On Thu, May 29, 2008 at 4:51 PM, Allan McRae mcrae_allan@hotmail.com wrote:

Hi all,

At the moment anyone can delete a package they maintain from the AUR. This seems to be being exploited by an evil minority to remove packages that have been orphaned. e.g. http://bbs.archlinux.org/viewtopic.php?pid=373831

I thought that it may be better if we restricted the deleting to only devs/TUs so this con no longer happen. (see bug http://bugs.archlinux.org/task/10527). The question is, how often do packages get deleted from the AUR and thus how much work would this generate? I guess it would be in similar volume to what we already get from orphan requests but this is just a guess.

Anyway, pressh suggested I post this here so all TUs would see it.

Allan

And for if it's agreed to disable users deleting packages, here's the patch.

On 5/29/08, Allan McRae mcrae_allan@hotmail.com wrote:

Callan Barrett wrote:

...

And for if it's agreed to disable users deleting packages, here's the

patch.

...

Give the man a prize!

Allan

Are there no other TUs with an opinion about the subject?

On Mon, Jun 2, 2008 at 3:12 PM, Callan Barrett wizzomafizzo@gmail.com wrote:

On Mon, Jun 2, 2008 at 8:52 PM, Ronald van Haren pressh@gmail.com wrote:

...

Are there no other TUs with an opinion about the subject?

I suppose I should post this patch to aur-dev then?

-- Callan Barrett

yes I would say go ahead and submit the patch

On Tue, Jun 3, 2008 at 12:14 AM, w9ya@qrparci.net wrote:

Yes I have an opinion;

Regular users should NEVER be allowed to tamper with a TU's package, including deletion.

-Bob Finch

Liviu Librescu - În veci pomenirea lui. (May his memory be eternal.)

Just so you know, this has always been the case. This patch is to stop users from deleting their own packages in unsupported so, for example, a malicious user couldn't adopt orphaned packages in unsupported and then delete them or a package couldn't be deleted by accident.

On Tue, Jun 3, 2008 at 12:14 AM, w9ya@qrparci.net wrote:

...

Yes I have an opinion;

Regular users should NEVER be allowed to tamper with a TU's package, including deletion.

-Bob Finch

Liviu Librescu - În veci pomenirea lui. (May his memory be eternal.)

Just so you know, this has always been the case. This patch is to stop users from deleting their own packages in unsupported so, for example, a malicious user couldn't adopt orphaned packages in unsupported and then delete them or a package couldn't be deleted by accident.

-- Callan Barrett

Great and thanks for the explanation.

Very best regards;

Bob F.

Liviu Librescu - În veci pomenirea lui. (May his memory be eternal.)

On 03/06/2008, at 9:14 AM, Geoffroy Carrier wrote:

Excerpts from Ronald van Haren's message of Mon Jun 02 17:47:22 +0200 2008:

...

yes I would say go ahead and submit the patch

+1

Check out my great nude pics at http://aur.archlinux.org/

First of all, what?

I thought that it may be better if we restricted the deleting to only devs/TUs so this con no longer happen. (see bug http://bugs.archlinux.org/task/10527) . The question is, how often do packages get deleted from the AUR and thus how much work would this generate? I guess it would be in similar volume to what we already get from orphan requests but this is just a guess.

I don't think packages would get deleted that often at all. The only scenarios I can think of is when an SCM packages becomes obsolete because the SCM changed upstream, or as Callan said, a package was mistakenly uploaded.