- Aur-general - lists.archlinux.org

[aur-general] A Positive Tale about an out-of-date Package
by Luca Corbatto 03 Dec '18

03 Dec '18

Hi everyone, I hope you don't mind, but after all these "discussions" lately I thought I'd step out of the undergrowth, brush myself off and just tell a little tale of how dealing with out-of-date packages can go in this community. So grab a cup of your favorite beverage and have a relaxed read. A little while back I came across the software synergy. Arch Linux being Arch Linux, of course, has a package for it! Hurray I thought, no need to package it myself. So I went and installed it. Sadly I realized it is quite out of date. At this point I can't remember if it was me who flagged it or if it was already flagged. Regardless, I thought "Maybe the maintainer is already on it, let's give them some time." After, I believe, about two weeks I thought, well let's take a look at the maintainers account aaand wow! According to the package search they are listed as maintainer on 591 packages! No wonder if a package or two fall through the cracks. So I looked in the PKGBUILD and found the email address of the maintainer. I quickly emailed them along the lines of "Hey, I noticed the synergy package has been out of date for a while. I also see you have tons of packages to maintain. Want some help with synergy?". Quite quickly I got a reply (paraphrasing) "Oh sorry about that, I had forgotten about that package. Some help would be amazing, here's a link to a github repository where I keep my packages. Feel free to open a pull request.". To github! Synergy was stubborn as they have lot's of bundled dependencies that all want to be unraveled. It was a journey in which I deepened my knowledge about CMake, learned to curse project maintainers that don't think about us packaging-people and eventually even learned a few more details about packaging for Arch Linux. After some time the pull request was ready. The package maintainer had to add a little spit and polish, after which it was merged and released into the wild. No further flagging or requesting necessary. So to all newbies out there that may have gotten scared by what was going on in the mailing lists lately: Don't be afraid! As far as I have perceived it so far, this is a welcoming and supportive community with great people working on a great (if not the best) Linux distribution. Thank you Anthraxxx for the lovely interactions we had in the course of working on the synergy package! Hope this can shed some positivity. Best regards, Luca (targodan)

2 1

[aur-general] On TU application, TU participation and community/ package quality
by Santiago Torres-Arias 29 Nov '18

29 Nov '18

On TU applications, TU participation and package quality: ========= Many Trusted Users have brought up their concerns regarding the lack of proper vetting of packages put forward by new TU's, the small participation of TUs in their duties* and the declining quality of packages in the community/ repository. As a consequence, we've decided to bring forward proposals to tackle the following issues: ## Issues * Existing Trusted Users are not followed closely in their actions, and the quality of some packages for instance is more than questionable. * New applications are not carefully reviewed, and a several TUs seem to just vote “Yes” by default. * There is a general feeling of decreasing/not high enough quality in the packages provided in the community/ repository. * The implication of some TUs in the distribution is very limited outside of packaging. ### current proposals (simplified) The discussion #archlinux-tu channel has yielded three general possibilities: 1. Add a council of TU's to introduce oversight on the whole voting process 2. Increase the minimum number of sponsors per application 3. Create a working group of TU's to review recent applications and warn TU's that do *not* appear to be performing their duties appropriately Consider that these need not be the only possibilities and any further proposals should be also brought up. ## Proposals ### TU council Creating a council of TUs who, by means of experience and involvement, make sure the approval of new TU's is properly reviewed. As such, this council will be in charge of voting in and/or sponsoring a new TU applicant. This raises questions about the horizontal power structure of the TU community. The consequences of bringing a hierarchy like this need to be discussed, as more than one TU is concerned of the implications of this model. The means for election for such a council are yet to be discussed, as the feasibility of this measure is to be discussed first. ### Minimum number of sponsors An alternative to a TU council is to increase the minimum number of sponsors for a TU application. This has been the case in other communities that experienced rapid growth (e.g., CNCF) and may help increase oversight and preparation of newer applicants. Variants of this model can be considered too. For example, a buddy system in which new applicants need both an experienced TU and a new TU as sponsors may also help preparing new TU's with the process of preparing applicants. However, one question raised during the discussion is whether this model is enough to warrant the goals outlined above. Namely, this measure doesn't seem to tackle the lack of participation of the broader TU community when reviewing new TU applications. ### Oversight committee Finally, a third proposal (and the one I'm championing) is to generate an elected organism within the TU community to overlook the performance of Trusted Users on the duties they agreed to fulfill. This oversight committee would track the activities of individual TUs and ensure that they are in fact participating in reviews, submitting proper high-quality PKGBUILDS, and moving packages to and from the AUR when the package's popularity changes. The methods by which this committee would enforce better TU participation are still to be discussed, but issuing warnings and probably bring cases to the broader TU community regarding an underperforming TU may be sufficient and nondisruptive. ## Conclusions The proposals above serve as a first step to discuss and iteratve over ideas on how to improve TU participation, applications and package quality. With this in mind, discussion of the applicability of these (or any other proposal) alone or on tandem should follow suit. Thanks! -Santiago P.S.: sorry for the legalose tone. I've probably spent too much time this week going through governance documents for different communitites. P.S.: Some of the ideas put forward is my interpretation of the text after going through the irc logs. Please correct me if my interpretation is wrong or incomplete. * e.g., reviewing PKGBUILDs or going through AUR requests

15 19

[aur-general] Change pkgbase of AUR package
by Michael Straube 27 Nov '18

27 Nov '18

Hi All, I want to remove the python3 package from the python-visitor split package [1], since it's already in [community]. Will simply changing the pkgbase/pkgname and pushing be enough? change: pkgbase=python-visitor pkgname=('python2-visitor' 'python-visitor') to: pkgname=python2-visitor Or do I need to upload a new python2-visitor package and file merge/delete request for the actual python-visitor split package? [1] https://aur.archlinux.org/pkgbase/python-visitor Best regards, Michael

2 2

[aur-general] Orphan request: concourse-fly-bin
by Julien Nicoulaud 25 Nov '18

25 Nov '18

Hi, Is it possible to orphan the concourse-fly-bin package ( https://aur.archlinux.org/packages/concourse-fly-bin) or at least add me as co- maintainer (https://aur.archlinux.org/account/nicoulaj) ? The maintainer did not update it despite my repeated demands (2018-11-07, 2018-11-16, 2018-11-19). Cheers, Julien

3 3

[aur-general] Spam Account
by Morgan Adamiec 23 Nov '18

23 Nov '18

Another spam account: https://aur.archlinux.org/account/markwilliamson/

2 1

[aur-general] TU application: Maxim Baz
by Maxim Baz 20 Nov '18

20 Nov '18

Hello everyone, My name is Maxim Baz, and with Morten Linderud (Foxboron) as my sponsor (who I was referred to by Alad Wenter) I'm applying to become a Trusted User. According to the git history of my dotfiles, I've been using Linux for around 3 years and Arch Linux for around 2 years. I'm quite active open-source contributor, especially on Github as you can see on my profile page [1]. Some of my currently favorite projects where I both contribute code and participate in discussions are: browserpass, wire-desktop, kitty, kakoune, spaceship-prompt, and undoubtedly aurutils. I also once submitted a small patch [2] to pacman-contrib that got merged. During the day I work at Microsoft, where I am also using Arch Linux and building software that runs on Linux in production. In my mind, packaging is one of the best ways to do good for Arch Linux community. Luckily there are tools that make this easy: I use Alad's aurutils and always build in chroot, fixing broken PKGBUILDs on the fly and sharing my fixes with package maintainers on AUR; to manage my own AUR packages [3] (except for the very few) I now use aurpublish tool by Eli Schwartz. Maintaining 'chromium-vaapi' in particular showed me how important it is to keep a valid up-to-date PKGBUILD for a tool that many people rely on every day, as well as how useful it is to provide precompiled binaries for apps that require lots of time and/or resources to compile — this is how my package 'chromium-vaapi-bin' was born. One aspect of packaging that always interested me is security and trust. Firstly, I have recently stumbled upon the idea of "reproducible builds" and I love it, Eli Schwartz and Morten Linderud briefly introduced me to the current efforts and I'm planning to get more involved in this area. In particular, I'm interested in the user-facing side of things, figuring out how to integrate this with pacman and how to let regular users benefit from reproducible builds the most. Also, as a TU I want to help finishing TODO "BUILDINFO rebuild" [4] if it's not completed earlier. Secondly, to maintain people's trust in Trusted Users we should never use http to fetch sources unless a verification method (such as a gpg signature) is also available, that's why I also want to help burning down a corresponding TODO "Use gpg signatures and https sources" [5]. Another thing I would do as TU is I would like to maintain and co-maintain packages for some Language Servers (if the current maintainers don't object). Language Server Protocol is a very cool concept (designed by Microsoft :P), it defines a protocol used between programming languages and editors to add features like autocomplete, go to definitions, code formatting and much more. Language servers themselves are being developed by community and are already supported by many editors like vim, neovim and kakoune. I am planning to start with the following packages: - bash-language-server: already in [community], I'd like to co-maintain it - python-language-server and python-jsonrpc-server: already in [community], I'd like to co-maintain them - go-langserver: the most feature-rich language server at the moment, to bring it to [community] I started the discussion with the upstream maintainers about tagging releases - kak-lsp: de-facto official plugin that adds LSP support for kakoune editor. I would also like to move some AUR packages to [community], in particular these ones have good amount of votes and in my mind deserve to be promoted to [community]: - wire-desktop (76): End-to-end encrypted messaging app that works on Windows, Linux, Mac, Android and iPhone. It is free, open-source and available on Github. Although I'm co-maintaining this package on AUR, I was mostly focused on contributing to the project itself: I added proper emoji support (following the latest Unicode standard), emoji autocomplete and improved native notifications on Linux (show user pictures, set urgency hint). - browserpass (31): Browser extension for pass (unix password manager), works in Chromium and Firefox. I became the primary project maintainer about a year ago, and together with another maintainer recently started rewriting it to make the architecture accommodate users' needs. I'm planning to bring this to [community] after the new version is ready (we are aiming to release in December). Also, someone in comments on AUR gave me a cool idea to use split-packages for Chromium and Firefox browsers, I'm going to do this as well (current PKGBUILD installs browserpass for both browsers, even if these browsers are not installed). - ttf-emojione (33): Colorful emoji font from EmojiOne. I created a Docker image that is able to compile the font out of image assets, and configured a Travis job for EmojiOne team so that the font is automatically being compiled on every commit and attached to every Github release. - grub-btrfs (15): Detects and includes btrfs snapshots in GRUB menu, allowing to easily boot in any existing snapshot. I personally use grub-btrfs in combination with snap-pac and snap-pac-grub for seamless integration with snapper and pacman. - python-black (10): Python code formatter that quickly gains popularity, I see it being adopted more and more in the community of Python developers, so I want it to be available in [community] repo. - gocryptfs (18): Encrypted overlay filesystem, an alternative for encfs. For all of the above, I'm being active on their Github pages and monitoring new releases using urlwatch. Finally I would like to co-maintain some of the packages that are already in [community] if the current maintainers don't object, I use them myself and participate in their development: - kakoune - kitty - prettier - py3status - urlwatch Sometimes I flag these packages as outdated, but I could just as well bump the versions myself. The above is the bare minimum, I reserve the right to discover more cool projects to maintain and co-maintain :P Cheers, Maxim Baz 1: https://github.com/maximbaz 2: https://lists.archlinux.org/pipermail/pacman-contrib/2018-February/000079.h… 3: https://github.com/maximbaz/pkgbuilds 4: https://www.archlinux.org/todo/buildinfo-rebuild/ 5: https://www.archlinux.org/todo/use-gpg-signatures-and-https-sources/

9 23

[aur-general] TU Membership Application
by Brett Cornwall 16 Nov '18

16 Nov '18

I am being sponsored by dvzrv. I've been working in the AUR since 2014 as 'Ainola'. I've had a few of my packages adopted into [community], such as gnome-mpv, csound, and qutecsound (the latter two being adopted by dvzrv). I am also an active contributor to the LibreOffice infrastructure team. I would like to get valuable tools promoted into [community], such as residualvm or the 'pass' plasmoid (after prodding upstream to have a formal release). Other packages that I do not maintain in the AUR would be ripe for picking as well, such as sc-controller or ttf-lato. I would also work with dvzrv on maintaining pro-audio packages, many of which were abandoned when SpepS left.

8 25

[aur-general] AUR package metadata dump
by Dmitry Marakasov 16 Nov '18

16 Nov '18

Hi! I'm maintainer of Repology.org, a service which monitors, aggregates and compares package vesion accross 200+ package repositories with a purpose of simplifying package maintainers work by discovering new versions faster, improving collaboration between maintainers and giving software authhors a complete overview of how well their projects are packaged. Repology does obviously support AUR, however there were some problems with retrieving information on AUR packages and I think this could be improved. The way Repology currently fetches AUR package data is as follows: - fetch https://aur.archlinux.org/packages.gz - split packages into 100 item packs - fetch JSON data for packages in each pack from https://aur.archlinux.org/rpc/?v=5&type=info&arg[]=<packages> While fetching data from API, Repology does a 1 second pause between requests to not create excess load on the server, but there are still frequent 429 errors. I've tried 2 second delays, but the 429s are still there, and fetch time increases dramatically as we have to do more than 500 requests. Probably API is loaded by other clients as well. I suggest to implement a regularly updated JSON dump of information on all packages and make it available for the site, like packages.gz is. The content should be similar to what https://aur.archlinux.org/rpc/?v=5&type=info would return for all packages at once. This will eliminate the need to access the API and generate load on it, simplify and speed up fetching dramatically for both Repology and possible other clients. Additionally, I'd like to suggest to add information on distfiles to the dump (and probably an API as well for consistency). For instance, Repology checks availability for all (homepage and download) links it retreives from package repositories and reports broken ones so the packages could be fixed. -- Dmitry Marakasov . 55B5 0596 FF1E 8D84 5F56 9510 D35A 80DD F9D2 F77D amdmi3(a)amdmi3.ru ..: https://github.com/AMDmi3

7 13

[aur-general] Spam account: philipjoy6
by Tinu Weber 16 Nov '18

16 Nov '18

Hello Would somebody please take a look at this one? Thank you! https://aur.archlinux.org/account/philipjoy6 Best, Tinu

2 1

[aur-general] chroot clean building and "http 429"
by hagar 16 Nov '18

16 Nov '18

G'Day all, I have been rebuilding all my packages properly in a clean chroot. I wwas writing a smaill script to put all the packages in order and I accidentaly got "http 429". Any Idea how long that lasts? - I figured out what caused it and fixed it. ( damned thing wasnt querying the PKGBUILDS but going online ). But my main question is how do you get around a circular dependancy. eg. mingw-w64-harfbuzz depends on - mingw-w64-freetype2 mingw-w64-freetype2 depends on -mingw-w64-harfbuzz You cant build one unless the other is already built. Is this allowed ? Thanks Macca

4 4