May 2021 - Aur-general - lists.archlinux.org

[aur-general] About the vuescan-bin package updating problm
by Thibault Molleman 30 May '21

30 May '21

So, I like the Vuescan app and I respect the developer for having made it. Really glad I paid for it. BUT it has to be said that installing/updating this aur package is a disaster. Basically: the download urls and/or the checksums keep changing to the point where 90% of the time when you try to update/install it, the pkgbuild is already out of date. I emailed the developer asking if he could adopt a better download url system. He replied: "No, I want people to only download VueScan from www.hamrick.com and I’m trying to figure out ways of disabling downloading from other sites." I explained to him that downloading from a repo or via a pkgbuild is such a convenient method and one of the key selling points of using Linux tbh. But haven't received an answer back (it has only been 3 days. But still). I really hope this 'issue' can somehow be resolved so people can properly install this great app without the constant cat-mouse game of trying to update the checksum fast enough. Cheers, Thibault

4 7

Re: [aur-general] Notification of GPL violation
by Manhong Dai 26 May '21

26 May '21

> Date: Thu, 20 May 2021 15:05:21 -0500 > From: "David C. Rankin" <drankinatty(a)gmail.com> > To: aur-general(a)lists.archlinux.org > Subject: Re: [aur-general] Notification of GPL violation > Message-ID: <c2e5a266-a494-7057-e4af-cbe57964c677(a)gmail.com> > Content-Type: text/plain; charset="utf-8" > > On 5/18/21 2:06 AM, Brett Cornwall via aur-general wrote: > > On 2021-05-17 21:16, Carsten Haitzler via aur-general wrote: > > > On Mon, 17 May 2021 13:32:26 +0000 lawl via aur-general > > > <aur-general(a)lists.archlinux.org> said: > > > > > > > Hello > > > > > > > > I'm the developer of NoiseTorch ( > > > > https://github.com/lawl/NoiseTorch/). > > > > I faithfully believe that the package "noisetorch" in the > > > > ArchLinux User > > > > Repository ("AUR") ( > > > > https://aur.archlinux.org/packages/noisetorch/) violates > > > > my license (GPLv3). > > > > > > > > I have the asked previous maintainer of this package to not apply > > > > patches or > > > > make it clear that this is a fork that's being conveyed. Several > > > > Arch Linux > > > > trusted users were also informed of this: > > > > https://github.com/lawl/NoiseTorch/issues/2#issuecomment-785262068 > > > > > > I am just looking at the AUR repository for this right now. It has > > > no patches. > > > It does not modify anything from the original. It builds the > > > original with > > > standard go tooling and options available in that toolchain (not > > > modifications > > > to your software) and then packages up the resulting build. The > > > only addition > > > is ADDING a .desktop file to that package archive to make it easier > > > to run the > > > application. This does not modify the software. So by your quotes > > > below it > > > meets > > > the license requirements. I don't know what was in the AUR pkg repo > > > before but > > > it certainly seems to be fine now. > > > > For anyone else wondering what the fuss is all about, this is a long- > > running > > bout of drama stirred up by the developer of Noisetorch [1]. They are > > hostile > > and will not be reasoned with, unfortunately. > > > > We are under no obligation to listen to these demands as we do not > > distribute > > the software and only supply a build script for which a user may > > build their > > own package. Kowtowing to this petulance will hardly solve the > > problem > > long-term as it is clear that *any* packages not made by the > > developer are > > treated with hostility. > > > > But I guess hashworks has already extended the olive branch; We'll > > have to see > > whether that's enough... > > > > > > [1] > > https://github.com/lawl/NoiseTorch/issues/2#issuecomment-785262068 > > I have reviewed all commits from > 811aec6641ff509bd44cd80aa872f71df502e36a > forward and there was no GPLv3 violation to begin with. The patch of > the > version is irrelevant to the operation or use of the software. > > (notwithstanding that Arch doesn't distribute anything to begin with) > > Probably kinda hard for a Go programmer to understand... > I know I will be the minority in this list. However, this statement doesn't sound right to me if the patch file is applied to the original source code. Unlike the file PKGBUILD, a patch file constitutes a modified source code because it does include some original code. No matter whether the modification is for use, or operation, or just even a typo fix, GPLV3 section 5 "Conveying Modified Source Versions" [1] doesn't distinguish them. I had a similar experience in terms of the AUR package SGE. I put my source code modification into a single patch file and put it to AUR git. Without my modification, SGE won't work with latest Linux anymore. However, due to an AUR website bug confirmed by a TU, the package was taken over without any emails sent to me. After a lot of back and force with the second maintainer, I finally gave up re-owning the package or making the software better within AUR. Instead I asked the second maintainer to add my name to the single patch file so I get the credit I deserve. However, the second maintainer denied that. He split the patch into many small patch files without my name in any of them, and insists that it is enough to have my name as the first AUR package maintainer. Then I asked him to remove my code modification, also was denied. Then I tried to ask TU to remove the package many times, all TUs denied my request, except the last TU deleted all those small patch files after he understood this is a serious copyright violation issue. Here is my understanding about those copyright conflicts. If you modified any source code, then GPL license will be applied, you have to copy the original copyright without any modification and then add yours, just as section 4 in GPL v3 says "You may convey verbatim copies of the Program's source code as you receive it" It is understandable that many AUR maintainers, or programmers like myself, don't know the details and often violates some copyright law more or less. We are lucky that most upstream programmers don't mind it. But, should such issue arise, I would do my best to make the upstream programmer happy or just find another alternative software. I know I am the minority in this list because the AUR SGE got two up- votes ironically after it didn't work anymore, and the second maintainer is even promoting the binary version based on my modification on some other repos. But, life is too short, I can live with it. I am writing this email because I just hope my painful experience can help this list know copyright better. [1] https://www.gnu.org/licenses/gpl-3.0.en.html Best, Manhong

18 54

[aur-general] Mass removal of packages.
by Derek Taylor 24 May '21

24 May '21

I received a notice that several of my suckless builds (dwm-distrotube-git, st-distrotube-git, dmenu-distrotube-git) have been deleted from the AUR due to being "for one person". That's certainly reasonable but these packages are not for one person. A lot of people use these and depend on them. Again, these builds are not for one person. What can be done about this? Thanks in advance, DT

5 4

[aur-general] Notification of GPL violation
by lawl 20 May '21

20 May '21

Hello I'm the developer of NoiseTorch (https://github.com/lawl/NoiseTorch/). I faithfully believe that the package "noisetorch" in the ArchLinux User Repository ("AUR") (https://aur.archlinux.org/packages/noisetorch/) violates my license (GPLv3). I have the asked previous maintainer of this package to not apply patches or make it clear that this is a fork that's being conveyed. Several Arch Linux trusted users were also informed of this: https://github.com/lawl/NoiseTorch/issues/2#issuecomment-785262068 Unfortunately this seemed to have little effect, forcing me to officially notify the ArchLinux project of this violation. The GPLv3 in Section 5 clearly states that modified versions must be marked as such > 5. Conveying Modified Source Versions. > > You may convey a work based on the Program, or the modifications to > produce it from the Program, in the form of source code under the > terms of section 4, provided that you also meet all of these conditions: > > a) The work must carry prominent notices stating that you modified > it, and giving a relevant date. The term conveyance is also clearly defined in the GPL: > To "propagate" a work means to do anything with it that, without > permission, would make you directly or secondarily liable for > infringement under applicable copyright law, except executing it on a > computer or modifying a private copy. Propagation includes copying, > distribution (with or without modification), making available to the > public, and in some countries other activities as well. > > To "convey" a work means any kind of propagation that enables other > parties to make or receive copies. Mere interaction with a user through > a computer network, with no transfer of a copy, is not conveying. Since AUR is distributing packages to automate the process receiving modified versions of the source code, I believe this constitutes conveyance of a modified version, irregardless of where the original source code tarball is fetched from. Please ensure the cessation of violation of the license immediately. Regards lawl Sent with [ProtonMail](https://protonmail.com) Secure Email.

14 24

[aur-general] Status of Garuda Linux PKGBUILD on AUR?
by fredbezies 13 May '21

13 May '21

Hello. I saw that packages meant for Manjaro or another archlinux based distro - not ArchLinux itself - were removed. Garuda Linux project - https://garudalinux.org/ - put on AUR at least 7 packages for its distribution. See https://aur.archlinux.org/packages/?O=0&K=garuda Are these PKGBUILDs allowed or not? Thanks for your answer. -- Frederic Bezies fredbezies(a)gmail.com

6 7

[aur-general] Status of Garuda Linux PKGBUILD on AUR?
by Pedro Henrique Lara Campos 13 May '21

13 May '21

> - mhwd, a Manjaro program that I believe assumes you're using the > Manjaro official kernel names... so if you tried to use it on Arch, it > would fail. I'm very curious about this one, as "mhwd-garuda-git" is a fork of Manjaro edited to use Arch's kernel names, as well as GPU-related packages. I know cause they asked my help at the time. Those seems to have on pkgdesc "manjaro settings manager ported to work with arch standards and limited to only dkms driver" Thanks for the hard work Eli (big fan of yours), Pedro Lara Campos Chaotic-AUR main maintainer. On 5/12/21 6:07 AM, fredbezies via aur-general wrote: >* Hello. *> >* I saw that packages meant for Manjaro or another archlinux based *>* distro - not ArchLinux itself - were removed. *> >* Garuda Linux project - https://garudalinux.org/ <https://garudalinux.org/> - put on AUR at least *>* 7 packages for its distribution. *> >* See https://aur.archlinux.org/packages/?O=0&K=garuda <https://aur.archlinux.org/packages/?O=0&K=garuda> *> >* Are these PKGBUILDs allowed or not? *> >* Thanks for your answer. * It's not a problem, inherently, for other distros to put up packages in the AUR. Those packages just have to follow the same rules everyone follows. Simply put, the AUR is the *Arch* User Repository, not the Garuda User Repository or the Manjaro User Repository or the Arch-like-derivatives User Repository. As a rule of thumb, all uploaded packages must be capable of being built on at least one supported Arch Linux system, and do something useful when installed there. So: - architecture must either be "any", or include "x86_64" - - may additionally support other distros - cannot hardcode functionality such that it assumes some other distro is in use I have no idea which packages of Garuda did not get deleted, or which packages of Manjaro did. But examples of packages that are... non-problematic: - icon/desktop themes that contain Manjaro imagery problematic: - pacman-mirrors, a program that generates mirrors for the Manjaro package repositories, which Arch systems don't use - manjaro-system, a pacman hook that does Manjaro-specific workarounds for the Arch News - mhwd, a Manjaro program that I believe assumes you're using the Manjaro official kernel names... so if you tried to use it on Arch, it would fail. -- Eli Schwartz Bug Wrangler and Trusted User

6 8

[aur-general] font-bh-ttf still on the blacklist
by stefan-husmann＠t-online.de 12 May '21

12 May '21

Hello TUs, the PKGBUILD for font-bh-ttf still seems to be on the [extra]-blacklist. Remote: error: package already provided by [extra]: font-bh-ttf But the package is not / no longer in [extra]. Please consider this. Best Regards Stefan Husmann

3 4

[aur-general] Status of Garuda Linux PKGBUILD on AUR?
by Pedro Henrique Lara Campos 12 May '21

12 May '21

> Some days ago, chaotic keyring - repository of Garuda Linux - was removed. So, these packages could be remove too. Please, chaotic-aur is an archlinux-targeted unofficial repository. GarudaLinux is merely allowed by me to use it for distribution of packages that will work in any ArchLinux-based setup. As we also receive contributions for BlackArch, ArcoLinux, and once received from ArchLinuxCN. I'll be glad if you don't mention my repository in this, or any other discussion, as it has nothing to do with AUR or ArchLinux-project as stated in https://lists.archlinux.org/pipermail/aur-requests/2021-May/052472.html. Thanks for the hard work, Pedro Lara Campos Chaotic-AUR main maintainer. Le mer. 12 mai 2021 à 18:45, Ralf Mardorf via aur-general <aur-general at lists.archlinux.org <https://lists.archlinux.org/listinfo/aur-general>> a écrit : >>* On Wed, 12 May 2021 12:07:49 +0200, fredbezies via aur-general wrote: *>* >I saw that packages meant for Manjaro or another archlinux based *>* >distro - not ArchLinux itself - were removed. *>>* Were they removed because they were Manjaro related or for some other *>* reason? * As far as I remember, they were Manjaro related, like mhwd (Manjaro Hardware Detection) tools or something like this. >>* "FAQ *>* What kind of packages are permitted on the AUR? *>>* The packages on the AUR are merely "build scripts", i.e. recipes to *>* build binaries for pacman. For most cases, everything is permitted, *>* subject to usefulness and scope guidelines, as long as you are in *>* compliance with the licensing terms of the content. For other cases, *>* where it is mentioned that "you may not link" to downloads, i.e. *>* contents that are not redistributable, you may only use the file name *>* itself as the source. This means and requires that users already have *>* the restricted source in the build directory prior to building the *>* package. When in doubt, ask." - *>* https://wiki.archlinux.org/title/Arch_User_Repository#FAQ <https://wiki.archlinux.org/title/Arch_User_Repository#FAQ> * Well, I'm not sure what to think about them. Some are forks for manjaro tools (like mhwd). So are they "legal" on AUR? Some days ago, chaotic keyring - repository of Garuda Linux - was removed. So, these packages could be remove too. >>* https://wiki.archlinux.org/title/AUR_submission_guidelines#Rules_of_submiss… <https://wiki.archlinux.org/title/AUR_submission_guidelines#Rules_of_submiss…> *>>* Btw. https://aur.archlinux.org/packages/apt/ <https://aur.archlinux.org/packages/apt/> * I'm just asking what trusted users think about these packages. Nothing less, nothing more. -- Frederic Beziesfredbezies at gmail.com <https://lists.archlinux.org/listinfo/aur-general> ------------------------------

1 0

[aur-general] AUR mass deletion, why?
by Fabian Bornschein 05 May '21

05 May '21

4 9

[aur-general] TU application: grawlinson
by George Rawlinson 03 May '21

03 May '21

Hello everyone! My name is George Rawlinson (grawlinson), and I am applying to be a Trusted User. My sponsors are Morten Linderud (Foxboron) and Sven-Hendrik Haase (svenstaro). They have evaluated my PKGBUILDs and quickly come to the conclusion that they are considered a crime against humanity, but feel free to offer your own opinions. Feedback is always great! Especially if there's something I've overlooked. I've been distro hopping too many times to count, but have comfortably settled on Arch Linux since circa 2015. I have always loved tinkering with software, and Linux provides one of the best ecosystems for that. It all started back in 2009 when I started self-hosting my mail domain(s) on a Debian VPS, which was migrated over to Arch once I became proficient/comfortable enough. My Arch-specific installations have since ballooned from that one VPS to an ex-enterprise server at home, running a large set of LXD containers that provide a variety of services to make my life somewhat easier. I maintain my own pacman repository for convenience; it is essentially a private git repository made up of git submodules (for AUR packages) as well as forked/new packages. To make maintenance easier I extensively rely on nvchecker, to keep on top of new releases. aurutils/devtools to build/test packages in a clean chroot. Additionally, namcap helps me figure out when I've invoked Cthulhu. Contributions: - Maintainer of some AUR packages since 2016[0] - Hosted a Tier-2 mirror from 2017[1] to 2019[2] on a Hetzner VPS - Flung some patches at the namcap & infrastructure repos - Filed bug reports/patches for various upstream projects and on the Arch bug tracker - Member of the Arch Testing Team since sometime last year (2020) Packages to (hopefully) transfer to community: - distrobuilder (would be co-maintained with Foxboron) - promscale & promscale_extension - prometheus-apcupsd-exporter - prometheus-snmp-exporter - prometheus-ipmi-exporter (and its freeipmi dependency, which I also co-maintain) There are some things I'd like to become more involved in: - Monitoring the bug tracker for issues that I can help with - Co-maintaining some LX{C,D} and Prometheus/Timescale related packages - Learning more about the overall tasks that TUs perform so I can decide where I can best focus my efforts. It all comes down to Arch having made such a positive impact in my life, and I believe it is past due that I start contributing back. Regards, George Rawlinson [0]: https://aur.archlinux.org/packages/?SeB=M&K=grawlinson [1]: https://bugs.archlinux.org/task/52852 [2]: https://lists.archlinux.org/pipermail/arch-mirrors-announce/2019-May/000033…

5 9