- Aur-general - lists.archlinux.org

[aur-general] Cabal-install-git package
by Markus Ongyerth 14 May '17

14 May '17

Hello, I created a PKGBUILD for cabal-install (from git) and wanted to upload it to the aur. [1] When I fetched the repository from the server, I got a PKGBUILD that already exists, but isn't listed on the website. #archlinux on freenode told me, that can happen when a repository was deleted from the aur. Is it possible to get my version in? Or was it removed, because a git HEAD version of cabal-install is considered superseeded by something from the official repos? ongy [1] https://github.com/Ongy/cabal-install-PKGBUILD

4 3

[aur-general] Can we have optional deps on AUR packages?
by Sven-Hendrik Haase 19 Apr '17

19 Apr '17

I just wanted to clear this up with the other TUs: Is it ok for [community] packages to have optional deps on AUR packages or not?

3 3

[aur-general] aursec - blockchain-based verification of AUR packages
by Bennett Piater 13 Apr '17

13 Apr '17

Hello, we are pleased to announce the release of aursec [0], a tool which aims to improve the security of using the AUR. We are writing it as part of our Bachelor's thesis. It provides a secure hash database in a private Ethereum blockchain that stores hashes for specific package versions. The hash that was submitted from the most different users becomes the consensus and can be queried and compared against. The hash is formed from the PKGBUILD, install files and VCS sources, thereby adding a layer of verification on top of that provided by the hashes in the PKGBUILD. The threat model [1] we defend against is targeted attacks against specific AUR users, e.g. using a hostile takeover and subsequent modification of an orphan package, that would be reverted and therefore likely not noticed. If the target used aursec, he would see that his package has a different hash from what other users got. Aursec takes a build folder containing a PKGBUILD and .SRCINFO and does all the work automatically. It calls makepkg --verifysrc in a firejail sandbox to download VCS sources and find out the current version. Example use: $aursec ~/aur/foo $find -type d ~/aur | aursec We would greatly appreciate feedback on the threat model, solution, and the usability of the tool itself. Cheers, Bennett Piater and Lukas Krismer [0]: https://aur.archlinux.org/packages/aursec [1]: https://vps1.piater.name/file-sharing/r/_q35eP3Y89#wqDp8+hB9C22GdKrH4nD/HP1… -- GPG fingerprint: 871F 1047 7DB3 DDED 5FC4 47B2 26C7 E577 EF96 7808

1 0

[aur-general] git push - Permissions denied
by Dan B 06 Apr '17

06 Apr '17

Package: aur.archlinux.org/libcs50 > » git push > Enter passphrase for key '/home/krakn/.ssh/id_rsa': > git-receive-pack: permission denied: krakn > fatal: Could not read from remote repository. > > Please make sure you have the correct access rights and the repository exists. Remotes are as follows (I am able to clone the repository): > » git remote -v > origin ssh://aur@aur.archlinux.org/libcs50 (fetch) > origin ssh://aur@aur.archlinux.org/libcs50 (push) I have no problems pushing to my other repositories. Is there something on the backend that might be preventing the push? Thanks!

3 4

[aur-general] first package submission
by David CARLIER 05 Apr '17

05 Apr '17

Hi all, I wished to submit this new package, the only thing is the main source file needs to be taken from the url (e.g needs a registration) but that s all so I dunno if I can apply for submitting this to aur ? Kind regards.

4 4

[aur-general] Deletion requests
by Konstantin Gizdov 04 Apr '17

04 Apr '17

Hi all, So I updated my packages and had other people also update theirs so that pythia8 and xrootd-abi0 are now completely redundant. I submitted requests for deletion a while ago and I am just writing to confirm that they can be safely removed. No packages have them as dependencies and I have even overprovisioned with 'provide' statements in the now correct pythia and xrootd packages. Thanks. Regards, Konstantin

2 1

[aur-general] Should "base" packages be listed as dependencies?
by Baptiste Jonglez 30 Mar '17

30 Mar '17

Hi, I was pretty confident that "base" packages should be listed as dependencies in PKGBUILDs, i.e. they are not assumed to be installed (as opposed to "base-devel" for build dependencies). This belief is reinforced by the fact that namcap gives dependencies error about packages such as glibc (which is in "base"): E: Dependency glibc detected and not included (libraries ['usr/lib/libc.so.6', 'usr/lib/libcrypt.so.1'] needed in files ['usr/lib/libcli.so.1.9.7']) But I could not find any documentation about this. On the contrary, this wiki page [1] says the opposite: In addition, the base group is assumed to be installed on *all* Arch systems. Am I missing something obvious? Thanks, Baptiste [1] https://wiki.archlinux.org/index.php/Makepkg#Usage

16 32

[aur-general] Review and a bit of other help request
by Konstantin Gizdov 29 Mar '17

29 Mar '17

Hi all, So I have now for quite a while been the maintainer for the following: root root-extra pythia8 xrootd-abi0 (this exists as a work around for other maintainer not updating package) unuran root5 (legacy and poorly supported for GCC 5+, need help here especially) and just adopted pythia. I've actually put quite a bit of work in some of them. With the latest changes upstream here and there, I am planning to re-optimize the builds, but I wanted to first ask for some input from this list and gather some suggestions. My main focus is making CERN's ROOT and it's relevant dependencies/extensions work on Arch. I started and mainly concentrate on root and root-extra. Pythia, XRootD, Unuran are such extensions which were not available or broken in Arch. So I had to make 'pythia8' and 'xrootd-abi0' as workarounds. I have now finally been able to adopt 'pythia' and plan on making a major re-write and optimization. I still have to keep 'xrootd-abi0' as the current maintainer does not really update or fix his package when new versions/problems arise. I do not plan on making an orphan request, as I do not want to cause trouble for people. However, I do wish to make the current environment as good as possible for the people that actually use it and would welcome any input from you. Thanks in advance. Apart from that I wanted to understand better if and how package signing works with AUR. I tried the wiki and a bit of Google, but so far it seems package signing is only for official repos/trusted users. I did not want to try it out myself before getting some advice as I was afraid messing up will prevent people from installing them. Regards, Konstantin

4 16

[aur-general] Aur password reset link doesn't send mail
by Taha Konuk 29 Mar '17

29 Mar '17

Hello, I want to reset my aur login password but after I enter my email address to get a reset link I don't receive the mail. My account is on this mail. Can you guys help me? Thanks

3 2

[aur-general] Trusted User application
by m4sk1n＠vivaldi.net 17 Mar '17

17 Mar '17

Hello, I'm Marcin Mikołajczak (on AUR 'm4sk1n') and I would like to become Arch User Repository Trusted User. I was born in Poland in 2001. I am Arch Linux user for about one year. I have recommended it to some people, a lot of them have switched from Windows to Manjaro. I understand bash scripting. Now I spend a lot of time on learning C++. Currently I'm maintainer of 5 packages in AUR and I can take care of more of them. The current ones are 'xnots-git', 'otter-browser-weekly', 'otter-browser-git' and two Xfce components (git checkout). I'm working on Polish translations of some open source projects (like Xfce, WINE, Otter Browser...). Of source I know how to use Git. My main non-technical interest is music, mainly electronic. If I become a TU I would like to push 'otter-browser' package to [community] repo. I would also adopt some packages, maybe music-related? Best way to contact me is IRC (freenode, as m4sk1n, I'm on 'arch-linux', 'arch-linux-aur' and 'arch-linux-newbie'). That's all, thanks for reading it, Best regards, m4sk1n

3 2