June 2019 - Aur-general - lists.archlinux.org

[aur-general] Fwd: [AUR] esp-idf
by Gonçalo Pereira 30 Jun '19

30 Jun '19

Hello, This package is outdated for a month and the maintainer grabbed the package in the beggining of this year and never touched it. I tried contacting him and nothing. Maybe I can maintain this package? (I was the last packager). Let me know what you think. Best Regards, Gonçalo Pereira (G-Pereira) ---------- Forwarded Message ---------- Subject: [AUR] esp-idf Date: Friday, June 14, 2019, 5:59:41 PM WEST From: Gonçalo Pereira <goncalo_pereira(a)outlook.pt> To: a(a)arti-nt.ru Hi, I see your package is outdated for a while. Since I use this package for my day-time job maybe I can help you keep it up-to-date. What I suggest is if you want I could be a co-mantainer. What do you think? Best Regards, Gonçalo Pereira (G-Pereira) -----------------------------------------

2 2

[aur-general] The AUR package "svp" is suspicious
by Hirela 30 Jun '19

30 Jun '19

TL;DR: The AUR package "svp" (https://aur.archlinux.org/packages/svp/) might be injecting suspicious binary patches. Here are the relevant lines from the PKGBUILD version 4.3.0.165: pkgver=4.3.0.165 source=("https://gist.githubusercontent.com/phiresky/1e2cbd30bed4e5978771af232d11afd…") # I am rehosting the binaries # taken from # http://www.svp-team.com/files/svp4-linux-64.tbz2 # at https://gist.github.com/phiresky/1e2cbd30bed4e5978771af232d11afd1 # so they are correctly versioned and old versions still exist sha256sums=('00a025ce7c06660bafbad8cf5d889e9a6f09a9c9c9585dbee2415a8bf0256f53') First of all, I do not agree with him rehosting binary software and would much prefer this PKGBUILD to just download the latest version of svp4-linux-64.tbz2 straight from the official source. Since this is proprietary freeware, the maintainer might not have a license to redistribute binaries, and even if he did, the advantage of "correctly versioned" does not match up to the disadvantage of having to trust the maintainer to not tamper with his rehosted versions. Loose versions are acceptable for all the *-git packages, so it should be acceptable for SVP. I decided to get the binaries from the official source to verify whether his rehosted packages weren't tampered with. The package version of the PKGBUILD (4.3.0.165) matches up with the latest version of SVP according to the official website (https://www.svp-team.com/wiki/Main_Page). I tried downloading the SVP binary from the official source and compare the hashes: $ curl https://www.svp-team.com/files/svp4-linux-64.tbz2 > svp4-linux-64.tbz2 $ sha256sum svp4-linux-64.tbz2 070411ab60d429e03632fa80bb3ded7d5b2c60c2f5b85dff136f65eb83da3bdb svp4-linux-64.tbz2 This hash does not match up with the hash claimed by the PKGBUILD for his rehosted version, which suggests that the rehosted package is not identical to the official one. I don't know whether this is due to incompetence or malice, but it is worrisome, as it may be possible that the maintainer has injected his own patches into the rehosted versions.

3 3

[aur-general] SPAM report, AUR comment
by Rylie James Thomas 29 Jun '19

29 Jun '19

Hi! Just noticed a SPAM comment on the debtap package, it's the user's only comment: - https://aur.archlinux.org/packages/debtap/#comment-693148 - https://aur.archlinux.org/account/jeniferlewis77/comments

3 2

[aur-general] Copyrighted source on https://aur.archlinux.org/
by Jones, Philip 25 Jun '19

25 Jun '19

Hi There is a package hosted on https://aur.archlinux.org/ that is copyrighted and not open source. How do I get it removed? Thanks Philip ----------------- Siemens Industry Software Limited is a limited company registered in England and Wales. Registered number: 3476850. Registered office: Faraday House, Sir William Siemens Square, Frimley, Surrey, GU16 8QD.

10 16

[aur-general] Postman
by Gonçalo Pereira 25 Jun '19

25 Jun '19

Hi all, The package "postman" has been broken for months now although a maintainer has put some effort to fix it. However, postman-bin works perfectly fine. Does it make sense to have this two packages? Let me know what you think. Best Regards, Gonçalo Pereira

2 1

[aur-general] Spammer Accounts
by ali.mousavi＠gmail.com 24 Jun '19

24 Jun '19

Hi, The following users are spamming the AUR comments: - https://aur.archlinux.org/account/dhavalpatel/comments - https://aur.archlinux.org/account/badmanlive/comments - https://aur.archlinux.org/account/badmanlive/comments Regards, Ali Mousavi

5 6

[aur-general] Two spammer accounts/comments
by Ronny Lorenz 21 Jun '19

21 Jun '19

Hi, one of my AUR packages (https://aur.archlinux.org/packages/mlapack/) has two obvious spammer comments, one from https://aur.archlinux.org/account/loritalear and the other from https://aur.archlinux.org/account/Melvinchunter Would the admins please be so kind to manually remove those two comments, possibly together with removing the spammer accounts at the same time ;) Cheers, Ronny -- Dipl.-Inform. Dr. rer. nat. Ronny Lorenz Institute for Theoretical Chemistry University of Vienna Waehringerstrasse 17 1090 - Vienna AUSTRIA web: http://www.tbi.univie.ac.at/ phone: +43-1-4277-52734 fax: +43-1-4277-52793 mail: ronny(a)tbi.univie.ac.at

1 0

[aur-general] Yet another spammer
by Edvinas Valatka 19 Jun '19

19 Jun '19

https://aur.archlinux.org/account/jocker12/comments

1 0

[aur-general] ttf-google-webfonts{,-distilled,-git,-hg} mess
by Jason St. John 19 Jun '19

19 Jun '19

I am the current maintainer of the AUR package ttf-google-webfonts-hg[4], and I'm bothered by the mess of various packages there are for Google's Web Fonts project. It's not at all KISS in its current state. There are currently four different AUR packages[1][2][3][4] that essentially supply the same files, and all four packages conflict with each other. Around August of 2012, the package named ttf-google-webfonts[1] was orphaned, and user w0ng created a GitHub repository[5] that mirrors the Mercurial repository[6] on Google Code (why?). Then, the new maintainer changed the original ttf-google-webfonts package from a VCS-type package that simply lacked "-hg" in the name to a package that pulls tarballs from w0ng's GitHub repo[5]. As you can see in the comments for ttf-google-webfonts[1], this has caused all sorts of confusion and messages about the package being out-of-date or having invalid checksums. To get around these issues, user epinephrine created the package ttf-google-webfonts-git[3] that clones w0ng's GitHub repo[5] instead of pulling tarballs from it, which significantly reduces the maintenance required on the package. Then, user Gently created a package named ttf-google-webfonts-distilled[2] that pulls a tarball from w0ng's GitHub repo[5] and only installs a small subset of the fonts therein. Shortly after ttf-google-webfonts[1] was changed from being a Mercurial-based package and not liking the direction that the package was taking, I reuploaded the original ttf-google-webfonts package as ttf-google-webfonts-hg[4] for people that simply wanted the old package back that uses the actual Google Web Fonts repository to download the files. To clean up this mess, I propose that ttf-google-webfonts-distilled[2] and ttf-google-webfonts-git[3] be deleted outright, for what should be obvious reasons. I also propose that ttf-google-webfonts[1] be deleted because of how frequently the Web Fonts project is updated and because the project lacks version numbers. If people really feel strongly about keeping that maintenance nightmare, then let them have it, but I really don't see what advantage it provides over the original ttf-google-webfonts-hg[4] other than one less makedepends. I apologize for the huge email, but this situation really is a mess. [1] https://aur.archlinux.org/packages/ttf-google-webfonts/ [2] https://aur.archlinux.org/packages/ttf-google-webfonts-distilled/ [3] https://aur.archlinux.org/packages/ttf-google-webfonts-git/ [4] https://aur.archlinux.org/packages/ttf-google-webfonts-hg/ [5] https://github.com/w0ng/googlefontdirectory [6] https://code.google.com/p/googlefontdirectory/ Jason

14 23

[aur-general] Another spammer
by Edvinas Valatka 18 Jun '19

18 Jun '19

https://aur.archlinux.org/account/rosaleefay

2 1