- Aur-general - lists.archlinux.org

[aur-general] Signoff report for [community-testing]
by Arch Website Notification 11 Aug '14

11 Aug '14

=== Signoff report for [community-testing] === https://www.archlinux.org/packages/signoffs/ There are currently: * 0 new packages in last 24 hours * 0 known bad packages * 0 packages not accepting signoffs * 0 fully signed off packages * 14 packages missing signoffs * 0 packages older than 14 days (Note: the word 'package' as used here refers to packages as grouped by pkgbase, architecture, and repository; e.g., one PKGBUILD produces one package per architecture, even if it is a split package.) == Incomplete signoffs for [community] (14 total) == * acpi_call-1.1.0-11 (i686) 0/1 signoffs * bbswitch-0.8-15 (i686) 0/1 signoffs * r8168-8.038.00-10 (i686) 0/1 signoffs * rt3562sta-2.4.1.1_r1-9 (i686) 0/1 signoffs * tp_smapi-0.41-52 (i686) 0/1 signoffs * vhba-module-20140629-6 (i686) 0/1 signoffs * virtualbox-modules-4.3.14-5 (i686) 0/1 signoffs * acpi_call-1.1.0-11 (x86_64) 0/2 signoffs * bbswitch-0.8-15 (x86_64) 0/2 signoffs * r8168-8.038.00-10 (x86_64) 0/2 signoffs * rt3562sta-2.4.1.1_r1-9 (x86_64) 0/2 signoffs * tp_smapi-0.41-52 (x86_64) 0/2 signoffs * vhba-module-20140629-6 (x86_64) 0/2 signoffs * virtualbox-modules-4.3.14-5 (x86_64) 0/2 signoffs == Top five in signoffs in last 24 hours == 1. thomas - 1 signoffs

1 0

[aur-general] Discussion about AUR packages signing
by Fabien Dubosson 11 Aug '14

11 Aug '14

Hi, I want to start a discussion about AUR packages signing. If this debate already happened, it means that I'm not really good with Google or unfortunate in the keywords I used in my searches: in these cases forgive me and just give me some pointers. TL;DR I personally "trust" some AUR users who have several good-quality packages, and an optional way to sign AUR packages would permit me to know that I can build and update their packages without worrying too much. Let me introduce my thoughts by explaining the context: when I need an application, I start by looking at the official packages. If it is not existing, I continue by looking in AUR, and eventually if there is no corresponding packages there I wrote my own PKGBUILD and share it. I think this is the most common workflow for arch users. If there is the need to build packages from AUR, preferences differs more between people. Some likes to use AUR-helpers, others try to avoid using unsupported packages, and a last group always build AUR PKGBUILD manually. Official and own-made packages can be used (more-or-less) safely. AUR packages need to be used with precautions, because they come from untrusted users and can be potentially dangerous. Actually this is one of the reason why some people are not using AUR-helpers and prefer to build packages manually. People that avoid to use unsupported packages are not concerned by this discussion, so I'll skip them. People that are building packages manually are doing so mainly to deeply check packages they install, so they must not be very interested with AUR package signing (or maybe are they?). I will then focus on people (like me) that use an AUR-helper in their workflow. I always read PKGBUILDs the first time that I want to install one of them in one of my computers (work, home, laptop). When a new version is released, my AUR-helper will ask me to update it, but after the second or third time I see that the package is well-written, I don't want to look every time at the PKGBUILD, patches and *.install files. In some sense, I start to "trust" to the package owner. With AUR-helpers it is easy to skip this part and just build the packages, but there is a drawback: the package owner can change. The problem with this situation is if the package is orphaned and a new owner start to maintain it, it would not be noticeable. This is where package signing in AUR would be very useful. You give your trust to some users who maintain several good-quality packages. And as long as you build packages signed by those users, you know you are safe to update them without looking at sources. It would also offers some other warranties: no usurpation of maintainer work, no corruption in case of AUR website weakness, etc. Also the solution can be quite simple: The `*.src.tar.gz` can be signed by the owner and the signature file can be uploaded to AUR, next to the source aurball. Later, both files can be downloaded by the user or the AUR-helper and verified with gpg. The rest of the logic must be implemented in AUR-helpers. Some other remarks: - It differs from the notion of TU because the goal is not to give a keyring of trust-able people to all users, but only to permit users who want to trust personally some AUR maintainers to do so. - Of course this doesn't prevent corruption of upstream sources nor offers perfect security. But it is better than nothing, and can potentially focus some unnoticed maintainer changes. - I read some times ago that the goal is to move from AUR to git one day. In this case signing the `*.src.tar.gz` would not be possible and a more complex solution will maybe be needed. Is something like this envisaged? What are your thoughts about this subject? Regards, ++ Fabien

7 11

[aur-general] Signoff report for [community-testing]
by Arch Website Notification 10 Aug '14

10 Aug '14

=== Signoff report for [community-testing] === https://www.archlinux.org/packages/signoffs/ There are currently: * 0 new packages in last 24 hours * 0 known bad packages * 0 packages not accepting signoffs * 0 fully signed off packages * 14 packages missing signoffs * 0 packages older than 14 days (Note: the word 'package' as used here refers to packages as grouped by pkgbase, architecture, and repository; e.g., one PKGBUILD produces one package per architecture, even if it is a split package.) == Incomplete signoffs for [community] (14 total) == * acpi_call-1.1.0-11 (i686) 0/1 signoffs * bbswitch-0.8-15 (i686) 0/1 signoffs * r8168-8.038.00-10 (i686) 0/1 signoffs * rt3562sta-2.4.1.1_r1-9 (i686) 0/1 signoffs * tp_smapi-0.41-52 (i686) 0/1 signoffs * vhba-module-20140629-6 (i686) 0/1 signoffs * virtualbox-modules-4.3.14-5 (i686) 0/1 signoffs * acpi_call-1.1.0-11 (x86_64) 0/2 signoffs * bbswitch-0.8-15 (x86_64) 0/2 signoffs * r8168-8.038.00-10 (x86_64) 0/2 signoffs * rt3562sta-2.4.1.1_r1-9 (x86_64) 0/2 signoffs * tp_smapi-0.41-52 (x86_64) 0/2 signoffs * vhba-module-20140629-6 (x86_64) 0/2 signoffs * virtualbox-modules-4.3.14-5 (x86_64) 0/2 signoffs == Top five in signoffs in last 24 hours == 1. lfleischer - 1 signoffs

1 0

[aur-general] Signoff report for [community-testing]
by Arch Website Notification 09 Aug '14

09 Aug '14

=== Signoff report for [community-testing] === https://www.archlinux.org/packages/signoffs/ There are currently: * 0 new packages in last 24 hours * 0 known bad packages * 0 packages not accepting signoffs * 0 fully signed off packages * 14 packages missing signoffs * 0 packages older than 14 days (Note: the word 'package' as used here refers to packages as grouped by pkgbase, architecture, and repository; e.g., one PKGBUILD produces one package per architecture, even if it is a split package.) == Incomplete signoffs for [community] (14 total) == * acpi_call-1.1.0-11 (i686) 0/1 signoffs * bbswitch-0.8-15 (i686) 0/1 signoffs * r8168-8.038.00-10 (i686) 0/1 signoffs * rt3562sta-2.4.1.1_r1-9 (i686) 0/1 signoffs * tp_smapi-0.41-52 (i686) 0/1 signoffs * vhba-module-20140629-6 (i686) 0/1 signoffs * virtualbox-modules-4.3.14-5 (i686) 0/1 signoffs * acpi_call-1.1.0-11 (x86_64) 0/2 signoffs * bbswitch-0.8-15 (x86_64) 0/2 signoffs * r8168-8.038.00-10 (x86_64) 0/2 signoffs * rt3562sta-2.4.1.1_r1-9 (x86_64) 0/2 signoffs * tp_smapi-0.41-52 (x86_64) 0/2 signoffs * vhba-module-20140629-6 (x86_64) 0/2 signoffs * virtualbox-modules-4.3.14-5 (x86_64) 0/2 signoffs == Top five in signoffs in last 24 hours ==

1 0

[aur-general] Delete Request
by sxe 08 Aug '14

08 Aug '14

The maintainer switched to GIT only so i renamed the package. Please delete: https://aur.archlinux.org/packages/kdestyle-kvantum-kde4/ Thanks, Andy

2 1

[aur-general] Signoff report for [community-testing]
by Arch Website Notification 08 Aug '14

08 Aug '14

=== Signoff report for [community-testing] === https://www.archlinux.org/packages/signoffs/ There are currently: * 2 new packages in last 24 hours * 0 known bad packages * 0 packages not accepting signoffs * 0 fully signed off packages * 16 packages missing signoffs * 0 packages older than 14 days (Note: the word 'package' as used here refers to packages as grouped by pkgbase, architecture, and repository; e.g., one PKGBUILD produces one package per architecture, even if it is a split package.) == New packages in [community-testing] in last 24 hours (2 total) == * libgit2-1:0.21.1-1 (i686) * libgit2-1:0.21.1-1 (x86_64) == Incomplete signoffs for [community] (16 total) == * acpi_call-1.1.0-11 (i686) 0/1 signoffs * bbswitch-0.8-15 (i686) 0/1 signoffs * libgit2-1:0.21.1-1 (i686) 0/1 signoffs * r8168-8.038.00-10 (i686) 0/1 signoffs * rt3562sta-2.4.1.1_r1-9 (i686) 0/1 signoffs * tp_smapi-0.41-52 (i686) 0/1 signoffs * vhba-module-20140629-6 (i686) 0/1 signoffs * virtualbox-modules-4.3.14-5 (i686) 0/1 signoffs * acpi_call-1.1.0-11 (x86_64) 0/2 signoffs * bbswitch-0.8-15 (x86_64) 0/2 signoffs * libgit2-1:0.21.1-1 (x86_64) 0/2 signoffs * r8168-8.038.00-10 (x86_64) 0/2 signoffs * rt3562sta-2.4.1.1_r1-9 (x86_64) 0/2 signoffs * tp_smapi-0.41-52 (x86_64) 0/2 signoffs * vhba-module-20140629-6 (x86_64) 0/2 signoffs * virtualbox-modules-4.3.14-5 (x86_64) 0/2 signoffs == Top five in signoffs in last 24 hours == 1. fyan - 6 signoffs 2. foutrelis - 4 signoffs 3. eric - 4 signoffs 4. ronald - 2 signoffs

1 0

[aur-general] name change for libreoffice-rpm to libreoffice-fresh-rpm
by Mark Lee 07 Aug '14

07 Aug '14

Salutations, I'd like to request a name change from libreoffice-rpm to libreoffice-fresh-rpm for my package. Regards, Mark

2 1

[aur-general] Signoff report for [community-testing]
by Arch Website Notification 07 Aug '14

07 Aug '14

=== Signoff report for [community-testing] === https://www.archlinux.org/packages/signoffs/ There are currently: * 0 new packages in last 24 hours * 0 known bad packages * 0 packages not accepting signoffs * 0 fully signed off packages * 16 packages missing signoffs * 0 packages older than 14 days (Note: the word 'package' as used here refers to packages as grouped by pkgbase, architecture, and repository; e.g., one PKGBUILD produces one package per architecture, even if it is a split package.) == Incomplete signoffs for [community] (16 total) == * acpi_call-1.1.0-11 (i686) 0/1 signoffs * bbswitch-0.8-15 (i686) 0/1 signoffs * dd_rescue-1.45-2 (i686) 0/1 signoffs * r8168-8.038.00-10 (i686) 0/1 signoffs * rt3562sta-2.4.1.1_r1-9 (i686) 0/1 signoffs * tp_smapi-0.41-52 (i686) 0/1 signoffs * vhba-module-20140629-6 (i686) 0/1 signoffs * virtualbox-modules-4.3.14-5 (i686) 0/1 signoffs * acpi_call-1.1.0-11 (x86_64) 0/2 signoffs * bbswitch-0.8-15 (x86_64) 0/2 signoffs * dd_rescue-1.45-2 (x86_64) 0/2 signoffs * r8168-8.038.00-10 (x86_64) 0/2 signoffs * rt3562sta-2.4.1.1_r1-9 (x86_64) 0/2 signoffs * tp_smapi-0.41-52 (x86_64) 0/2 signoffs * vhba-module-20140629-6 (x86_64) 0/2 signoffs * virtualbox-modules-4.3.14-5 (x86_64) 0/2 signoffs == Top five in signoffs in last 24 hours == 1. bisson - 9 signoffs 2. lcarlier - 4 signoffs 3. lfleischer - 1 signoffs

1 0

[aur-general] virtualbox-extension-pack vs. virtualbox-ext-oracle
by Christian Hesse 06 Aug '14

06 Aug '14

Hello everybody, following a lengthy discussion sublu just deleted my package virtualbox-extension-pack from AUR. This is what his package (virtualbox-ext-oracle) does: * Install an archive file. * Use install script to copy a number of files to /usr without pacman knowing about it. I think this is the wrong way, so I created my own package (virtualbox-extension-pack) that tries to get it right: * Just install the files required, "ready to use" for virtualbox. * No crappy install script required! My package had about 75 votes IIRC, probably there would have been more if more people knew about the details. The discussing had a number of comments that agreed about my opinion regarding installing/coping files to /usr with pacman or the install script. Although I think it is wrong seblu is free to provide his package via AUR. But is there any good reason mine is not allowed to reside there? -- main(a){char*c=/* Schoene Gruesse */"B?IJj;MEH" "CX:;",b;for(a/* Chris get my mail address: */=0;b=c[a++];) putchar(b-1/(/* gcc -o sig sig.c && ./sig */b/42*2-3)*42);}

6 7

[aur-general] Backdoors in packages
by Florian Bruhin 06 Aug '14

06 Aug '14

Hi, I personally check PKGBUILDs before installing, but I know of many people who don't. This made me wonder: How many (if any) cases of actual malice (backdoors, removing data, other nasty stuff) are/were actually in the wild? Florian -- http://www.the-compiler.org | me(a)the-compiler.org (Mail/XMPP) GPG 0xFD55A072 | http://the-compiler.org/pubkey.asc I love long mails! | http://email.is-not-s.ms/

4 4