- Aur-general - lists.archlinux.org

Question about aur package existing in git, but not visible in aur
by Julien Virey 16 Mar '24

16 Mar '24

Hi, The package toggl-cli is not visible in https://aur.archlinux.org/packages?O=0&K=toggl-cli. But it still exists in ssh://aur.archlinux.org/toggl-cli.git The package has not been updated since 2016. commit dd7340e8804776df85fe1eb82a79384e7f1349fb (HEAD -> master, origin/master, origin/HEAD) Date: Mon Feb 22 06:00:17 2016 -0300 I was about to release a new package for this pkgbase ( https://github.com/watercooler-labs/toggl-cli). Can I request a deletion / reset of ssh://aur.archlinux.org/toggl-cli.git to use this pkgbase ? Salutations, Julien

3 3

How do I get an unpopular package that's needed by an existing package to extra?
by Lime In a Jacket (Aaron Liu) 13 Mar '24

13 Mar '24

Ey, A while ago I made the AUR package perl-acme-cow, which is needed for some cowfiles bundled with cowsay. Is there a process for dependencies to enter extra? I understand that it's not popular and doesn't meet the requirement, but without it, attempting to use certain bundled cowfiles results in an error. Cheers, Aᴀʀᴏɴ

2 1

Migration of p7-tools to cahute
by Eldeberen 11 Mar '24

11 Mar '24

Hi everyone, I currently maintain some packages on the AUR, related to Casio calculators. In particular we'll focus on p7/libp7/p7screen which are dedicated to communication protocols. https://aur.archlinux.org/packages/p7 https://aur.archlinux.org/packages/libp7 https://aur.archlinux.org/packages/p7screen Recently the developer (Cakeisalie5) rewrote these utilities and replaced them by a single package, Cahute. https://cahuteproject.org/ I made a new package for this, which is not yet on the AUR but can be found on my personnal forge: https://git.middleearth.fr/Packages/cahute So I have some questions for you ^^ - How do I manage the decommissioning of the old tools? - I understand I'm not allowed to use the 'replaces' directive on the PKGBUILD as it is not an official package, I am right? - Should I add some warnings on existing p7/libp7/p7screen packages warning that they are no more maintained? - On the cahute package, does the .install looks good? - More generally I'll take any advise that help me to comply with the AUR guidelines :) Thanks for your help, Eldeberen

3 2

removal of yuzu from the official repos
by james smith 05 Mar '24

05 Mar '24

as most of you have heard the yuzu has been shutdown by nintendo[1] and the github page removed[2] therefore the package needs to be considered for removal from the official repos as there will be no more updates and the package links to the github will be broken in a matter of time [1] https://storage.courtlistener.com/recap/gov.uscourts.rid.56980/gov.uscourts… [2]https://github.com/yuzu-emu/yuzu

6 7

Re: Upgrade failure
by Abraham S.A.H. 04 Mar '24

04 Mar '24

> Odd, I've been accessing it in China over a VPN for many years. Do you have issues with any other website, and what happens when you replace "www" with "old"? The "old" one opens perfectly. I completely forgot that version of Reddit. But not with "www". No I do not have this problem with other websites. -- Best Regards, Abraham Sent with Tutanota; https://tuta.com

2 1

AUR Orphan Purge
by arch＠serebit.com 01 Mar '24

01 Mar '24

Hello all, Over the past few days, about 3,000 packages were removed from the Arch User Repository as part of a larger cleanup effort. These packages all fit the following criteria: - No maintainer - Popularity equal to 0.00000 - 3 or fewer total votes - Most recent update before 2019-01-01 If a package that you actively use has been removed, and you are willing to maintain it, feel free to resubmit the package. The Git repositories of all deleted packages are still accessible[1]. Any future large-scale cleanup efforts will be preceded by an announcement on the mailing lists to avoid blindsiding users and maintainers. Best, Campbell Jones [1] https://wiki.archlinux.org/title/Arch_User_Repository#Acquire_build_files

2 1

Re: powertabeditor - request for PKGBUILD review
by Jonas Serych 21 Feb '24

21 Feb '24

Hi, thanks for your comments. Lone_Wolf wrote: > timidity++ and fluidsynth are the 2 most common software midi > synthesizers on archlinux. > I suggest you list them as optdepends . Thanks, I did that (and also checked that it works with both of these). Polarian wrote: > Appreciate it if you paste the PKGBUILD into the email body, and not > attach it. Would also make it easier to quote. Here is the updated PKGBUILD: --8<---------------cut here---------------start------------->8--- # Maintainer: Jonas Serych <jonas(a)sery.ch> pkgname='powertabeditor' pkgver='2.0.0_alpha19' pkgrel=1 pkgdesc="Guitar tablature viewer and editor" arch=('x86_64') url="https://powertab.github.io/" license=('GPL-3.0-only') depends=('boost-libs' 'boost' 'doctest' 'minizip' 'pugixml' 'rtmidi' 'alsa-lib' 'nlohmann-json' 'qt5-base' 'qt5-tools') optdepends=('timidity++: MIDI playback support' 'fluidsynth: MIDI playback support') makedepends=('cmake') source=("https://github.com/powertab/${pkgname}/archive/refs/tags/${pkgver//_/-}.tar…") sha256sums=('318e14370bd60670dadfe70d2f124d817d51017ec13011f577080633d83f41d4') build() { cmake -B build -S "${pkgname}-${pkgver//_/-}" \ -DCMAKE_BUILD_TYPE='None' \ -DCMAKE_INSTALL_PREFIX=/usr cmake --build build } check() { ctest --test-dir build --output-on-failure } package() { DESTDIR="$pkgdir" cmake --install build } --8<---------------cut here---------------end--------------->8--- Any other things to improve? Or can I put it to AUR? Best, Jonas Serych

1 0

Moving from binary to from source, can we delete bin version
by Mek Yt 20 Feb '24

20 Feb '24

Hi, I first created AUR packages from binary file (`dagu-bin`, `oathkeeper-bin` and `kratos-bin`) but it is best to build them from source. I recreated them from source, I would like to know if it is possible to delete the binary version. I would like to maintain only the one from source. I could disown and wait for them to disappear but it looks cleaner to directly delete them and direct potential users to the correct/maintain one. Thanks, Mek Yt AUR to delete: https://aur.archlinux.org/packages/dagu-bin https://aur.archlinux.org/packages/oathkeeper-bin https://aur.archlinux.org/packages/kratos-bin PS: - `oathkeeper-bin` and `kratos-bin` use `ory-` namespace now (`ory-kratos` and `ory-oathkeeper`) - `oathkeeper-bin` and `kratos-bin` where duplicate (with service files) of orphan `ory-oathkeeper-bin` and `ory-kratos-bin`

4 3

Is including GPG keys in an AUR package for verifying sources a good idea?
by Wilhelm Schuster 20 Feb '24

20 Feb '24

Hi, I maintain the AUR package for wget2 [0] (which has `validgpgkeys()` populated) and have recently been contacted by a user that has trouble with GPG signature verification when building the package in a Docker container (using aurutils apparently). Their first suggestion was for me to drop the validpgpkeys section to make it easier for them to build the package. This is not something I'm willing to implement as that means downgrading security for other users of the package. makepkg provides an escape hatch for users who don't care about signature verification via the `--skippgpcheck` flag. Their second suggestion was for me to add the GPG public keys directly to AUR package. My first thought was that this is also not a good idea, but I'm not sure I can come up with convincing arguments. My reason against it is, that the PGP key allows for a user of my PKGBUILD to verify that I only include sources which have been signed by the maintainer of the software. As packager, I can control the source and hashes for a package, so if I want to use a malicious source, I can just update the hash to match, but I can't easily change the upstream signing key. However, if the users relies on the key included with the package, then I could use my own malicious key, so the user should compare the key with upstream sources anyway. On the other hand retrieving keys from the keyservers can be a crapshoot. I certainly have been bitten by that brittle infrastructure in the past, and having a copy of the key can alleviate that. That seems also the reason, why Arch proper has started including copies of GPG keys with their packages (see for example glibc [1]). This has been codified in RFC0011 [2] and is managed via the `export-pkgbuild-keys` script included in devtools. There doesn't seem to be any discussion of downsides of this approach in the RFC and accompanying Merge Request. Users, who wish to make sure that the used GPG keys are the ones published by upstream can always ignore the included key files and grab the keys directly from the keyservers. Do you think including GPG keys with AUR packages to make it easier for some users is a good idea? Or should they just use `--skippgpcheck`? Are there any glaring issues I'm missing here? Do you know of AUR packages that include the GPG keys for source verification similar to what Arch packages do? [0]: https://aur.archlinux.org/packages/wget2 [1]: https://gitlab.archlinux.org/archlinux/packaging/packages/glibc/-/tree/2.39… [2]: https://rfc.archlinux.page/0011-store-source-signing-keys/ Cheers, Wilhelm.

11 17

powertabeditor - request for PKGBUILD review
by Jonas Serych 19 Feb '24

19 Feb '24

Hi, this is my first time creating a PKGBUILD. I tried to follow the guidelines and the recommended practices for cmake packages, but not sure I didn't miss something. Thanks for any suggestions. I checked that it builds in clean chroot. The software seems to work well, except for JACK server not running error (for playback of midi). I am not sure if this should be somehow solved in the PKGBUILD, or if it should be left to the user. When I run qsynth alongside the powertabeditor the playback works just fine. Somehow setting up timidity++ daemon would work too, I guess. Best regards, Jonas Serych

3 3