April 2017 - Aur-general - lists.archlinux.org

[aur-general] ttf-google-webfonts{,-distilled,-git,-hg} mess
by Jason St. John 19 Jun '19

19 Jun '19

I am the current maintainer of the AUR package ttf-google-webfonts-hg[4], and I'm bothered by the mess of various packages there are for Google's Web Fonts project. It's not at all KISS in its current state. There are currently four different AUR packages[1][2][3][4] that essentially supply the same files, and all four packages conflict with each other. Around August of 2012, the package named ttf-google-webfonts[1] was orphaned, and user w0ng created a GitHub repository[5] that mirrors the Mercurial repository[6] on Google Code (why?). Then, the new maintainer changed the original ttf-google-webfonts package from a VCS-type package that simply lacked "-hg" in the name to a package that pulls tarballs from w0ng's GitHub repo[5]. As you can see in the comments for ttf-google-webfonts[1], this has caused all sorts of confusion and messages about the package being out-of-date or having invalid checksums. To get around these issues, user epinephrine created the package ttf-google-webfonts-git[3] that clones w0ng's GitHub repo[5] instead of pulling tarballs from it, which significantly reduces the maintenance required on the package. Then, user Gently created a package named ttf-google-webfonts-distilled[2] that pulls a tarball from w0ng's GitHub repo[5] and only installs a small subset of the fonts therein. Shortly after ttf-google-webfonts[1] was changed from being a Mercurial-based package and not liking the direction that the package was taking, I reuploaded the original ttf-google-webfonts package as ttf-google-webfonts-hg[4] for people that simply wanted the old package back that uses the actual Google Web Fonts repository to download the files. To clean up this mess, I propose that ttf-google-webfonts-distilled[2] and ttf-google-webfonts-git[3] be deleted outright, for what should be obvious reasons. I also propose that ttf-google-webfonts[1] be deleted because of how frequently the Web Fonts project is updated and because the project lacks version numbers. If people really feel strongly about keeping that maintenance nightmare, then let them have it, but I really don't see what advantage it provides over the original ttf-google-webfonts-hg[4] other than one less makedepends. I apologize for the huge email, but this situation really is a mess. [1] https://aur.archlinux.org/packages/ttf-google-webfonts/ [2] https://aur.archlinux.org/packages/ttf-google-webfonts-distilled/ [3] https://aur.archlinux.org/packages/ttf-google-webfonts-git/ [4] https://aur.archlinux.org/packages/ttf-google-webfonts-hg/ [5] https://github.com/w0ng/googlefontdirectory [6] https://code.google.com/p/googlefontdirectory/ Jason

14 23

[aur-general] Can we have optional deps on AUR packages?
by Sven-Hendrik Haase 19 Apr '17

19 Apr '17

I just wanted to clear this up with the other TUs: Is it ok for [community] packages to have optional deps on AUR packages or not?

3 3

[aur-general] aursec - blockchain-based verification of AUR packages
by Bennett Piater 13 Apr '17

13 Apr '17

Hello, we are pleased to announce the release of aursec [0], a tool which aims to improve the security of using the AUR. We are writing it as part of our Bachelor's thesis. It provides a secure hash database in a private Ethereum blockchain that stores hashes for specific package versions. The hash that was submitted from the most different users becomes the consensus and can be queried and compared against. The hash is formed from the PKGBUILD, install files and VCS sources, thereby adding a layer of verification on top of that provided by the hashes in the PKGBUILD. The threat model [1] we defend against is targeted attacks against specific AUR users, e.g. using a hostile takeover and subsequent modification of an orphan package, that would be reverted and therefore likely not noticed. If the target used aursec, he would see that his package has a different hash from what other users got. Aursec takes a build folder containing a PKGBUILD and .SRCINFO and does all the work automatically. It calls makepkg --verifysrc in a firejail sandbox to download VCS sources and find out the current version. Example use: $aursec ~/aur/foo $find -type d ~/aur | aursec We would greatly appreciate feedback on the threat model, solution, and the usability of the tool itself. Cheers, Bennett Piater and Lukas Krismer [0]: https://aur.archlinux.org/packages/aursec [1]: https://vps1.piater.name/file-sharing/r/_q35eP3Y89#wqDp8+hB9C22GdKrH4nD/HP1… -- GPG fingerprint: 871F 1047 7DB3 DDED 5FC4 47B2 26C7 E577 EF96 7808

1 0

[aur-general] git push - Permissions denied
by Dan B 06 Apr '17

06 Apr '17

Package: aur.archlinux.org/libcs50 > » git push > Enter passphrase for key '/home/krakn/.ssh/id_rsa': > git-receive-pack: permission denied: krakn > fatal: Could not read from remote repository. > > Please make sure you have the correct access rights and the repository exists. Remotes are as follows (I am able to clone the repository): > » git remote -v > origin ssh://aur@aur.archlinux.org/libcs50 (fetch) > origin ssh://aur@aur.archlinux.org/libcs50 (push) I have no problems pushing to my other repositories. Is there something on the backend that might be preventing the push? Thanks!

3 4

[aur-general] first package submission
by David CARLIER 05 Apr '17

05 Apr '17

Hi all, I wished to submit this new package, the only thing is the main source file needs to be taken from the url (e.g needs a registration) but that s all so I dunno if I can apply for submitting this to aur ? Kind regards.

4 4

[aur-general] Deletion requests
by Konstantin Gizdov 04 Apr '17

04 Apr '17

Hi all, So I updated my packages and had other people also update theirs so that pythia8 and xrootd-abi0 are now completely redundant. I submitted requests for deletion a while ago and I am just writing to confirm that they can be safely removed. No packages have them as dependencies and I have even overprovisioned with 'provide' statements in the now correct pythia and xrootd packages. Thanks. Regards, Konstantin

2 1