July 2025 - Aur-general - lists.archlinux.org

Possible malicous PKGBUILD
by Lex Black 29 Jul '25

29 Jul '25

Hi Will only be able top later create a deletion requests for a package, but maybe someone else wants to step up? https://aur.archlinux.org/packages/gdox Not a really stealthy and working approach to do harm, but such a PKGBUILD shouldn't stay up in my opinion. Best regards

2 1

Package Maintainer application
by Martin Rys 29 Jul '25

29 Jul '25

Hi, my name's Martin, you can more often find me under "C0rn3j". Professionally, I work as a DevOps, and in my free time I do things I've most recently stumbled upon, which usually has to do with FOSS. I've been using Arch for about a decade, I mostly hang out in the unofficial Telegram group*, which I help moderate. I sometimes contribute to the Wiki, send patches over GitLab when relevant, or otherwise participate in discussions if I happen to see anything I can add my two cents to. I've been maintaining a random assortment of things in the AUR, a lot of the times simply because I was using a package that the previous maintainer disowned, and I figured I might pick up the torch. Which brings me to why I want to become a PM - I would like to see some of the things I currently maintain in the official repositories, such as sc-controller** or Tauon**, and to help out with the maintenance in general. I use ALARM on some of my devices too, so I'd possibly like to help out with the porting efforts to Arch in the future, when that becomes relevant. I've attached links to my accounts and also my personal site below. My sponsors are Gian (grazzolini) and Tomaz Canabrava. Special thanks goes out to Muflone for additional packaging feedback. I think that covers everything necessary, have a good day and I hope you'll consider my application! * https://t.me/archlinuxgroup ** https://github.com/Taiko2k/Tauon ** https://github.com/C0rn3j/sc-controller https://aur.archlinux.org/account/c0rn3j https://gitlab.archlinux.org/c0rn3j https://github.com/C0rn3j https://gitlab.com/C0rn3j https://rys.rs/ - GPG key used for signing is also present here

7 8

Re: Package Maintainer application
by Giancarlo Razzolini 28 Jul '25

28 Jul '25

Excerpts from Martin Rys's message of julho 24, 2025 12:26 pm: > Hi, > > my name's Martin, you can more often find me under "C0rn3j". > Professionally, I work as a DevOps, and in my free time I do things I've > most recently stumbled upon, which usually has to do with FOSS. > > I've been using Arch for about a decade, I mostly hang out in the > unofficial Telegram group*, which I help moderate. > > I sometimes contribute to the Wiki, send patches over GitLab when > relevant, or otherwise participate in discussions if I happen to see > anything I can add my two cents to. > > I've been maintaining a random assortment of things in the AUR, a lot of > the times simply because I was using a package that the previous > maintainer disowned, and I figured I might pick up the torch. > > Which brings me to why I want to become a PM - I would like to see some > of the things I currently maintain in the official repositories, such as > sc-controller** or Tauon**, and to help out with the maintenance in general. > > I use ALARM on some of my devices too, so I'd possibly like to help out > with the porting efforts to Arch in the future, when that becomes relevant. > > I've attached links to my accounts and also my personal site below. > > My sponsors are Gian (grazzolini) and Tomaz Canabrava. > Special thanks goes out to Muflone for additional packaging feedback. > > I think that covers everything necessary, have a good day and I hope > you'll consider my application! > > * https://t.me/archlinuxgroup > ** https://github.com/Taiko2k/Tauon > ** https://github.com/C0rn3j/sc-controller > > https://aur.archlinux.org/account/c0rn3j > https://gitlab.archlinux.org/c0rn3j > https://github.com/C0rn3j > https://gitlab.com/C0rn3j > https://rys.rs/ - GPG key used for signing is also present here > > Hi All, I was away from my GPG key during the weeked, so I couldn't send the signed email before. I have been bugging Martin to join the staff as a package maintainer for years now. Not only he has been super helpful to a lot of Arch users, but he opens a ton of issues and contribute to a lot of projects. One being pipewire, for example. I confirm my sponsorship. Regards, Giancarlo Razzolini

3 2

Command in DLAGENTS works in shell but not in makepkg
by Aaron Liu 22 Jul '25

22 Jul '25

Hey, Part of a PKGBUILD I'm trying to make looks like this: source=(Lark-linux_x64-${pkgver}.deb::https://www.larksuite.com/api/package… DLAGENTS=("https::/usr/bin/sh -c curl\ -LO\ \"\$$curl\ \'%u\'\ \|\ grep\ -oP\ \'\(\?\<=\"download_link\":\"$\[\^\"\]\*\'\ --\ \|\ sed\ \'s/\\\\u0026/\\\&/g\'\ --\)\"") The command (/usr/bin/sh...) works when I run it in my shell, but not when I run makepkg on the PKGBUILD. Any help would be really, really appreciated. I don't even know how to make makepkg tell me what command it runs, and even that would be nice. -- Cheers, Aᴀʀᴏɴ

1 1

Re: [SECURITY] firefox-patch-bin, librewolf-fix-bin and zen-browser-patched-bin AUR packages contain malware
by Shay Gover 19 Jul '25

19 Jul '25

Hi Quentin, Can you send us the packages description so we can identify other attempts in the future? Thanks Shay Date: Fri, 18 Jul 2025 18:53:19 +0200 > From: Quentin MICHAUD <mh4ckt3mh4ckt1c4s(a)archlinux.org> > Subject: [SECURITY] firefox-patch-bin, librewolf-fix-bin and > zen-browser-patched-bin AUR packages contain malware > To: aur-general(a)lists.archlinux.org > Message-ID: <4156647e-59ab-4026-9778-19d7cda6d4bc(a)archlinux.org> > Content-Type: text/plain; charset=UTF-8; format=flowed > > On the 16th of July, at around 8pm UTC+2, a malicious AUR package was > uploaded to the AUR. Two other malicious packages were uploaded by the > same user a few hours later. These packages were installing a script > coming from the same GitHub repository that was identified as a Remote > Access Trojan (RAT). > > The affected malicious packages are: > > - librewolf-fix-bin > - firefox-patch-bin > - zen-browser-patched-bin > > The Arch Linux team addressed the issue as soon as they became aware of > the situation. As of today, 18th of July, at around 6pm UTC+2, the > offending packages have been deleted from the AUR. > > We strongly encourage users that may have installed one of these > packages to remove them from their system and to take the necessary > measures in order to ensure they were not compromised. >

1 0

[SECURITY] firefox-patch-bin, librewolf-fix-bin and zen-browser-patched-bin AUR packages contain malware
by Quentin MICHAUD 18 Jul '25

18 Jul '25

On the 16th of July, at around 8pm UTC+2, a malicious AUR package was uploaded to the AUR. Two other malicious packages were uploaded by the same user a few hours later. These packages were installing a script coming from the same GitHub repository that was identified as a Remote Access Trojan (RAT). The affected malicious packages are: - librewolf-fix-bin - firefox-patch-bin - zen-browser-patched-bin The Arch Linux team addressed the issue as soon as they became aware of the situation. As of today, 18th of July, at around 6pm UTC+2, the offending packages have been deleted from the AUR. We strongly encourage users that may have installed one of these packages to remove them from their system and to take the necessary measures in order to ensure they were not compromised.

1 0

A nightmare in nesting for DLAGENTS
by Aaron Liu 08 Jul '25

08 Jul '25

Ey, A package recently started making their download links be dynamically-generated and expire. I've found that the download link can be gotten through `curl 'https://www.larksuite.com/api/package_info?platform=10' | grep -oP '(?<="download_link":")[^"]*' --`. I've decided to implement this into the package through setting source to the API link and specifying DLAGENTS. However, I'm having trouble wrangling the quotes. Currently, I have DLAGENTS=('https::/bin/sh -c '\''curl -LO $(curl -s %u | grep -oP "(?<=\"download_link\":\")[^"]*")'\'''). The shell complains -LO: -c: line 1: unexpected EOF while looking for matching `''. (I'm not using jq because 1. it's an extra makedepends 2. I tried replacing the grep part with `jq -r .download_link` and it changes nothing.) I've been working at different ways of expressing this for a while now and all I've managed to change is which kind of quotation mark the shell complains about. Any ideas? -- Cheers, Aᴀʀᴏɴ

1 1