July 2023 - Aur-general - lists.archlinux.org

[aur-general] TU rename Bylaws amendment vote
by Konstantin Gizdov 25 Oct '23

25 Oct '23

Hi, As per the TU Bylaws following the discussion to rename the Truster Users [1], the Trusted Users themselves must vote to approve the renaming. Hence, please, cast your vote on whether you agree the Bylaws be amended and the "Trusted User" role is renamed into "Package Maintainer". Vote is located at - https://aur.archlinux.org/tu/140 -- Regards, Konstantin [1] - https://gitlab.archlinux.org/archlinux/rfcs/-/merge_requests/7

2 6

Applying for maintainer role
by Tomaz Canabrava 16 Aug '23

16 Aug '23

Hello, My name is Tomaz Canabrava, Im a kde developer and mostly focus on Konsole. Other than that, I use arch Linux for the past 10 years, as my only Linux distro. I have experience with packaging (debian, for work) but not on arch, but it’s shell and that thing I can handle :) My sponsors are Gian and Antonio Rojas. This is not gpg signed and I’m sorry for that, but gian and Antonio can also vouch for me as the validity of this email. Best, Tomaz - kde ev member

14 33

AUR package naming for Java packages (was: [PRQ#42786] Deletion Request for autopsy-bin Rejected)
by Chih-Hsuan Yen 05 Aug '23

05 Aug '23

Thank you for bringing this up. Current guidelines for packages using prebuilt binaries, which are added in 2019 [1], are indeed unclear about Java packages. Literally, there is no rule about whether such Java packages should use a package name with "-bin" suffix or not. I propose to require the "-bin" suffix for new Java package using prebuilt binaries while allow existing packages without the "-bin" suffix (i.e., no need to submit deletion/merge requests for them). A modified rule can be: * Packages that use '''prebuilt''' [[wikipedia:Deliverable|deliverables]], when the sources are available, must use the {{ic|-bin}} suffix. An exception to this is with [[Java package guidelines#Java packaging on Arch Linux|Java]], where new Java packages using prebuilt binaries must use the {{ic|-bin}} suffix, while existing such packages without the {{ic|-bin}} suffix are allowed. The AUR should not contain the binary tarball created by makepkg, nor should it contain the filelist. Any opinions? [1] https://wiki.archlinux.org/index.php?diff=572792 Best, Chih-Hsuan Yen (yan12125) ---------- Forwarded message --------- 寄件者： Marcell Meszaros <marcell.meszaros(a)runbox.eu> Date: 2023年7月30日週日下午10:00 Subject: Re: [PRQ#42786] Deletion Request for autopsy-bin Rejected To: Chih-Hsuan Yen <yan12125(a)archlinux.org>, <aur-requests(a)lists.archlinux.org> Cc: <contact(a)lsferreira.net> >autopsy-bin is a better package name for a package built from >binaries. In that case, please kindly revise the AUR submission guidelines, because currently it explicitly mentions Java as an exception to the '-bin' name suffix requirement. [a] " * Packages that use prebuilt deliverables, when the sources are available, must use the -bin suffix. An exception to this is with Java. " [a]: https://wiki.archlinux.org/title/AUR_submission_guidelines#Rules_of_submiss… On 30 July 2023 15:26:43 GMT+02:00, Chih-Hsuan Yen <yan12125(a)archlinux.org> wrote: >Marcell Meszaros <marcell.meszaros(a)runbox.eu> 於 2023年7月30日週日下午6:20寫道： >> >> @yan12125, why did you reject the deletion request for this duplicate? >> >> AUR/autopsy also uses the precompiled Java bytecode as source. >> >> So the two packages are truly duplicates, the only difference is that autopsy-bin is 1 year older and flagged OOD for that period. >> >> On 30 July 2023 11:05:20 GMT+02:00, notify(a)aur.archlinux.org wrote: >> >Request #42786 has been Rejected by yan12125 [1]: >> > >> >> This is a java application so the >> >suffix '-bin' is not necessary anyway. >> > >> >Java packages can be either built from sources or binaries as well. >> > >> >[1] https://aur.archlinux.org/account/yan12125/ > >autopsy-bin is a better package name for a package built from >binaries. Therefore, orphaning and updating autospy-bin is better than >deleting autospy-bin. After that, autospy can be merged into >autospy-bin in case it is not changed to be built from sources. > >Best, > >Chih-Hsuan Yen (yan12125)

3 3

unable to build with makepkg (No such file or directory)
by james smith 29 Jul '23

29 Jul '23

trying to build this https://github.com/matthewq337/auto-fdisk https://bpa.st/H6XQ

5 4

Fwd: Re: unable to build with makepkg (No such file or directory)
by Robin Candau 29 Jul '23

29 Jul '23

Forwarding my answer to the ML -------- Message transféré -------- Sujet : Re: unable to build with makepkg (No such file or directory) Date : Sat, 29 Jul 2023 18:05:03 +0200 De : Robin Candau <antiz(a)archlinux.org> Pour : james smith <cinemassacres(a)gmail.com> Le 29/07/2023 à 17:45, james smith a écrit : > trying to build this https://github.com/matthewq337/auto-fdisk > <https://github.com/matthewq337/auto-fdisk> https://bpa.st/H6XQ > <https://bpa.st/H6XQ> Hi, Can you provide a bit more details? You can provide the output of `makepkg` for instance. On a side note, by quickly looking at your PKGBUILD, I can see a bunch of issue: - Your PKGBUILD seems to build a VCS package. Your pkgname has to reflect that by adopting a `-git` suffix. - The "source." prefix in your pkgver is un-necessary. - Auto-fdisk is licensed under the MIT license so it has to be packaged by the PKGBUILD. See the first bullet point of the related wiki "license" chapter for more details [1]. - The package should depend on `bash` rather than `sh`. For what it's worth, bash being a member of the `base` metapackage [2], you don't even have to list it as a dependency if you prefer, as the `base` metapackage is assumed installed at runtime. - Missing `git` as a makedepends. And, most importantly, why did you fork the upstream project [3] and deliver your fork in the PKGBUILD [4] instead of relying on the actual upstream repo [5] directly? Is there any particular reason for that? [1] https://wiki.archlinux.org/title/PKGBUILD#license [2] https://archlinux.org/packages/core/any/base/ [3] https://github.com/matthewq337/auto-fdisk [4] https://bpa.st/H6XQ#1L7-L7 [5] https://github.com/ivmm/Auto-fdisk -- Regards, Robin Candau / Antiz

1 0

[PATCH] /etc/ld.so.conf.d
by Masato TOYOSHIMA 23 Jul '23

23 Jul '23

add /etc/ld.so.conf.d/libressl.conf --- PKGBUILD | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/PKGBUILD b/PKGBUILD index ec9caae..f3dc5f7 100644 --- a/PKGBUILD +++ b/PKGBUILD @@ -7,7 +7,7 @@ pkgname=libressl pkgver=3.7.3 -pkgrel=1 +pkgrel=2 pkgdesc="Free version of the TLS/crypto stack forked from OpenSSL" arch=(x86_64) url="https://www.libressl.org/" @@ -47,6 +47,9 @@ package() { make DESTDIR="${pkgdir}" install install -Dm644 COPYING -t "${pkgdir}"/usr/share/licenses/${pkgname}/ + mkdir -p "${pkgdir}/etc/ld.so.conf.d" + echo "/usr/lib/libressl" > "${pkgdir}/etc/ld.so.conf.d/libressl.conf" + # Remove symlink man pages that point to OpenSSL ones since the prefix is not accounted for for manlink in $(find -L "${pkgdir}"/usr/share/man/man3/ -type l) ; do -- 2.41.0

1 0

Why are patches submitted via email?
by Adam Labus 18 Jul '23

18 Jul '23

Hi, quick question: Why aren't pull requests made directly on gitlab/somewhere on the site, but instead are sent over email. Even from the human aspect, I think most devs want to track their "ego points" in the form of how many merges they made. Or is it just me who is doing it wrong and I should put patches into comments instead?

5 4

Re: Applying for maintainer role
by Tomaz Canabrava 17 Jul '23

17 Jul '23

Hello Carsten, On Mon, 17 Jul 2023 at 11:41 Carsten Haitzler <raster(a)archlinux.org> wrote: > On Mon, 17 Jul 2023 10:44:37 +0300 Tomaz Canabrava <tcanabrava(a)kde.org> > said: > > > On Mon, 17 Jul 2023 at 10:25 Jonathan Steel <jsteel(a)archlinux.org> > wrote: > > > > > On Sun 16 Jul 2023 at 15:37, Tomaz Canabrava wrote: > > > > I have experience with packaging (debian, for work) but not on arch, > but > > > > it’s shell and that thing I can handle :) > > > > > > Why not show this by maintaining some air packages? > > > > > > Mostly because there is nothing in aur that I use that lacks a > maintainer. > > But I do have a software that is not packaged yet that I can port to aur. > > > > > > > > > > This is not gpg signed and I’m sorry for that, but gian and Antonio > can > > > > also vouch for me as the validity of this email. > > > > > > Why is it not signed? > > > > > > Because I don’t have a gpg key, and when the dkim features on the email > > already are enough to validate that the email I send is from me. > > > > > > > > > > I think you should read https://wiki.archlinux.org/title/Trusted_Users > and > > > re-submit a signed application showing the minimum requirements are > met. > > > > > > I have read the wiki and I have applied to a packager position following > > the wiki rules or explaining why I didn’t follow a part of it, i won’t > > re-apply because that’s a waste of everyone’s time just for the sake of > > ticking boxes. > > > > Summary: > > - [x] known on the opensource community with multiple, and used, > programs > > - [x] packaging experience > > - [ ] aur / arch package experience > > - [x] contributes directly to upstream > > - [ ] signed the mail with gpg > > Then I would reject your application as you don't plan to re-try with a > PGP key > and don't even have one. > > A PGP key is used to show that it was YOU and not someone else that signed > a > package is a basic requirement of maintaining packages on Arch. That has > nothing to do with dkim or email. You'll need a PGP key for other things > and if > you don't have one, you can't maintain packages. Signing your email with a > PGP > key at least shows you have one and can use it for some basic things. As > you're > clear you don't have one and have no intention of showing you do by > re-applying > with a signed email I can't see how you would be able to maintain packages. > > In addition, you don't have any packaging experience on Arch. The first > step > is AUR. Get your feet wet somewhere that is simpler like AUR. I would > suggest > you get some experience there first before you have to deal with submitting > community etc. packages that actually have more layers of work to be done > over > and above what AUR needs, so AUR "work" is like learning the first 50% of > what > is needed. > > I think it'd be great if you did arrange to have a PGP key, showed us you > have > one by signing an application after you've done some AUR packaging for a > bit. > > This is what I did - I maintained some AUR packages for a while then > expanded > the number I work on and eventually applied to maintain more "core" > packages > because I too an am upstream. > > I'm not one of these "I must PGP sign everything" people. I'm not that > security-focused about my utterances by e-mail, but I do see the point of > it > for packaging and I jumped through the hoops to deal with it. > > I get your feeling of "Why bother - it's just an email", but it's a > necessary > component in the packaging pipeline and ecosystem. You're not expected to > be > some PGP guru. You're just expected to be able to sign some package to say > it > was you that packaged it an that requires you do "jump through some hoops" > at > this stage. I hope you'll reconsider. That’s completely understandable. Today I’ll create an aur component for Codevis, a software to visualize large architectures Im developing for the past three years (that just got opensourced) And I’ll also create a GPG key, and sign some email on this thread with it. Best, Tomaz > > > > -- > Carsten Haitzler <raster(a)archlinux.org> >

1 1

nvidia-470xx packages broken and maintainers don't react, how to proceed with this?
by Michael Kogan 09 Jul '23

09 Jul '23

Hello list! Currently the nvidia-470 packages [1] are broken and there is no reaction from the packages' maintainers. They did an absolutely awesome job by keeping the packages alive for a really long time and guaranteed absolutely smooth upgrades, but for some reason they currently don't react to out-of-date requests. The current situation is that the kernel module's compilation is broken, but the package still builds and installs, making the machine fallback to TTY after an update. There seem to be patches in the comments but they are tedious to use in a TTY only environment, so it would be great if some of the guys who provided the patches would be added as co-maintainer such that the patches can be included into the package. Best, Michael [1] https://aur.archlinux.org/packages/nvidia-470xx-dkms

3 4

Fwd: vte-git, vte-common and toxic trolls
by Pellegrino Prevete 05 Jul '23

05 Jul '23

---------- Forwarded message --------- Da: Pellegrino Prevete <pellegrinoprevete(a)gmail.com> Date: mar 4 lug 2023 alle ore 19:56 Subject: Re: vte-git, vte-common and toxic trolls To: Robin Candau <antiz(a)archlinux.org> Il giorno mar 4 lug 2023 alle ore 08:30 Robin Candau <antiz(a)archlinux.org> ha scritto: > Le 04/07/2023 à 03:30, Pellegrino Prevete a écrit : > > Hello, > > Hi, > > upstream ('extra' repo), at some point the vte3 package has been split > into vte-common, vte3 and vte4. > vte3 and vte4 do not conflict and they both depend on vte-common. > > On the aur, the vte3-git package was recently orphaned and was adopted by > that absurd guy I had the misfortune to interact with a couple months ago > already. > > You know, the one who has kept its obscene insults towards me online in > that package comments without any shame. > > So, this person hoards both vte3-git and vte4-git and keeps them > conflicting. > > I've reviewed every comments of the vte3-git and vte4-git AUR package and > I couldn't find the "obscene insults" you're referring to. > If you have legit evidence of such obscene insults, please provide them so > we can act accordingly. > This happened in sushi-git. He has far deleted the original comment but it can still be read in a following message. https://aur.archlinux.org/packages/sushi-git?O=0#comment-913784 The same trusted user (gromit) who is letting him keep his conflicting package, also accepted his orphan request and gave him the package a day after I upgraded it. In general I'd like to say it's really frustrating people on the AUR isn't usually easily aware of the work other users are currently doing on the repository. I am sure xiota would have been way less angry if he could have justified his wait on his own by looking at what I was doing meanwhile. > Now a couple days ago even a trusted user intervened erroneously; I assume > he didn't pay much attention to dates or changes upstream. > > That trusted user didn't intervened erroneously. Merging vte{3,4}-git into > vte-git will actually break the latter as vte-git depends on both of them > [1] [2]. > I am the author of vte-git, so what you say doesn't make sense. vte-git is a package I made to show good will to xiota in correctly splitting the package and it's "broken" because I also sent him patches to apply to make his package non-conflicting (vte3-git shouldn't conflict with vte4-git) and I was waiting for him to apply them; they are in the comments. But at this point I don't think it's useful to discuss it further, so I am gonna adopt the following structure for vte-git to overcome this issue entirely: pkgbase: vte-git pkgname: vte-git -> provides vte4-git, vte4 -> depends on vte-common-git pkgname: vtethree-git -> provides vte3-git, vte3 -> depends on vte-common-git > That and the fact that the latest merge request you made for vte4-git [3] > claims "[...] also maintainership won't be lost with merge." makes me think > that you don't know how merge requests actually works [4]. > > What's happening bothers me to the point I think I'd like to ask two of > you to act as trustees for a TU election round. > > So you basically want to apply as a TU for the sole purpose of having > "enough power" to solve this personal war yourself? > No, I want to apply as TU because I find absurd it is possible for a random user to: - insult me - take a package from me after it with the permission of a TU - adopt a dependency I need to upgrade a package - refusing to upgrade it - reporting and making look like my packages were not working instead all of this without anyone ever referring the patches I sent him, no one saying what the issue is, and overall making me lose a lot of time, so that I have to republish the package entirely to just have a change from upstream brought to the aur. > I don't think "being bothered enough by this to the point you'd like to > apply as a TU" on its own is a legit reason that will get two of us to > consider a sponsoring. > Clearly it's not the main reason to sponsor me for being a TU. > I maintain around 700 packages and I will maintain way more very soon. > > There's no competition here. Maintaining a lot of packages doesn't give > you more "power" or "legitimacy" than another. > Maintaining many (widely used) packages is indeed a great power which gives legitimacy to the one who bears it, because it can be assumed there would be people who would be damaged from a sudden, huge, rogue upgrade. It's more difficult you come to expect that from someone who maintains many packages, works with his real identity and works with many projects. You easily expect that from an contributor you never his name before. > Please, maintain packages you have the time and interest to maintain, not > just for the sake of having "way more very soon". > I am gonna maintain way more packages because I want arch users to enjoy way more packages. I do what I do just because no one else is doing it and I want it sooner. > > To be honest, it's disappointing how this whole story turned into a > personal war at the expense of the legitimacy of the requests. > Actually I still don't understand what's the issue in doing as upstream, which is what I am proposing from the beginning. > Submitting orphan requests for *poor* reasons like "This person shouldn't > maintain this package" without any additional details [5] [6] is not what > orphan requests are for and are a waste of time for moderators that treat > them. > This person shouldn't maintain this package because he complains about inexistent issues and apparently he wants users to keep building the same software two times. > I'd like *both you and xiota* to behave correctly by dropping this > personal war behind and by submitting legitimately motivated requests. > After he insulted me and adopted this toxic behaviour I gave him an hand by preparing for him the vte-git package and the relative packages for him to merge to make everything compatible even if it didn't want to have a single pkgbase. I am still complaining about this user because at this point because no one has really justified the decision of why it should be okay to keep vte3-git and vte4-git overlapping and conflicting. > [1] https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=vte-git#n137 > [2] https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=vte-git#n138 > [3] > https://lists.archlinux.org/archives/list/aur-requests@lists.archlinux.org/… > [4] https://wiki.archlinux.org/title/AUR_submission_guidelines#Merge > [5] > https://lists.archlinux.org/archives/list/aur-requests@lists.archlinux.org/… > [6] > https://lists.archlinux.org/archives/list/aur-requests@lists.archlinux.org/… > > -- > Regards, > Robin Candau / Antiz > >

2 1