Problem with deleted package
Hello, I am the maintainer of the sofa package. A few days ago I received an odd message regarding a deletion request with the reason being "dead source". I went and checked and saw no problem with the source ( [ https://www.iausofa.org/ | https://www.iausofa.org/ ] ). Looking through the interface I could not find any way to answer to the request. I had a lot of work, so I dropped the matter thinking the request would simply be dismissed as it was obviously in error. However, I received a message that this was carried out. At no point was I contacted by a human, I only ever received the cryptic automated messages that were not helpful in addressing the problem. The situation worries me a bit as this could be an attempt to hijack a low-visibility package. Besides contacting the person who has carried out the deletion, which I just did, what procedure should I follow to ensure that there is no ill-intention and that the package is fully restored? Thanks you very much. Regards, Médéric Boquien
Hello again, For what it is worth, the package has suddenly reappeared on AUR with its git history. However, it is not registered under my name anymore but that of Navigator, aka Yury Bobylev. The plot thickens … Regards, Médéric
Hi Médéric,
For what it is worth, the package has suddenly reappeared on AUR with its git history. However, it is not registered under my name anymore but that of Navigator, aka Yury Bobylev. The plot thickens … I don’t have any info about who deleted your package and why. However, I can confirm that technically, anyone is free to re-upload a package that was previously deleted. That re-upload always preserves the Git history of the deleted package. That’s how AURweb is implemented.
So it’s pretty common to observe this kind of Wiedergänger. Even though in terms of policy, re-uploading a package that was previously deleted is heavily frowned upon unless there’s a good reason to do so. Regards Claudia
Hello,
I don’t have any info about who deleted your package and why.
The deletion request was sent by qubeck (no contact info) with the motivation "dead source" and it was carried out by Muflone. As I mentioned, the motivation did not make sense to me as the source is alive and well.
So it’s pretty common to observe this kind of Wiedergänger. Even though in terms of policy, re-uploading a package that was previously deleted is heavily frowned upon unless there’s a good reason to do so.
In practice that means I was disowned of this package without anything I could do (I could not answer the deletion request and no human got in touch with me to confirm). I find this problematic and somewhat worrisome regarding security. At any rate, how can I proceed to that the package ownership is reverted back to me? Thank you very much! Regards, Médéric Boquien
Hi Médéric,
In practice that means I was disowned of this package without anything I could do (I could not answer the deletion request and no human got in touch with me to confirm). I find this problematic and somewhat worrisome regarding security.
I agree with you in that the deletion process could be much more user friendly. The simplest thing you could have done is fix the issue before the grace period was up. In case this happens to you again and you’d rather dispute the issue, there’s several ways to get an AUR moderator’s attention to make your case. Every deletion request opens a new thread on aur-requests [1]; you can post a reply there, or open a thread here on aur-general like you did (but ideally before the grace period ends). You can also reach out on IRC in #archlinux-aur. However, note that AUR moderators generally don’t personally reach out to PKGBUILD owners who are at the receiving end of a deletion request. The request itself always has a comment that states the reason for the request, so during the grace period, the ball is in your court, not in the AUR moderator’s.
At any rate, how can I proceed to that the package ownership is reverted back to me? Thank you very much!
The best way for you to proceed would be responding to the question Muflone has asked in this thread (“Do you plan to fix this package using a valid URL where to download the sources or can I give the package sofa to the user requesting to become the maintainer?”). Regards Claudia [1]: https://lists.archlinux.org/archives/list/aur- requests@lists.archlinux.org
Hello
I am the maintainer of the sofa package. A few days ago I received an odd message regarding a deletion request with the reason being "dead source". I went and checked and saw no problem with the source (https://www.iausofa.org/). Looking through the interface I could not find any way to answer to the request. I had a lot of work, so I dropped the matter thinking the request would simply be dismissed as it was obviously in error. However, I received a message that this was carried out. At no point was I contacted by a human, I only ever received the cryptic automated messages that were not helpful in addressing the problem. The situation worries me a bit as this could be an attempt to hijack a low-visibility package. Besides contacting the person who has carried out the deletion, which I just did, what procedure should I follow to ensure that there is no ill-intention and that the package is fully restored? Thanks you very much.
I've received multiple emails and requests so I'll try to summary all them here: The AUR package sofa [1] uses as source URL where to download the sources an invalid URL [2] which shows a page stating:
We couldn't find the page you were looking for. This is either because:
* There is an error in the URL entered into your web browser. Please check the URL and try again. * The page you are looking for has been moved or deleted.
You can return to our homepage by clicking here <https://www.iausofa.org/>, or you can try searching for the content you are seeking by clicking here <https://www.iausofa.org/search>.
Therefore the package cannot be built anymore until you have a previously downloaded copy of the sources or an alternative URL where to download them. One week ago someone filed a deletion request [3] for this package being unusable and unbuildable for the previous reason. I left the request for some days allowing you to fix the package and today I checked again the package and it still was including the broken URL previously indicated, without any change to the package, without any answer in the AUR page comments, without and reply to the deletion request. For this reason the package was correctly deleted. If you want to maintain this package again, you can but make sure to set a valid URL where to get the sources. For the future, the package requests [4] can be found on the aur-requests mailing list [5] As a general rule, if you'd fixed the package, it wouldn't be deleted. There's nothing sketchy here, a deleted package can be adopted by anyone and for a broken package anyone can ask to delete it. Let's move to now. A user named Navigator has uploaded the same (broken) package and he's asking to become the new maintainer [6]. Do you plan to fix this package using a valid URL where to download the sources or can I give the package sofa to the user requesting to become the maintainer? Best regards [1] https://aur.archlinux.org/packages/sofa [2] http://www.iausofa.org/2023_1011_C/sofa_c-20231011.tar.gz [3] https://lists.archlinux.org/archives/list/aur-requests@lists.archlinux.org/t... [4] https://wiki.archlinux.org/title/AUR_submission_guidelines#Requests [5] https://lists.archlinux.org/archives/list/aur-requests@lists.archlinux.org/ [6] https://lists.archlinux.org/archives/list/aur-requests@lists.archlinux.org/t... -- Muflone
Hello,
Let's move to now. A user named Navigator has uploaded the same (broken) package and he's asking to become the new maintainer [6]. Do you plan to fix this package using a valid URL where to download the sources or can I give the package sofa to the user requesting to become the maintainer?
Thank you for the summary and explanations and overall patience with me. All this happened at the worst possible moment for me work-wise. As the website was responding fine, I did not understand the "dead source" message in particular as I would have expected a simple message from qubeck for a broken link rather than a deletion request. At any rate, I looked again, this time more carefully, and I see that the path differs slightly ( [ https://www.iausofa.org/s/sofa_c-20231011tar.gz | https://www.iausofa.org/s/sofa_c-20231011tar.gz ] vs [ https://www.iausofa.org/s/sofa_c-20231011tar.gz | https://www.iausofa.org/sofa_c-20231011tar.gz ] ). Naturally I can fix this easily if the package is sent back to me. Thank you very much! Regards, Médéric Boquien
On 9/14/26 08:08, mboquien@free.fr wrote:
Hello,
Let's move to now. A user named Navigator has uploaded the same (broken) package and he's asking to become the new maintainer [6]. Do you plan to fix this package using a valid URL where to download the sources or can I give the package sofa to the user requesting to become the maintainer?
Thank you for the summary and explanations and overall patience with me. All this happened at the worst possible moment for me work-wise. As the website was responding fine, I did not understand the "dead source" message in particular as I would have expected a simple message from qubeck for a broken link rather than a deletion request. At any rate, I looked again, this time more carefully, and I see that the path differs slightly (https://www.iausofa.org/s/sofa_c-20231011tar.gz vs https://www.iausofa.org/sofa_c-20231011tar.gz <https://www.iausofa.org/s/sofa_c-20231011tar.gz>). Naturally I can fix this easily if the package is sent back to me. Thank you very much!
Regards,
Médéric Boquien
I agree that orphan/deletion requests and even the flagging process can be experienced as hostile when you're maintaining packages. I had quite a few outdated packages a while ago, I'll admit. So it's not like I myself was doing a good job at that time. But then I received around ~10 emails at once about out-of-date flags, orphan and deletion requests. I even unflagged a few packages that I started to update already, only to have them flagged again within a few minutes. This particularly felt very hostile. The whole process is very un-human. You only get some automated notifications with minimal words. And while there's a quick and easy way to file a request, there's no quick or easy way to respond to them. The email you receive doesn't even indicate how to respond to the request, it doesn't mention any grace period, and it is sent with "Reply-to: noreply@aur.archlinux.org". The person who flagged my packages and filed orphan/deletion requests may just have been running some script. And I appreciate AUR cleanups. But the way this gets to the maintainer is definitely not nice. I think the whole process would be hugely improved if you can respond directly to requests on the AUR website, rather than having to subscribe to a high volume mailinglist full of automated messages. But at the very least the automated emails could have a link to a wiki page explaining these procedures. And please, please, don't reply with something "you're a maintainer, it's your responsibility to be informed of procedures and how to respond to AUR requests" or something else that just boils down to "deal with it". Sure, people should read, but we are all humans. Even people who maintain software packages are usually people. So please don't just dismiss this kind of feedback out of hand. Kind regards, Maarten de Vries
Hi Maarten,
But at the very least the automated emails could have a link to a wiki page explaining these procedures.
A good first step would be adding this information to the wiki in the first place. I think a good place for that info to live is the Requests section of the AUR guidelines [1]. If you (or anyone else) want to help out, feel free to discuss your suggestion with the wiki maintainers in #archlinux-wiki on IRC, or on the talk page of the article.
Sure, people should read, but we are all humans. Even people who maintain software packages are usually people.
So are the AURweb developers and AUR moderators.
So please don't just dismiss this kind of feedback out of hand.
On the contrary. I agree in that the current process is not exactly user-friendly. This has been stated many times. No matter how justified your criticism is, please understand that the AUR is a piece of software from the noughties. It was never developed with a 2020s internet and audience in mind, not technically nor in terms of scale nor standards of user expectations. Arch Linux developers don’t have the capacity to fix all of these issues as quickly as one might expect. The best thing you can do is understand that we acknowledge the issues and exercise some patience, and ideally help out with crafting some documentation. Regards Claudia [1]: https://wiki.archlinux.org/title/AUR_submission_guidelines#Requests
On 9/14/26 10:16, Claudia Pellegrino wrote:
Hi Maarten,
Hey, Thanks for your kind reply.
But at the very least the automated emails could have a link to a wiki page explaining these procedures.
A good first step would be adding this information to the wiki in the first place. I think a good place for that info to live is the Requests section of the AUR guidelines [1]. If you (or anyone else) want to help out, feel free to discuss your suggestion with the wiki maintainers in #archlinux-wiki on IRC, or on the talk page of the article.
Right, good point. I will see if I can find the time for this, I'm also terribly busy, but I don't like to only complain and expect others to fix it.
Sure, people should read, but we are all humans. Even people who maintain software packages are usually people.
So are the AURweb developers and AUR moderators.
So please don't just dismiss this kind of feedback out of hand.
On the contrary. I agree in that the current process is not exactly user-friendly. This has been stated many times. No matter how justified your criticism is, please understand that the AUR is a piece of software from the noughties. It was never developed with a 2020s internet and audience in mind, not technically nor in terms of scale nor standards of user expectations. Arch Linux developers don’t have the capacity to fix all of these issues as quickly as one might expect. The best thing you can do is understand that we acknowledge the issues and exercise some patience, and ideally help out with crafting some documentation.
Regards Claudia
[1]: https://wiki.archlinux.org/title/AUR_submission_guidelines#Requests
Of course, I also understand this. And I also think usually the replies from Arch Linux project members tend to be balanced. It's just that I've seen a lot of messages from other users on the list that rush to defend Arch Linux. That is nice in itself, but it tends to result in a knee-jerk reaction that completely ignores the feedback itself and distracts from the actual content. I did not mean to imply that the Arch Linux project members don't take feedback serious. Again, thanks for your reply. I will try to find the time to update the wiki, and see if I can send a PR to the AUR website too once the wiki has a good page to link to. Kind regards, Maarten de Vries
On Mon, 2026-09-14 at 10:16 +0200, Claudia Pellegrino wrote:
Arch Linux developers don’t have the capacity to fix all of these issues as quickly as one might expect.
Apropos issues and capacities. Hi, the arch general mailing list has been quiet for the past 3 weeks. Emails I sent on August 29 and today aren't getting through. Is everything okay with the mailing list? This morning I sent an email to the list owner, so it hasn't been that long, and it's to be expected that I haven't received a reply yet. However, I thought I'd check again here just to be on the safe side, in case the email to arch-general-owner...lists.archlinux.org didn't go through. Regards, Ralf
Hello
Let's move to now. A user named Navigator has uploaded the same (broken) package and he's asking to become the new maintainer [6]. Do you plan to fix this package using a valid URL where to download the sources or can I give the package sofa to the user requesting to become the maintainer?
Thank you for the summary and explanations and overall patience with me. All this happened at the worst possible moment for me work-wise. As the website was responding fine, I did not understand the "dead source" message in particular as I would have expected a simple message from qubeck for a broken link rather than a deletion request. At any rate, I looked again, this time more carefully, and I see that the path differs slightly (https://www.iausofa.org/s/sofa_c-20231011tar.gz vs https://www.iausofa.org/sofa_c-20231011tar.gz <https://www.iausofa.org/s/sofa_c-20231011tar.gz>). Naturally I can fix this easily if the package is sent back to me. Thank you very much!
I had no access to my email until now but you were re-assigned as maintainer for the package sofa. I see you also already updated the package fixing the broken link. Best regards -- Muflone
participants (5)
-
archlinux＠m.de-vri.es
-
Claudia Pellegrino
-
mboquien＠free.fr
-
Muflone
-
Ralf Mardorf