aurweb v6.5.0 deployed
Hello, aurweb v6.5.0 is now deployed on aur.archlinux.org. - SSH/git push access is re-enabled along with adoption. - Registration remains closed for now. Two changes affect users: Package adoption now requires review. Adopting an orphan, whether from the web interface or via `ssh aur@aur.archlinux.org adopt <pkgbase>`, files an adoption request rather than transferring maintainership immediately. A Package Maintainer must grant it. Only one request can be pending per package base, and requests nobody acts on are rejected automatically after 14 days. Most (real) users remain unaffected but unverified accounts are sent a warning after 7 days and removed after 14. Verifying your address at any time stops this. This cleanup is a preparation for SSO interation when eventually comes along with fighting malicous / spam accounts. Thanks, -- Leonidas Spyropoulos PGP: 244740D17C7FD0EC
Leonidas and others, Thank you all for your hard work. Even if there are a few haters within us, just know we are all incredibly grateful for you guys and your diligent work. Best, User8395 -------- Original Message -------- On Tuesday, 08/11/26 at 07:33 Leonidas Spyropoulos <artafinde@archlinux.org> wrote: Hello, aurweb v6.5.0 is now deployed on aur.archlinux.org. - SSH/git push access is re-enabled along with adoption. - Registration remains closed for now. Two changes affect users: Package adoption now requires review. Adopting an orphan, whether from the web interface or via `ssh aur@aur.archlinux.org adopt <pkgbase>`, files an adoption request rather than transferring maintainership immediately. A Package Maintainer must grant it. Only one request can be pending per package base, and requests nobody acts on are rejected automatically after 14 days. Most (real) users remain unaffected but unverified accounts are sent a warning after 7 days and removed after 14. Verifying your address at any time stops this. This cleanup is a preparation for SSO interation when eventually comes along with fighting malicous / spam accounts. Thanks, -- Leonidas Spyropoulos PGP: 244740D17C7FD0EC
Thanks Leonidas and the arch team for your work maintaining and protecting this ecosystem.
A group of long time users might be assembled to aid with the process
Sign me up if this is something that can help. Salutations, Julien On Tue, Aug 11, 2026 at 5:34 PM User8395 <therealuser8395@proton.me> wrote:
Leonidas and others,
Thank you all for your hard work. Even if there are a few haters within us, just know we are all incredibly grateful for you guys and your diligent work.
Best, User8395
-------- Original Message -------- On Tuesday, 08/11/26 at 07:33 Leonidas Spyropoulos < artafinde@archlinux.org> wrote: Hello,
aurweb v6.5.0 is now deployed on aur.archlinux.org.
- SSH/git push access is re-enabled along with adoption. - Registration remains closed for now.
Two changes affect users:
Package adoption now requires review. Adopting an orphan, whether from the web interface or via `ssh aur@aur.archlinux.org adopt <pkgbase>`, files an adoption request rather than transferring maintainership immediately. A Package Maintainer must grant it. Only one request can be pending per package base, and requests nobody acts on are rejected automatically after 14 days.
Most (real) users remain unaffected but unverified accounts are sent a warning after 7 days and removed after 14. Verifying your address at any time stops this. This cleanup is a preparation for SSO interation when eventually comes along with fighting malicous / spam accounts.
Thanks,
-- Leonidas Spyropoulos PGP: 244740D17C7FD0EC
A group of long time users might be assembled to aid with the process
Sign me up if this is something that can help.
I believe that there should be a process to gain an "assistant" role in order to strengthen us against slop and malware and make the Arch Dev Team's life a little easier. I do not know what it could do, but there are some possible applications for it, such as adoption reviewing, but that could be abused in order for bad actors to inject malware and other malicious software in the AUR. On Tue, Aug 11, 2026 at 6:37 PM Julien Virey <julien.virey@gmail.com> wrote:
Thanks Leonidas and the arch team for your work maintaining and protecting this ecosystem.
A group of long time users might be assembled to aid with the process
Sign me up if this is something that can help.
Salutations, Julien
On Tue, Aug 11, 2026 at 5:34 PM User8395 <therealuser8395@proton.me> wrote:
Leonidas and others,
Thank you all for your hard work. Even if there are a few haters within us, just know we are all incredibly grateful for you guys and your diligent work.
Best, User8395
-------- Original Message -------- On Tuesday, 08/11/26 at 07:33 Leonidas Spyropoulos < artafinde@archlinux.org> wrote: Hello,
aurweb v6.5.0 is now deployed on aur.archlinux.org.
- SSH/git push access is re-enabled along with adoption. - Registration remains closed for now.
Two changes affect users:
Package adoption now requires review. Adopting an orphan, whether from the web interface or via `ssh aur@aur.archlinux.org adopt <pkgbase>`, files an adoption request rather than transferring maintainership immediately. A Package Maintainer must grant it. Only one request can be pending per package base, and requests nobody acts on are rejected automatically after 14 days.
Most (real) users remain unaffected but unverified accounts are sent a warning after 7 days and removed after 14. Verifying your address at any time stops this. This cleanup is a preparation for SSO interation when eventually comes along with fighting malicous / spam accounts.
Thanks,
-- Leonidas Spyropoulos PGP: 244740D17C7FD0EC
On Tue, 2026-08-11 at 14:16 +0300, Leonidas Spyropoulos wrote:
aurweb v6.5.0 is now deployed on aur.archlinux.org.
Thank you very much :)!
I'm happy to hear that there are new features implemented. Is this going to be a burden for Package Maintainers? You might consider offloading the work of adoption acceptance to regular users. Iirc the matter has been discussed here. A group of long time users might be assembled to aid with the process. Registration date could be a measure of trust in this case. You may think of them as trusted users... Pun intended. Best regards Marcin Wieczorek On August 11, 2026 1:16:45 PM GMT+02:00, Leonidas Spyropoulos <artafinde@archlinux.org> wrote:
Hello,
aurweb v6.5.0 is now deployed on aur.archlinux.org.
- SSH/git push access is re-enabled along with adoption. - Registration remains closed for now.
Two changes affect users:
Package adoption now requires review. Adopting an orphan, whether from the web interface or via `ssh aur@aur.archlinux.org adopt <pkgbase>`, files an adoption request rather than transferring maintainership immediately. A Package Maintainer must grant it. Only one request can be pending per package base, and requests nobody acts on are rejected automatically after 14 days.
Most (real) users remain unaffected but unverified accounts are sent a warning after 7 days and removed after 14. Verifying your address at any time stops this. This cleanup is a preparation for SSO interation when eventually comes along with fighting malicous / spam accounts.
Thanks,
A group of long time users might be assembled to aid with the process. Registration date could be a measure of trust in this case. You may think of them as trusted users
I believe the risk here would be the creation of a black market of older accounts, especially if the AUR grows in popularity, so there would still need to be some sort of application process. On Tuesday, August 11th, 2026 at 4:44 PM, Marcin Wieczorek <marcin@marcin.co> wrote:
I'm happy to hear that there are new features implemented. Is this going to be a burden for Package Maintainers? You might consider offloading the work of adoption acceptance to regular users. Iirc the matter has been discussed here. A group of long time users might be assembled to aid with the process. Registration date could be a measure of trust in this case. You may think of them as trusted users... Pun intended.
Best regards Marcin Wieczorek
On August 11, 2026 1:16:45 PM GMT+02:00, Leonidas Spyropoulos <artafinde@archlinux.org> wrote:
Hello,
aurweb v6.5.0 is now deployed on aur.archlinux.org.
- SSH/git push access is re-enabled along with adoption. - Registration remains closed for now.
Two changes affect users:
Package adoption now requires review. Adopting an orphan, whether from the web interface or via `ssh aur@aur.archlinux.org adopt <pkgbase>`, files an adoption request rather than transferring maintainership immediately. A Package Maintainer must grant it. Only one request can be pending per package base, and requests nobody acts on are rejected automatically after 14 days.
Most (real) users remain unaffected but unverified accounts are sent a warning after 7 days and removed after 14. Verifying your address at any time stops this. This cleanup is a preparation for SSO interation when eventually comes along with fighting malicous / spam accounts.
Thanks,
I didn't mean "every user old enough". A web of trust would eventually emerge as it's a well established idea in this community. Of course heavily moderated by the team. Well, what I wanted to convey is that I'm ready to dedicate my spare time to the requests, I'm not trying to invent a new tier of Maintainers. MW On August 11, 2026 9:05:39 PM GMT+02:00, Alice Bartelloni <alice.bartelloni@protonmail.com> wrote: A group of long time users might be assembled to aid with the process. Registration date could be a measure of trust in this case. You may think of them as trusted users I believe the risk here would be the creation of a black market of older accounts, especially if the AUR grows in popularity, so there would still need to be some sort of application process.
Fantastic. Very happy to see adoptions are now queued for review. Appreciate everything, folks. On August 11, 2026 5:16:45 AM CST, Leonidas Spyropoulos <artafinde@archlinux.org> wrote:
Hello,
aurweb v6.5.0 is now deployed on aur.archlinux.org.
- SSH/git push access is re-enabled along with adoption. - Registration remains closed for now.
Two changes affect users:
Package adoption now requires review. Adopting an orphan, whether from the web interface or via `ssh aur@aur.archlinux.org adopt <pkgbase>`, files an adoption request rather than transferring maintainership immediately. A Package Maintainer must grant it. Only one request can be pending per package base, and requests nobody acts on are rejected automatically after 14 days.
Most (real) users remain unaffected but unverified accounts are sent a warning after 7 days and removed after 14. Verifying your address at any time stops this. This cleanup is a preparation for SSO interation when eventually comes along with fighting malicous / spam accounts.
Thanks,
-- Leonidas Spyropoulos PGP: 244740D17C7FD0EC
On Tuesday, August 11th, 2026 at 13:37, Leonidas Spyropoulos <artafinde@archlinux.org> wrote:
Hello,
aurweb v6.5.0 is now deployed on aur.archlinux.org.
I would like to join in expressing my gratitude to all of you for your hard work.
To the AUR team, Thanks to all of you (AUR team members) for your hard work on this. 😎 Best regards, Saqlain Afroz On Tue, 11 Aug 2026 at 16:50, Leonidas Spyropoulos <artafinde@archlinux.org> wrote:
Hello,
aurweb v6.5.0 is now deployed on aur.archlinux.org.
- SSH/git push access is re-enabled along with adoption. - Registration remains closed for now.
Two changes affect users:
Package adoption now requires review. Adopting an orphan, whether from the web interface or via `ssh aur@aur.archlinux.org adopt <pkgbase>`, files an adoption request rather than transferring maintainership immediately. A Package Maintainer must grant it. Only one request can be pending per package base, and requests nobody acts on are rejected automatically after 14 days.
Most (real) users remain unaffected but unverified accounts are sent a warning after 7 days and removed after 14. Verifying your address at any time stops this. This cleanup is a preparation for SSO interation when eventually comes along with fighting malicous / spam accounts.
Thanks,
-- Leonidas Spyropoulos PGP: 244740D17C7FD0EC
On 8/11/26 07:16, Leonidas Spyropoulos wrote:
Hello,
aurweb v6.5.0 is now deployed on aur.archlinux.org.
- SSH/git push access is re-enabled along with adoption. - Registration remains closed for now.
Thank you guys for all your work :) Michael
Hello,
aurweb v6.5.0 is now deployed on aur.archlinux.org.
- SSH/git push access is re-enabled along with adoption. - Registration remains closed for now.
Salutations for your contributions to Arch Linux. On Tue, Aug 11, 2026 at 2:17 PM Leonidas Spyropoulos < artafinde@archlinux.org> wrote:
Hello,
aurweb v6.5.0 is now deployed on aur.archlinux.org.
- SSH/git push access is re-enabled along with adoption. - Registration remains closed for now.
Two changes affect users:
Package adoption now requires review. Adopting an orphan, whether from the web interface or via `ssh aur@aur.archlinux.org adopt <pkgbase>`, files an adoption request rather than transferring maintainership immediately. A Package Maintainer must grant it. Only one request can be pending per package base, and requests nobody acts on are rejected automatically after 14 days.
Most (real) users remain unaffected but unverified accounts are sent a warning after 7 days and removed after 14. Verifying your address at any time stops this. This cleanup is a preparation for SSO interation when eventually comes along with fighting malicous / spam accounts.
Thanks,
-- Leonidas Spyropoulos PGP: 244740D17C7FD0EC
On 8/11/26 6:16 AM, Leonidas Spyropoulos wrote:
aurweb v6.5.0 is now deployed on aur.archlinux.org.
- SSH/git push access is re-enabled along with adoption. - Registration remains closed for now.
Two changes affect users:
Well done, and two very intelligent and needed changes will serve AUR well going forward. I guess the public tar-and-feathering of any AUR user granting adoption to a malicious actor was tabled for now :) Thank you Leonidas! -- David C. Rankin, J.D.,P.E.
participants (12)
-
Alice Bartelloni
-
archlinux.endeared273＠passmail.net
-
David C Rankin
-
Julien Virey
-
Lambros Vyssoulis
-
Leonidas Spyropoulos
-
Marcin Wieczorek
-
Michael Shaw
-
Ralf Mardorf
-
Ryan
-
Saqlain Afroz
-
User8395