- Aur-general - lists.archlinux.org

[aur-general] Packages that include other project code
by Brett Cornwall 15 Jul '19

15 Jul '19

I'd like a sanity check! Waybar has a dependency on a C++ logging library called spdlog. This project depends on fmt and by default uses an included copy. I've raised a ticket about removing this but it doesn't look like the developer is interested [2]. In this case, I feel it expedient to patch out the logic to use the bundled headers [2] and outright remove the directories [3]. Am I correct in this conclusion or is this too far-reaching? [1] https://github.com/gabime/spdlog/issues/1146 [2] https://git.archlinux.org/svntogit/community.git/tree/spdlog/trunk/rm_bundl… [3] https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=pack…

2 1

[aur-general] Spam accounts
by Alfredo Ramos 15 Jul '19

15 Jul '19

Hello, I just saw some spam comments in the android-studio package. https://aur.archlinux.org/account/JozephChristophe/comments https://aur.archlinux.org/account/oliversmith1407/comments

1 0

Re: [aur-general] Question about creating AUR package
by Tomasz Gąsior 13 Jul '19

13 Jul '19

I think this links are relevant: - <https://wiki.archlinux.org/index.php/Creating_packages> - <https://wiki.archlinux.org/index.php/AUR_submission_guidelines> --- Tomasz Gąsior https://tomaszgasior.pl W dniu sob, 13 lip 2019 o 17∶56 użytkownik joão marcos pereira bezerra via aur-general <aur-general(a)archlinux.org> napisał: > Hello, i'm new to this mailing list, here because i want to submit a > AUR Package > > It's called "corrupter-bin", an alternative to "corrupter-git" that > avoids installing Go-Lang package (400MB) > > What are the steps? after creating the PKGBUILD what do i do? >

1 0

[aur-general] Question about creating AUR package
by joão marcos pereira bezerra 13 Jul '19

13 Jul '19

Hello, i'm new to this mailing list, here because i want to submit a AUR Package It's called "corrupter-bin", an alternative to "corrupter-git" that avoids installing Go-Lang package (400MB) What are the steps? after creating the PKGBUILD what do i do?

2 1

[aur-general] Spam Account
by Georg Pfahler 12 Jul '19

12 Jul '19

Hi, another Spam Account: https://aur.archlinux.org/account/karishma366/comments -- Georg Pfahler <georgpfahler(a)wachenzell.org>

1 0

[aur-general] Spam report
by Justin Wong 06 Jul '19

06 Jul '19

user: helensten link: https://aur.archlinux.org/packages/aseprite-git#comment-699395 For mod action please. Thanks! - Justin

2 1

[aur-general] Spam account/comments
by Henry-Joseph Audéoud 03 Jul '19

03 Jul '19

Hello, I have some comments in one of my packages (20kly). The three emitter accounts seems clearly spammers: https://aur.archlinux.org/account/gerrykirsten/comments https://aur.archlinux.org/account/robert1833/comments https://aur.archlinux.org/account/sweetzzz/comments -- Henry-Joseph Audéoud ryolait(a)archlinux.org

1 0

[aur-general] Spam account/comments
by Joan Figueras 02 Jul '19

02 Jul '19

Hi, just saw a comment in one of my packages (icecat). The account seems clearly a spammer: https://aur.archlinux.org/account/jennifer247/comments Thanks to take care of. Cheers -- Joan Figueras

2 1

[aur-general] Fwd: [AUR] esp-idf
by Gonçalo Pereira 30 Jun '19

30 Jun '19

Hello, This package is outdated for a month and the maintainer grabbed the package in the beggining of this year and never touched it. I tried contacting him and nothing. Maybe I can maintain this package? (I was the last packager). Let me know what you think. Best Regards, Gonçalo Pereira (G-Pereira) ---------- Forwarded Message ---------- Subject: [AUR] esp-idf Date: Friday, June 14, 2019, 5:59:41 PM WEST From: Gonçalo Pereira <goncalo_pereira(a)outlook.pt> To: a(a)arti-nt.ru Hi, I see your package is outdated for a while. Since I use this package for my day-time job maybe I can help you keep it up-to-date. What I suggest is if you want I could be a co-mantainer. What do you think? Best Regards, Gonçalo Pereira (G-Pereira) -----------------------------------------

2 2

[aur-general] The AUR package "svp" is suspicious
by Hirela 30 Jun '19

30 Jun '19

TL;DR: The AUR package "svp" (https://aur.archlinux.org/packages/svp/) might be injecting suspicious binary patches. Here are the relevant lines from the PKGBUILD version 4.3.0.165: pkgver=4.3.0.165 source=("https://gist.githubusercontent.com/phiresky/1e2cbd30bed4e5978771af232d11afd…") # I am rehosting the binaries # taken from # http://www.svp-team.com/files/svp4-linux-64.tbz2 # at https://gist.github.com/phiresky/1e2cbd30bed4e5978771af232d11afd1 # so they are correctly versioned and old versions still exist sha256sums=('00a025ce7c06660bafbad8cf5d889e9a6f09a9c9c9585dbee2415a8bf0256f53') First of all, I do not agree with him rehosting binary software and would much prefer this PKGBUILD to just download the latest version of svp4-linux-64.tbz2 straight from the official source. Since this is proprietary freeware, the maintainer might not have a license to redistribute binaries, and even if he did, the advantage of "correctly versioned" does not match up to the disadvantage of having to trust the maintainer to not tamper with his rehosted versions. Loose versions are acceptable for all the *-git packages, so it should be acceptable for SVP. I decided to get the binaries from the official source to verify whether his rehosted packages weren't tampered with. The package version of the PKGBUILD (4.3.0.165) matches up with the latest version of SVP according to the official website (https://www.svp-team.com/wiki/Main_Page) I tried downloading the SVP binary from the official source and compare the hashes: $ curl https://www.svp-team.com/files/svp4-linux-64.tbz2 > svp4-linux-64.tbz2 $ sha256sum svp4-linux-64.tbz2 070411ab60d429e03632fa80bb3ded7d5b2c60c2f5b85dff136f65eb83da3bdb svp4-linux-64.tbz2 This hash does not match up with the hash claimed by the PKGBUILD for his rehosted version, which suggests that the rehosted package is not identical to the official one. I don't know whether this is due to incompetence or malice, but it is worrisome, as it may be possible that the maintainer has injected his own patches into the rehosted versions.

3 3