- Aur-dev - lists.archlinux.org

[aur-dev] AUR 2.1.0 released
by Lukas Fleischer 10 Jul '13

10 Jul '13

Changes since 2.0.1: * Typeahead suggest for packages. * Fix account editing and hijacking vulnerability. * Fix account privilege escalation vulnerability. * Clear a user's active sessions following account suspension. * Several translation fixes/updates. * pkgsubmit.php: Parse .AURINFO metadata. .AURINFO files can now be included in source packages to overwrite specific PKGBUILD fields. .AURINFO files are parsed line by line. The syntax for each line is "key = value", where key is any of the following field names: * pkgname * pkgver * pkgdesc * url * license * depend Multiple "depend" lines can be specified to add multiple dependencies. You can check the Git log [1] for a complete list of commits. The official Arch Linux AUR setup [2] has already been upgraded! [1] https://projects.archlinux.org/aur.git/log/?id=v2.1.0 [2] https://aur.archlinux.org/

7 11

[aur-dev] Spam comments
by Florian Dejonckheere 02 Jun '13

02 Jun '13

I stumbled upon a few spam comments, from an account that's already suspended according to the mailing list archives. The spammer's account is JOYOAUTO. A quick search through Google turns up the following package comments are polluted: o catalyst-hook (https://aur.archlinux.org/packages/catalyst-hook) o catalyst-daemon (https://aur.archlinux.org/packages/catalyst-daemon) o clamtk (https://aur.archlinux.org/packages/clamtk) o apc (https://aur.archlinux.org/packages/apc) o arbtt (https://aur.archlinux.org/packages/arbtt) o btscanner (https://aur.archlinux.org/packages/btscanner)<https://aur.archlinux.org/packages/bt-scanner> o alt-ergo (https://aur.archlinux.org/packages/alt-ergo) o albumart (https://aur.archlinux.org/packages/albumart) o autoaur (https://aur.archlinux.org/packages/autoaur) o atier (https://aur.archlinux.org/packages/catalyst-hook) o api-sanity-checker (https://aur.archlinux.org/packages/api-sanity-checker) o boost-build-config (https://aur.archlinux.org/packages/boost-build-config) o audiveris-beta (https://aur.archlinux.org/packages/audiveris-beta) The archives and Google also indicate spam comments on some of the packages were already removed. Isn't there a way to delete all of a given user's comments? Thanks *Florian Dejonckheere* florian(a)floriandejonckheere.be http://www.floriandejonckheere.be floriandejonckheere sip:florian@floriandejonckheere.be

2 1

[aur-dev] Notification System Overhaul
by canyonknight 08 May '13

08 May '13

Hello all, The current notification system for the AUR is lacking in features and isn't too pretty on the code side of things. Before I try and finalize the code I have, I wanted to lay out what I was planning for some feedback. Right now the AUR only allows for notifications when a user adds a comment. I would like users to have access to notifications for the following package actions: - New comments on packages - Package updates - Package adoption/orphaning - Package deletion/merging I think having the ability to select those 4 types of notifications brings a lot more flexibility while not being overly complicated. As for the AUR web interface changes, the package details page would feature a link to modify that specific package's notifications. The page would feature a list of all potential types of notifications the user can subscribe to with a check box next to each option. The user can then select all/some/none of the notifications for that specific package. On the backend side of things, swiftmailer seems to be a decent choice for sending the notifications. It is actively developed, has all the features the AUR would really need, and has a nice interface on the programming side of things. All the notification code mixed in with package functions and the like could be ripped out allowing for easier modification down the road. Ideally the following bugs should be closed after everything is implemented: FS#15412 - Send a notification when a package is orphaned or adopted FS#19948 - Add whether or not I'm the maintainer to the aur-notify email su FS#27687 - Merging packages does not transfer the notify list. FS#30109 - email notification upon package update FS#31850 - Send notification e-mails in preferred user language FS#31851 - Overhaul e-mail notification system FS#34843 - Make bugs/AUR messages more visible Does anyone have anything major they would like to see out of the notification system? Is there anything anyone disagrees with? Regards, Jason

3 4

[aur-dev] Adopted sakura-bzr package
by Evan Pitstick 07 May '13

07 May '13

I just adopted the sakura-bzr package and as it's my first aur submission I thought I'd request some comments. You can find the files here: https://github.com/xaocon/sakura-bzr/blob/master/PKGBUILD https://github.com/xaocon/sakura-bzr/blob/master/sakura-bzr.install One question I had in particular was about adding a variable. This is clearly discouraged in the documentation. I used ${pkgname%-bzr} in the source URL (as well as in several other places in the PKGBUILD). The website doesn't seem to parse the source line as I expected. I curious if it makes more sense to also create a _pkgname var and use it instead. All comments/suggestions welcome. Thanks, -Evan

3 3

Re: [aur-dev] [aur-general] Package naming
by Armin K. 03 May '13

03 May '13

On 05/03/2013 01:15 PM, Guillaume Friloux wrote: > Hi, the problem is that youre making multiple packages and AUR doesnt > supports it properly. > A possible hack would be to add at begin of second line : > true && > Well, there are already several packages with split binary packages, and they appear to be uploaded correctly. This mentions naming problem - ie only small letters allowed. CC-ing aur-dev. I can't upload llvm split package named llvm-r600 and it says: (translation from Croatian): Wrong name: Only small letters allowed. The PKGBUILD is located at http://sprunge.us/JFDe Is this a bug? I could upload the original package, but I can't update it.

1 0

[aur-dev] [PATCH] aurblup: Update for pacman 4.1 API changes
by Lukas Fleischer 28 Apr '13

28 Apr '13

alpm_db_register_sync() and alpm_option_get_syncdbs() have been renamed. Update aurblup sources accordingly. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- scripts/aurblup/aurblup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/aurblup/aurblup.c b/scripts/aurblup/aurblup.c index be398f8..f072669 100644 --- a/scripts/aurblup/aurblup.c +++ b/scripts/aurblup/aurblup.c @@ -189,11 +189,11 @@ dblist_create(void) int i; for (i = 0; i < sizeof(alpm_repos) / sizeof(char *); i++) { - if (!alpm_db_register_sync(handle, alpm_repos[i], 0)) + if (!alpm_register_syncdb(handle, alpm_repos[i], 0)) alpm_die("failed to register sync db \"%s\": %s\n", alpm_repos[i]); } - if (!(dblist = alpm_option_get_syncdbs(handle))) + if (!(dblist = alpm_get_syncdbs(handle))) alpm_die("failed to get sync DBs: %s\n"); for (d = dblist; d; d = alpm_list_next(d)) { -- 1.8.2.675.gda3bb24.dirty

1 0

[aur-dev] [PATCH] FS#34843: Send AUR notifications directly to user to make it more visible
by Anatol Pomozov 24 Apr '13

24 Apr '13

Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- web/lib/pkgfuncs.inc.php | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 53b7e54..ee150ca 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -260,11 +260,11 @@ function add_package_comment($pkgid, $uid, $comment) { $q.= "AND CommentNotify.UserID != " . $uid . " "; $q.= "AND CommentNotify.PkgID = " . intval($pkgid); $result = $dbh->query($q); - $bcc = array(); + $recipients = array(); if ($result) { while ($row = $result->fetch(PDO::FETCH_ASSOC)) { - array_push($bcc, $row['Email']); + array_push($recipients, $row['Email']); } $q = "SELECT Packages.* "; @@ -282,9 +282,10 @@ function add_package_comment($pkgid, $uid, $comment) { . $comment . "\n\n---\nIf you no longer wish to receive notifications about this package, please go the the above package page and click the UnNotify button."; $body = wordwrap($body, 70); - $bcc = implode(', ', $bcc); - $headers = "Bcc: $bcc\nReply-to: nobody(a)archlinux.org\nFrom: aur-notify(a)archlinux.org\nX-Mailer: AUR\n"; - @mail('undisclosed-recipients: ;', "AUR Comment for " . $row['Name'], $body, $headers); + $headers = "Reply-to: nobody(a)archlinux.org\nFrom: aur-notify(a)archlinux.org\nX-Mailer: AUR\n"; + foreach ($recipients as $to) { + @mail($to, "AUR Comment for " . $row['Name'], $body, $headers); + } } } @@ -873,12 +874,12 @@ function pkg_delete ($atype, $ids, $mergepkgid) { $q.= "AND CommentNotify.UserID != " . uid_from_sid($_COOKIE['AURSID']) . " "; $q.= "AND CommentNotify.PkgID = " . $pkgid; $result = $dbh->query($q); - $bcc = array(); + $recipients = array(); while ($row = $result->fetch(PDO::FETCH_ASSOC)) { - array_push($bcc, $row['Email']); + array_push($recipients, $row['Email']); } - if (!empty($bcc)) { + if (!empty($recipients)) { $pkgname = pkgname_from_id($pkgid); # TODO: native language emails for users, based on their prefs @@ -893,9 +894,10 @@ function pkg_delete ($atype, $ids, $mergepkgid) { $body .= "You will no longer receive notifications about this package."; } $body = wordwrap($body, 70); - $bcc = implode(', ', $bcc); - $headers = "Bcc: $bcc\nReply-to: nobody(a)archlinux.org\nFrom: aur-notify(a)archlinux.org\nX-Mailer: AUR\n"; - @mail('undisclosed-recipients: ;', "AUR Package deleted: " . $pkgname, $body, $headers); + $headers = "Reply-to: nobody(a)archlinux.org\nFrom: aur-notify(a)archlinux.org\nX-Mailer: AUR\n"; + foreach ($recipients as $to) { + @mail($to, "AUR Package deleted: " . $pkgname, $body, $headers); + } } } -- 1.8.2.1

3 4

[aur-dev] [PATCH] Add PackagerUID column to Packages table
by canyonknight 24 Apr '13

24 Apr '13

The last packager is not currently saved despite there being many instances of the last packager being different than either the submitter or the maintainer. Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- UPGRADING | 10 ++++++++++ support/schema/aur-schema.sql | 4 +++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/UPGRADING b/UPGRADING index a04471f..a003e9b 100644 --- a/UPGRADING +++ b/UPGRADING @@ -1,6 +1,16 @@ Upgrading ========= +From 2.2.0 to 2.3.0 +------------------- + +1. Add new last packager column to "Packages" table: + +---- +ALTER TABLE Packages ADD COLUMN PackagerUID INT(10) UNSIGNED NULL DEFAULT NULL; +ALTER TABLE Packages ADD FOREIGN KEY (PackagerUID) REFERENCES Users(ID) ON DELETE SET NULL; +---- + From 2.1.0 to 2.2.0 ------------------- diff --git a/support/schema/aur-schema.sql b/support/schema/aur-schema.sql index 0d04f12..c797970 100644 --- a/support/schema/aur-schema.sql +++ b/support/schema/aur-schema.sql @@ -106,6 +106,7 @@ CREATE TABLE Packages ( ModifiedTS BIGINT UNSIGNED NOT NULL, SubmitterUID INTEGER UNSIGNED NULL DEFAULT NULL, -- who submitted it? MaintainerUID INTEGER UNSIGNED NULL DEFAULT NULL, -- User + PackagerUID INTEGER UNSIGNED NULL DEFAULT NULL, PRIMARY KEY (ID), UNIQUE (Name), INDEX (CategoryID), @@ -115,7 +116,8 @@ CREATE TABLE Packages ( FOREIGN KEY (CategoryID) REFERENCES PackageCategories(ID) ON DELETE NO ACTION, -- deleting a user will cause packages to be orphaned, not deleted FOREIGN KEY (SubmitterUID) REFERENCES Users(ID) ON DELETE SET NULL, - FOREIGN KEY (MaintainerUID) REFERENCES Users(ID) ON DELETE SET NULL + FOREIGN KEY (MaintainerUID) REFERENCES Users(ID) ON DELETE SET NULL, + FOREIGN KEY (PackagerUID) REFERENCES Users(ID) ON DELETE SET NULL ) ENGINE = InnoDB; -- 1.8.2.1

2 1

[aur-dev] Removing spammer accounts
by Lukas Fleischer 23 Apr '13

23 Apr '13

I analyzed recent additions to the AUR user database in the hope of finding a way to delete all spammer accounts. Unfortunately, the account creation bot seems to be a bit more clever than I thought. Various different user names (both random user names, user names extracted from IRC channels etc.) and various different email addresses (different hosts, some local parts match the user name and some don't) were used. The only obvious pattern is that following fields are always empty: * RealName * IRCNick * PGPKey However, using that filter and also filtering by ID (51617 is the first account obviously created by a bot) and last login (1363737600 is 2013-03-20 00:00:00 which is after the login form has been disabled for Tor users) still leaves 18378 accounts: mysql> SELECT COUNT(*) FROM Users WHERE RealName = '' AND -> IRCNick = '' AND PGPKey = '' AND ID >= 51617 AND -> ID <= 70072 AND LastLogin < 1363737600; +----------+ | COUNT(*) | +----------+ | 18378 | +----------+ 1 row in set (0.01 sec) My suggestion is: 1. Set the password field of these accounts to "", so that they will no longer be able to login. They can still use the password reset form. 2. Delete all accounts that still have an empty password field in ~2 weeks. If there are any objections or alternative suggestions, please let me know. Otherwise, I will unset password fields before I re-enable the registration form (on Tuesday, 2013-03-26). Regards, Lukas

2 3

Re: [aur-dev] AUR Android app
by Pedro Veloso 21 Apr '13

21 Apr '13

Hi guys, Thank you for the replies. The RPC will do nicely, that was exactly what I was looking for. I guess I'll start with the info provided by the RPC and think about web scraping for package dependencies later on. The notifier for package maintainers should be easy to implement, I'm assuming it is basically keeping track of the "OutOfDate" field. As soon as I start and setup project somewhere (probably on github) I'll inform the list about my progress. Thank you, and cheers :)

2 2