdesc", "license", "pkgrel", "pkgver", "arch", "pkgname"); foreach ($req_vars as $var) { if (!array_key_exists($var, $pkgbuild)) { -- 1.7.1

2 1

[aur-dev] Accept packages with build and/or package function (FS#19914)
by Andrea Scarpino 23 Jun '10

23 Jun '10

With makepkg 3.4.0 is possible to avoid the build() function and use package() only. Current AUR checks only for build() when it parsing PKGBUILD, this patch checks for both. build() OR package() function is needed. -- Andrea Scarpino - andreascarpino.it KDE Maintainer in Arch Linux

2 1

[aur-dev] changing build options - yaourt
by PeanuTech 16 Jun '10

16 Jun '10

Hi I just started using Arch Linux. So far it's a great distribution. I have a question regarding yaourt. When you install packages from source code, can you specify any options for make? e.g. make -j6? If so, how it's done. I'd like to read a wiki article if there's one. Thanks.

3 2

[aur-dev] [PATCH] Add sorting by "Voted" and "Notify" fields
by Lukas Fleischer 04 Jun '10

04 Jun '10

This patch adds the possibility to sort by "Voted" and "Notify" columns in package search results. Fixes FS#13643 [1] (and maybe also FS#5401 [2]). [1] http://bugs.archlinux.org/task/13643 [2] http://bugs.archlinux.org/task/5401

2 1

Re: [aur-dev] FS#17109: AUR passwords are not salted
by Linas 19 Apr '10

19 Apr '10

Loui Chang wrote: > Thank you for your suggestions. These are things that are best discussed > on the aur-dev mailing list. > > Seems like you've put some thought into this. Why don't you submit a > patch? > Thanks for your support. Here goes an attempt. I have mixed my suggestions with Denis idea of changing the hash algorithm at the same time plus a few bits I found on the way. Actions performed by this patch: salt to be NULL, in which case it is treated as md5 hashed password. *All entries can be automatically updated by a -to be written- script. *Removes add salt on login code, per above. *Salted passwords now use sha512 instead of md5. *Adds requirement on hash extension (usually bundled as static). *try_login() only performs one query to verify user login instead of 5. *generate_salt now uses mt_rand() *Reject passwords given by GET.

1 0

Re: [aur-dev] FS#17109: AUR passwords are not salted
by Loui Chang 18 Apr '10

18 Apr '10

On Sun 18 Apr 2010 01:01 +0200, Linas wrote: > Arch User Repository (AUR) wrote: > > The following task has a new comment added: > > > > FS#17109 - AUR passwords are not salted > > User who did this - Loui Chang (louipc) > > > > ---------- > > A patch has been committed to git which will salt the passwords. > > ---------- > > > > More information can be found at the following URL: > > http://bugs.archlinux.org/task/17109#comment60615 > > These are good news, however, I don't think it is as good as "it would be": > > > # get salt for this user > > $salt = get_salt($userID); > > if ($salt) { > > # use salt > > ... > > $passwd_result = mysql_fetch_row(db_query($passwd_q, $dbh)); > > } else { > > ... > > $nosalt_result = mysql_fetch_row(db_query($nosalt_q, $dbh)); > > } > > > This gratuitously changes one sql query for login to three. > > It could be done as: > "SELECT ID,Passwd,Salt FROM Users" .+ " WHERE ID = '$userID'"; > $result = mysql_fetch_row(....) > if ($result[0]) { return false; } //No such user > if ( salted_hash($passwd, $result[2]) == $result[1] ) { return true; } > if ( is_null($result[2]) && (md5($passwd) == $result[1]) { update hash; > return true; } > > > Since it already encapsulates the salting into a function, it would be > trivial to allow the > salting compatible with already stored passwords, so they can be updated > with a script: > > function salted_hash($passwd, $salt) > { > if (strlen($salt) != 32) { > trigger_error('Salt does not look like an md5 hash', E_USER_WARNING); > } > return md5($salt . md5($passwd)); > } > > Finally, generate_salt() would be safer using mt_rand() instead of rand(). Thank you for your suggestions. These are things that are best discussed on the aur-dev mailing list. Seems like you've put some thought into this. Why don't you submit a patch?

1 0

[aur-dev] [PATCH] Support for salted passwords
by Denis Kobozev 16 Apr '10

16 Apr '10

Hi archers, Here's a patch that adds support for storing salted passwords in the database. The salt is a random string for each user and is stored along with the password in the Users table. Salt is created and password is salted when old users log in. New users get salted passwords when they register. What do you think? Denis.

4 4

[aur-dev] [PATCH] add search only by name and use it as default
by Andrea Scarpino 15 Apr '10

15 Apr '10

This add the ability to search packages only by name and set it as default. The possibility to search by both is kept using Advanced Search. -- Andrea

4 5