October 2026 - Aur-general - lists.archlinux.org

AUR
by WebDawg 16 Oct '26

16 Oct '26

Hello, Is their a public document that defines the governence around decisions surrounding the AUR and it's associated work? I understand this is a volunteer driven project but I was just trying to comprehend how the governance works today. Thanks in advance, WebDawg

5 5

AUR New Account Registration
by Garrett 16 Oct '26

16 Oct '26

Hello all, The AUR new account registrations have been closed for months now. All inquiries are met with "there is no manual process." No path forward has been published, and discussions in this forum for how to harden the AUR have not resulted in concrete steps. I say this not as a criticism, but as a statement of fact. We are currently in a place where account registrations are disabled indefinitely with no "next step" defined. I assume that we can all agree that account registration should be reopened at some point. So my questions are these: What needs to be true to reopen account registrations? Who is working on it? Can they communicate the status of their work? Is there a path forward for new accounts to be created in some way that is not simply turning the registration page back on? Manual verification, sponsorship, probation of some kind? From an outsider's perspective, it seems that what needs to be true is to plan and execute a way to harden the AUR against bad actors. It does not seem that a plan has been agreed to, or that anyone is currently working on it. I'm not saying this is true, I'm saying this is what *seems to be the case* to someone who only knows what is stated in this forum. If work is being done on this, and it has been communicated, I apologize. If work is being done on this, and it has not been communicated, I respectfully suggest that some kind of communication be made. Regardless of whether that is the case, an interim solution should be implemented. Manual verification of new users is no one's ideal, but perhaps it could be used until a better solution is found. No one should expect the Arch TU/PM team to do this in addition to their other responsibilities, but perhaps they can delegate this task to a team of volunteers. I would certainly be happy to donate some time to this. -- Regards, Garrett “Life doesn’t give us purpose. We give life purpose.” --Bartholomew Henry Allen

2 1

Keep in topic - Warning
by Leonidas Spyropoulos 15 Oct '26

15 Oct '26

Hi, Please keep the ML emails for AUR related discussions. Generic talk and other topics are not part of this. This is the last warning before ML goes into moderation mode. Thank you for your understanding Leonidas

1 0

Final unsubscribe request
by hunabku＠gmx.com 15 Oct '26

15 Oct '26

Hello, I have twice requested to be removed from your mailing list, without success. I ask that you immediately stop sending emails to hunabku(a)gmx.com and confirm its removal. If the messages continue, I will mark them all as spam and forward my complaint to the relevant authority. Regards, hunabku

16 27

hundreds of aur packages were mass uploaded with malware
by James Smith 14 Oct '26

14 Oct '26

the user marchos1as[1] typo squated popular packages eg yay/paru [1] https://aur.archlinux.org/packages?K=marchos1as&SeB=m

5 5

Seeking guidance on maintaining the Mullvad Browser AUR package
by Gabriel Jesus 14 Oct '26

14 Oct '26

Hello, My name is Gabriel Jesus, and I am an Arch Linux user interested in contributing to the AUR by maintaining the Mullvad Browser package. I noticed that the existing mullvad-browser AUR package appears to be outdated, while the official Mullvad Browser project continues to release new versions. I have created a community packaging project for Arch Linux using official upstream releases, SHA-256 checksum validation, and OpenPGP signature verification. GitHub repository: https://github.com/gabrielsecarch/mullvad-browser I have built and tested the package on my Arch Linux system, and the browser launches successfully. I would appreciate feedback on the PKGBUILD and any improvements needed to follow Arch Linux packaging standards. I also noticed that new AUR account registrations are temporarily suspended. I do not want to create a duplicate package or bypass AUR policies. Could you please advise me on the appropriate way to pursue maintenance of the existing mullvad-browser package while new account registrations remain closed? Thank you for your time and guidance. Best regards, Gabriel Jesus GitHub: https://github.com/gabrielsecarch

2 1

support from maintainers for amending author in aur package
by Ueue 11 Oct '26

11 Oct '26

hello For legal/privacy reason I would like to amend the author in one package that i maintain on aur. Can I have support from a maintainer with force push permission? Thank you very much ueue

2 1

[PATCH] tcping: modernize PKGBUILD to pep517 and add license
by Frank Pereny 10 Oct '26

10 Oct '26

Hello aur-general list, I have modernized the orphaned `tcping` package to use the current Arch Linux PEP 517 python packaging standards (python-build and python-installer) instead of the deprecated setup.py workflow. Additionally, I have updated the .SRCINFO metadata, bumped pkgrel to 2, and explicitly added the installation steps for the missing MIT LICENSE file. The unified diff is provided below. Regards, Frank Pereny diff --git a/.SRCINFO b/.SRCINFO index c716c25..6488a0e 100644 --- a/.SRCINFO +++ b/.SRCINFO @@ -1,16 +1,21 @@ pkgbase = tcping pkgdesc = Just like icmp ping pkgver = 0.1.1rc1 - pkgrel = 1 + pkgrel = 2 url = https://github.com/zhengxiaowai/tcping arch = any license = MIT makedepends = python-setuptools + makedepends = python-build + makedepends = python-installer + makedepends = python-wheel + depends = python depends = python-click depends = python-prettytable depends = python-six source = https://files.pythonhosted.org/packages/2a/a1/7e8ac7d81a1a89b1cdb8200fee2c0… + source = LICENSE::https://raw.githubusercontent.com/zhengxiaowai/tcping/refs/heads/m… sha256sums = 557d5e928601e5a31e55abe20c6b9fff18bdc74a1e1d620d6b28b2f7c7a26606 + sha256sums = a5d77ee8f21b686eb9f7fe44783c5f17a987b7efe04151da5a12e31a42fd1568 pkgname = tcping - diff --git a/PKGBUILD b/PKGBUILD index 46903db..1c43875 100644 --- a/PKGBUILD +++ b/PKGBUILD @@ -1,25 +1,29 @@ -# Contributor(s): xgdgsc <xgdgsc(a)gmail.com> -# Maintainer: Bruce Zhang <zttt183525594(a)gmail.com> +# Maintainer: Frank Pereny <fjpereny(a)gmail.com> +# Contributor: Bruce Zhang <zttt183525594(a)gmail.com> +# Contributor: xgdgsc <xgdgsc(a)gmail.com> pkgname=tcping pkgver=0.1.1rc1 -pkgrel=1 +pkgrel=2 pkgpath='2a/a1/7e8ac7d81a1a89b1cdb8200fee2c0779410a63743806213cb9289ab6ee94' pkgdesc="Just like icmp ping" arch=('any') url="https://github.com/zhengxiaowai/tcping" license=('MIT') -depends=('python-click' 'python-prettytable' 'python-six') -makedepends=('python-setuptools') -source=("https://files.pythonhosted.org/packages/${pkgpath}/tcping-${pkgver}.tar.gz") -sha256sums=('557d5e928601e5a31e55abe20c6b9fff18bdc74a1e1d620d6b28b2f7c7a26606') +depends=('python' 'python-click' 'python-prettytable' 'python-six') +makedepends=('python-setuptools' 'python-build' 'python-installer' 'python-wheel') +source=("https://files.pythonhosted.org/packages/${pkgpath}/tcping-${pkgver}.tar.gz" + "LICENSE::https://raw.githubusercontent.com/zhengxiaowai/tcping/refs/heads/m…") +sha256sums=('557d5e928601e5a31e55abe20c6b9fff18bdc74a1e1d620d6b28b2f7c7a26606' + 'a5d77ee8f21b686eb9f7fe44783c5f17a987b7efe04151da5a12e31a42fd1568') build() { cd "$pkgname-$pkgver" - python setup.py build + python -m build --wheel --no-isolation } package() { cd "$pkgname-$pkgver" - python setup.py install --root="$pkgdir/" --optimize=1 --skip-build + python -m installer --destdir="$pkgdir" dist/*.whl + install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE" }

1 0

GitHub Vulnerability Wave
by Emiliano Gandini Outeda 10 Oct '26

10 Oct '26

Hi Folks, Related to yesterday/today thread: Malicious package upstream: plasma6-applet-quicklaunch (6.5.80-3) It seems GitHub as been fucked, please check your package upstream repos. https://thehackernews.com/2026/10/credential-stealing-github-actions.html Just spreading the word. Emiliano Gandini Outeda emiliano-go[dot]com emiliano.gandini[at]protonmail[dot]com

2 1

[Revised] Malicious package upstream: plasma6-applet-quicklaunch (6.5.80-3)
by Saren 09 Oct '26

09 Oct '26

(Revised due to accidental reply to an old thread) Package:https://aur.archlinux.org/packages/plasma6-applet-quicklaunch Upstream:https://github.com/ixnewton/org.kde.plasma.quicklaunch/ Problematic Upstream File: https://github.com/ixnewton/org.kde.plasma.quicklaunch/blob/main/.github/wo… The "security-audit.yml" which will be executed in actions runner is actually extracting API keys and cloud creds and upload them to an external server. Although I believe that building this package using PKGBUILD harmless, the package upstream cannot be trusted anymore. Also note that the package submitter/maintainer may not be affiliated with the upstream author.

7 10