- Aur-general - lists.archlinux.org

[aur-general] Spam report
by Justin Wong 06 Jul '19

06 Jul '19

user: helensten link: https://aur.archlinux.org/packages/aseprite-git#comment-699395 For mod action please. Thanks! - Justin

2 1

[aur-general] Spam account/comments
by Henry-Joseph Audéoud 03 Jul '19

03 Jul '19

Hello, I have some comments in one of my packages (20kly). The three emitter accounts seems clearly spammers: https://aur.archlinux.org/account/gerrykirsten/comments https://aur.archlinux.org/account/robert1833/comments https://aur.archlinux.org/account/sweetzzz/comments -- Henry-Joseph Audéoud ryolait(a)archlinux.org

1 0

[aur-general] Spam account/comments
by Joan Figueras 02 Jul '19

02 Jul '19

Hi, just saw a comment in one of my packages (icecat). The account seems clearly a spammer: https://aur.archlinux.org/account/jennifer247/comments Thanks to take care of. Cheers -- Joan Figueras

2 1

[aur-general] Fwd: [AUR] esp-idf
by Gonçalo Pereira 30 Jun '19

30 Jun '19

Hello, This package is outdated for a month and the maintainer grabbed the package in the beggining of this year and never touched it. I tried contacting him and nothing. Maybe I can maintain this package? (I was the last packager). Let me know what you think. Best Regards, Gonçalo Pereira (G-Pereira) ---------- Forwarded Message ---------- Subject: [AUR] esp-idf Date: Friday, June 14, 2019, 5:59:41 PM WEST From: Gonçalo Pereira <goncalo_pereira(a)outlook.pt> To: a(a)arti-nt.ru Hi, I see your package is outdated for a while. Since I use this package for my day-time job maybe I can help you keep it up-to-date. What I suggest is if you want I could be a co-mantainer. What do you think? Best Regards, Gonçalo Pereira (G-Pereira) -----------------------------------------

2 2

[aur-general] The AUR package "svp" is suspicious
by Hirela 30 Jun '19

30 Jun '19

TL;DR: The AUR package "svp" (https://aur.archlinux.org/packages/svp/) might be injecting suspicious binary patches. Here are the relevant lines from the PKGBUILD version 4.3.0.165: pkgver=4.3.0.165 source=("https://gist.githubusercontent.com/phiresky/1e2cbd30bed4e5978771af232d11afd…") # I am rehosting the binaries # taken from # http://www.svp-team.com/files/svp4-linux-64.tbz2 # at https://gist.github.com/phiresky/1e2cbd30bed4e5978771af232d11afd1 # so they are correctly versioned and old versions still exist sha256sums=('00a025ce7c06660bafbad8cf5d889e9a6f09a9c9c9585dbee2415a8bf0256f53') First of all, I do not agree with him rehosting binary software and would much prefer this PKGBUILD to just download the latest version of svp4-linux-64.tbz2 straight from the official source. Since this is proprietary freeware, the maintainer might not have a license to redistribute binaries, and even if he did, the advantage of "correctly versioned" does not match up to the disadvantage of having to trust the maintainer to not tamper with his rehosted versions. Loose versions are acceptable for all the *-git packages, so it should be acceptable for SVP. I decided to get the binaries from the official source to verify whether his rehosted packages weren't tampered with. The package version of the PKGBUILD (4.3.0.165) matches up with the latest version of SVP according to the official website (https://www.svp-team.com/wiki/Main_Page) I tried downloading the SVP binary from the official source and compare the hashes: $ curl https://www.svp-team.com/files/svp4-linux-64.tbz2 > svp4-linux-64.tbz2 $ sha256sum svp4-linux-64.tbz2 070411ab60d429e03632fa80bb3ded7d5b2c60c2f5b85dff136f65eb83da3bdb svp4-linux-64.tbz2 This hash does not match up with the hash claimed by the PKGBUILD for his rehosted version, which suggests that the rehosted package is not identical to the official one. I don't know whether this is due to incompetence or malice, but it is worrisome, as it may be possible that the maintainer has injected his own patches into the rehosted versions.

3 3

[aur-general] SPAM report, AUR comment
by Rylie James Thomas 29 Jun '19

29 Jun '19

Hi! Just noticed a SPAM comment on the debtap package, it's the user's only comment: - https://aur.archlinux.org/packages/debtap/#comment-693148 - https://aur.archlinux.org/account/jeniferlewis77/comments

3 2

[aur-general] Copyrighted source on https://aur.archlinux.org/
by Jones, Philip 25 Jun '19

25 Jun '19

Hi There is a package hosted on https://aur.archlinux.org/ that is copyrighted and not open source. How do I get it removed? Thanks Philip ----------------- Siemens Industry Software Limited is a limited company registered in England and Wales. Registered number: 3476850. Registered office: Faraday House, Sir William Siemens Square, Frimley, Surrey, GU16 8QD.

10 16

[aur-general] Postman
by Gonçalo Pereira 25 Jun '19

25 Jun '19

Hi all, The package "postman" has been broken for months now although a maintainer has put some effort to fix it. However, postman-bin works perfectly fine. Does it make sense to have this two packages? Let me know what you think. Best Regards, Gonçalo Pereira

2 1

[aur-general] Spammer Accounts
by ali.mousavi＠gmail.com 24 Jun '19

24 Jun '19

Hi, The following users are spamming the AUR comments: - https://aur.archlinux.org/account/dhavalpatel/comments - https://aur.archlinux.org/account/badmanlive/comments - https://aur.archlinux.org/account/badmanlive/comments Regards, Ali Mousavi

5 6

[aur-general] Two spammer accounts/comments
by Ronny Lorenz 21 Jun '19

21 Jun '19

Hi, one of my AUR packages (https://aur.archlinux.org/packages/mlapack/) has two obvious spammer comments, one from https://aur.archlinux.org/account/loritalear and the other from https://aur.archlinux.org/account/Melvinchunter Would the admins please be so kind to manually remove those two comments, possibly together with removing the spammer accounts at the same time ;) Cheers, Ronny -- Dipl.-Inform. Dr. rer. nat. Ronny Lorenz Institute for Theoretical Chemistry University of Vienna Waehringerstrasse 17 1090 - Vienna AUSTRIA web: http://www.tbi.univie.ac.at/ phone: +43-1-4277-52734 fax: +43-1-4277-52793 mail: ronny(a)tbi.univie.ac.at

1 0