- Aur-general - lists.archlinux.org

Licensing following RFC40 and RFC52
by Lex Black 05 Aug '25

05 Aug '25

Hello list, I have a question regarding adding LICENSES to the aurweb repos. The simple solution would be to add the 0BSD text to the repo. So far so good. I looked additionally into REUSE, as this is mostly deployed by the repo packages and got mentioned on the respective wiki page[0]. As the pkgctl programm from the devtools package has the subcommand `license setup` and `license check` I looked into using this. But the resulting structure doesn't conform to the aurweb submission guidelines as subdirectories aren't allowed. But would be required to be REUSE-compliant? Will this be changed to allow this specific subdir? Or should the suggestion to use REUSE dropped from the wiki page? If the latter, how to attribute patches that are added from upstream? Best regards ________ [0] https://wiki.archlinux.org/title/AUR_submission_guidelines#Rules_of_submiss… "Add a LICENSE file or a REUSE.toml file to your repository."

2 2

Possible malicous PKGBUILD
by Lex Black 29 Jul '25

29 Jul '25

Hi Will only be able top later create a deletion requests for a package, but maybe someone else wants to step up? https://aur.archlinux.org/packages/gdox Not a really stealthy and working approach to do harm, but such a PKGBUILD shouldn't stay up in my opinion. Best regards

2 1

Command in DLAGENTS works in shell but not in makepkg
by Aaron Liu 22 Jul '25

22 Jul '25

Hey, Part of a PKGBUILD I'm trying to make looks like this: source=(Lark-linux_x64-${pkgver}.deb::https://www.larksuite.com/api/package… DLAGENTS=("https::/usr/bin/sh -c curl\ -LO\ \"\$$curl\ \'%u\'\ \|\ grep\ -oP\ \'\(\?\<=\"download_link\":\"$\[\^\"\]\*\'\ --\ \|\ sed\ \'s/\\\\u0026/\\\&/g\'\ --\)\"") The command (/usr/bin/sh...) works when I run it in my shell, but not when I run makepkg on the PKGBUILD. Any help would be really, really appreciated. I don't even know how to make makepkg tell me what command it runs, and even that would be nice. -- Cheers, Aᴀʀᴏɴ

1 1

Re: [SECURITY] firefox-patch-bin, librewolf-fix-bin and zen-browser-patched-bin AUR packages contain malware
by Shay Gover 19 Jul '25

19 Jul '25

Hi Quentin, Can you send us the packages description so we can identify other attempts in the future? Thanks Shay Date: Fri, 18 Jul 2025 18:53:19 +0200 > From: Quentin MICHAUD <mh4ckt3mh4ckt1c4s(a)archlinux.org> > Subject: [SECURITY] firefox-patch-bin, librewolf-fix-bin and > zen-browser-patched-bin AUR packages contain malware > To: aur-general(a)lists.archlinux.org > Message-ID: <4156647e-59ab-4026-9778-19d7cda6d4bc(a)archlinux.org> > Content-Type: text/plain; charset=UTF-8; format=flowed > > On the 16th of July, at around 8pm UTC+2, a malicious AUR package was > uploaded to the AUR. Two other malicious packages were uploaded by the > same user a few hours later. These packages were installing a script > coming from the same GitHub repository that was identified as a Remote > Access Trojan (RAT). > > The affected malicious packages are: > > - librewolf-fix-bin > - firefox-patch-bin > - zen-browser-patched-bin > > The Arch Linux team addressed the issue as soon as they became aware of > the situation. As of today, 18th of July, at around 6pm UTC+2, the > offending packages have been deleted from the AUR. > > We strongly encourage users that may have installed one of these > packages to remove them from their system and to take the necessary > measures in order to ensure they were not compromised. >

1 0

[SECURITY] firefox-patch-bin, librewolf-fix-bin and zen-browser-patched-bin AUR packages contain malware
by Quentin MICHAUD 18 Jul '25

18 Jul '25

On the 16th of July, at around 8pm UTC+2, a malicious AUR package was uploaded to the AUR. Two other malicious packages were uploaded by the same user a few hours later. These packages were installing a script coming from the same GitHub repository that was identified as a Remote Access Trojan (RAT). The affected malicious packages are: - librewolf-fix-bin - firefox-patch-bin - zen-browser-patched-bin The Arch Linux team addressed the issue as soon as they became aware of the situation. As of today, 18th of July, at around 6pm UTC+2, the offending packages have been deleted from the AUR. We strongly encourage users that may have installed one of these packages to remove them from their system and to take the necessary measures in order to ensure they were not compromised.

1 0

A nightmare in nesting for DLAGENTS
by Aaron Liu 08 Jul '25

08 Jul '25

Ey, A package recently started making their download links be dynamically-generated and expire. I've found that the download link can be gotten through `curl 'https://www.larksuite.com/api/package_info?platform=10' | grep -oP '(?<="download_link":")[^"]*' --`. I've decided to implement this into the package through setting source to the API link and specifying DLAGENTS. However, I'm having trouble wrangling the quotes. Currently, I have DLAGENTS=('https::/bin/sh -c '\''curl -LO $(curl -s %u | grep -oP "(?<=\"download_link\":\")[^"]*")'\'''). The shell complains -LO: -c: line 1: unexpected EOF while looking for matching `''. (I'm not using jq because 1. it's an extra makedepends 2. I tried replacing the grep part with `jq -r .download_link` and it changes nothing.) I've been working at different ways of expressing this for a while now and all I've managed to change is which kind of quotation mark the shell complains about. Any ideas? -- Cheers, Aᴀʀᴏɴ

1 1

Re: License and questions regarding gnome-printing
by Luna Jernberg 19 Jun '25

19 Jun '25

Ah alright Den tors 19 juni 2025 kl 19:17 skrev Aamot Innovation <ole(a)aamot.org>: > > Thank you. > > gnome-printing is obsolete. I will also remove it from www.aamot.org/ole/printing.html and www.github.com/oleaamot/printing > > > 19. juni 2025 kl. 7:11 pm skrev Luna Jernberg <droidbittin(a)gmail.com>: > > > > The package is now deleted > > > > Den tors 19 juni 2025 kl 16:52 skrev Luna Jernberg <droidbittin(a)gmail.com>: > >> > >> https://lists.archlinux.org/archives/list/aur-requests@lists.archlinux.org/… > >> > >> Den tors 19 juni 2025 kl 16:51 skrev Luna Jernberg <droidbittin(a)gmail.com>: > >>> > >>> Alright will do > >>> > >>> Den tors 19 juni 2025 kl 16:50 skrev Ole Aamot <ole(a)aamot.org>: > >>>> > >>>> Delete gnome-printing from AUR. It is obsolete and not necessary for printing on GNOME Systems. > >>>> > >>>> On 6/19/25 10:00 AM, Ole Aamot wrote: > >>>> > >>>> Hello, > >>>> > >>>> Thank you for your message and for raising these important questions regarding the gnome-printing package recently submitted to the AUR. > >>>> > >>>> I'll address both of your concerns directly: > >>>> > >>>> > >>>> --- > >>>> > >>>> 1. License of gnome-printing > >>>> > >>>> The license for gnome-printing was initially not clearly stated, and I understand this has caused confusion. To clarify: > >>>> > >>>> The gnome-printing project is an experimental wrapper intended to integrate simplified printing functionality for specific GTK4/GNOME4-based workflows. > >>>> > >>>> It was developed under the principles of free and open-source software, and the intention is to license it under the Public Domain, in line with most GNOME utilities. > >>>> > >>>> The license declaration was inadvertently omitted from the initial release, and we will be adding a COPYING file and SPDX license headers in the next version update on https://github.com/aamotsoftware/printing to make this explicit. > >>>> > >>>> > >>>> > >>>> --- > >>>> > >>>> 2. Purpose of gnome-printing > >>>> > >>>> You are absolutely right that GNOME uses CUPS for its built-in printing system. gnome-printing is not a replacement for CUPS or for GNOME's existing print stack. Instead, its goals are: > >>>> > >>>> To provide a user-facing frontend (using GTK4/Adwaita) for certain common printing tasks, primarily aimed at developers and tinkerers who want tighter scripting or sandboxed integration (such as within GNOME Builder or Flatpak applications). > >>>> > >>>> It acts as a thin wrapper around CUPS and the common UNIX lp/lpr utilities, with potential features like: > >>>> > >>>> previewing print jobs via a minimal UI, > >>>> > >>>> generating print-ready PDFs, > >>>> > >>>> selecting specific backends or printers in a streamlined way (especially for headless usage or kiosk setups), > >>>> > >>>> integration with non-CUPS pipelines (future potential, e.g., IPP-over-USB experiments). > >>>> > >>>> > >>>> > >>>> That said, it is indeed redundant for general GNOME desktop users, who already benefit from excellent support via the gnome-control-center and evince/gtk-print stack. As such, gnome-printing is niche and optional, meant more for experimentation and lightweight print job scripting in specific GNOME developer scenarios. > >>>> > >>>> See https://www.aamot.org/ole/printing.html > >>>> --- > >>>> > >>>> Next Steps > >>>> > >>>> We will: > >>>> > >>>> Update the project metadata with the correct license information. > >>>> > >>>> Clarify the purpose and scope of the package in the AUR description and upstream README to avoid misunderstandings. > >>>> > >>>> Ensure FabioLolix’s fixes are merged and credited. > >>>> > >>>> Could you provide me with FabioLolix's fixes? > >>>> > >>>> --- > >>>> > >>>> Thanks again for your diligence, and we appreciate the Arch community’s attention to detail and software quality. > >>>> > >>>> Warm regards, > >>>> Ole Kristian Aamot > >>>> Aamot Research > >>>> ole(a)aamot.software > >>>> www.aamot.io > >>>> > >>>> — cc: Luna (“bittin”), FabioLolix, Muflone > >>>> > >>>> > >>>> On Thu, Jun 19, 2025, 7:31 AM Chloe <digear466(a)mailgw.com> wrote: > >>>>> > >>>>> Hello, > >>>>> > >>>>> A few days ago, an AUR user bittin ("Luna") submitted the gnome-printing package to AUR and they signed off their emails with "Luna <on behalf > >>>>> of Ole>". > >>>>> > >>>>> Community members have raised several issues with the package. While the build script has been mostly fixed (courtesy of FabioLolix), there are > >>>>> still some questions: > >>>>> > >>>>> 1. What is the license of gnome-printing? We are unable to find the license, and therefore it is uncertain whether this software can be > >>>>> redistributed. > >>>>> 2. What is the purpose of gnome-printing? Muflone, who is a Package Maintainer (an official Arch Linux staff role), has pointed out that "GNOME > >>>>> has builtin printing system using CUPS". Does gnome-printing provide any feature which cannot be satisfied by GNOME's builtin features or other > >>>>> existing software? > >>>>> > >>>>> Regards, > >>>>> gnlrdrvo >

1 0

gnome-printing PKGBUID help
by Luna Jernberg 19 Jun '25

19 Jun '25

Hey! https://aur.archlinux.org/packages/gnome-printing someone can help me fix up this PKGBUILD or know how to make a PKGBUILD that only unpacks files in a specific folder or if it should be a PKGBUILD at all? //Luna <on behalf of Ole>

2 4

Re: License and questions regarding gnome-printing
by Luna Jernberg 19 Jun '25

19 Jun '25

Alright will do Den tors 19 juni 2025 kl 16:50 skrev Ole Aamot <ole(a)aamot.org>: > > Delete gnome-printing from AUR. It is obsolete and not necessary for printing on GNOME Systems. > > On 6/19/25 10:00 AM, Ole Aamot wrote: > > Hello, > > Thank you for your message and for raising these important questions regarding the gnome-printing package recently submitted to the AUR. > > I'll address both of your concerns directly: > > > --- > > 1. License of gnome-printing > > The license for gnome-printing was initially not clearly stated, and I understand this has caused confusion. To clarify: > > The gnome-printing project is an experimental wrapper intended to integrate simplified printing functionality for specific GTK4/GNOME4-based workflows. > > It was developed under the principles of free and open-source software, and the intention is to license it under the Public Domain, in line with most GNOME utilities. > > The license declaration was inadvertently omitted from the initial release, and we will be adding a COPYING file and SPDX license headers in the next version update on https://github.com/aamotsoftware/printing to make this explicit. > > > > --- > > 2. Purpose of gnome-printing > > You are absolutely right that GNOME uses CUPS for its built-in printing system. gnome-printing is not a replacement for CUPS or for GNOME's existing print stack. Instead, its goals are: > > To provide a user-facing frontend (using GTK4/Adwaita) for certain common printing tasks, primarily aimed at developers and tinkerers who want tighter scripting or sandboxed integration (such as within GNOME Builder or Flatpak applications). > > It acts as a thin wrapper around CUPS and the common UNIX lp/lpr utilities, with potential features like: > > previewing print jobs via a minimal UI, > > generating print-ready PDFs, > > selecting specific backends or printers in a streamlined way (especially for headless usage or kiosk setups), > > integration with non-CUPS pipelines (future potential, e.g., IPP-over-USB experiments). > > > > That said, it is indeed redundant for general GNOME desktop users, who already benefit from excellent support via the gnome-control-center and evince/gtk-print stack. As such, gnome-printing is niche and optional, meant more for experimentation and lightweight print job scripting in specific GNOME developer scenarios. > > See https://www.aamot.org/ole/printing.html > --- > > Next Steps > > We will: > > Update the project metadata with the correct license information. > > Clarify the purpose and scope of the package in the AUR description and upstream README to avoid misunderstandings. > > Ensure FabioLolix’s fixes are merged and credited. > > Could you provide me with FabioLolix's fixes? > > --- > > Thanks again for your diligence, and we appreciate the Arch community’s attention to detail and software quality. > > Warm regards, > Ole Kristian Aamot > Aamot Research > ole(a)aamot.software > www.aamot.io > > — cc: Luna (“bittin”), FabioLolix, Muflone > > > On Thu, Jun 19, 2025, 7:31 AM Chloe <digear466(a)mailgw.com> wrote: >> >> Hello, >> >> A few days ago, an AUR user bittin ("Luna") submitted the gnome-printing package to AUR and they signed off their emails with "Luna <on behalf >> of Ole>". >> >> Community members have raised several issues with the package. While the build script has been mostly fixed (courtesy of FabioLolix), there are >> still some questions: >> >> 1. What is the license of gnome-printing? We are unable to find the license, and therefore it is uncertain whether this software can be >> redistributed. >> 2. What is the purpose of gnome-printing? Muflone, who is a Package Maintainer (an official Arch Linux staff role), has pointed out that "GNOME >> has builtin printing system using CUPS". Does gnome-printing provide any feature which cannot be satisfied by GNOME's builtin features or other >> existing software? >> >> Regards, >> gnlrdrvo

1 2

Confusion about version for AUR package
by zac 04 Jun '25

04 Jun '25

Hello, I'm hoping to submit an AUR package which is just an OpenRC script for another package. The main package is `blocky` and I'll be calling my package `blocky-openrc` as such. I'm not sure if I should version my package separately, or if it should match the version of Blocky. I'm hesitant to version it by Blocky because it would be annoying to have to update the package version every time a new version of Blocky is released, even though nothing in the OpenRC script has changed. Here is the PKGBUILD. I figured I'd post it in case there's other feedback anyone might have. # Maintainer: zacoons <zac [at] zacoons [dot] com> pkgname=blocky-bin-openrc pkgver=1.0 pkgrel=1 pkgdesc="Fast and lightweight DNS proxy as ad-blocker" arch=("any") url="https://github.com/0xERR0R/blocky" license=("0BSD") depends=( "openrc" ) optdepends=( "blocky: blocky" "blocky-bin: blocky" ) source=( "blocky.initd" ) sha256sums=( "6ad6361614b16ddac6ce9e8d5f8e9b9e8c07e95115f59311e5e38b88ccbb51e3" # blocky.initd ) package() { install -D -v -m755 blocky.initd $pkgdir/etc/init.d/blocky }

5 6