January 2022 - Aur-requests - lists.archlinux.org

[aur-requests] [PRQ#31497] Deletion Request for anbox-modules-dkms
by notify＠aur.archlinux.org 19 Jan '22

19 Jan '22

eNV25 [1] filed a deletion request for anbox-modules-dkms [2]: This package is a duplicate of anbox-modules-dkms-git. I previously submitted a merge request from anbox-modules-dkms to anbox-modules-dkms-git. I maintain anbox-modules-dkms-git. [1] https://aur.archlinux.org/account/eNV25/ [2] https://aur.archlinux.org/pkgbase/anbox-modules-dkms/

1 1

[aur-requests] [PRQ#31510] Merge Request for anbox-modules-dkms-git
by notify＠aur.archlinux.org 19 Jan '22

19 Jan '22

sickcodes [1] filed a request to merge anbox-modules-dkms-git [2] into anbox-modules-dkms [3]: This is a false deletion request, the maintainer knows this is a correct non-git dkms PKGBUILD https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=anbox-modules- dkms The maintainer discussion between myself and the other maintainer is on https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=anbox- modules-dkms I don’t we know what the current maintainer is trying to achieve here but the two packages are distinct. 1) I personally maintain the fork with the GitHub user 2) I had already made env25 a co maintainer 3) I am on the WayDroid dev team 2) this fork was created by myself and Choff 3) the non-git is perfectly fine now 4) eNV25 has already merged requested this, in a rush, for no apparent reason. Please reject this merge & deletion request for the following reasons: And if possible please merge back the non-git repo comment history as you can clearly see I have been maintaining the WIKI on Anbox to be accurate https://wiki.archlinux.org/title/Anbox In good faith, Sick Codes of the Security Research Team @SickCodes [1] https://aur.archlinux.org/account/sickcodes/ [2] https://aur.archlinux.org/pkgbase/anbox-modules-dkms-git/ [3] https://aur.archlinux.org/pkgbase/anbox-modules-dkms/

3 3

[aur-requests] [PRQ#31578] Deletion Request for ruby-psych
by notify＠aur.archlinux.org 19 Jan '22

19 Jan '22

Segaja [1] filed a deletion request for ruby-psych [2]: moved to [community] - https://archlinux.org/packages/community/x86_64/ruby-psych/ [1] https://aur.archlinux.org/account/Segaja/ [2] https://aur.archlinux.org/pkgbase/ruby-psych/

1 1

Re: [aur-requests] [PRQ#31497] Deletion Request for anbox-modules-dkms
by info＠sick.codes 19 Jan '22

19 Jan '22

Pkgver() was removed which also made makedeb work for non-arch packaging Versioning changed to to 5.15-1 to reflect last known working kernel version and released: https://github.com/sickcodes/anbox-modules-dkms/releases Maintained here: https://github.com/sickcodes/aur/blob/master/anbox-modules-dkms/PKGBUILD 5.16 doesn’t compile so -git will now not work on latest kernel an update is made upstream. A non git is absolutely necessary for this package, the so please reject 31497 and if possible merge back the important comment history from https://aur.archlinux.org/packages/anbox-modules-dkms-git/ which was merged two months ago https://aur.archlinux.org/packages/anbox-modules-dkms-git/#comment-841570 This package is required for all of these: https://aur.archlinux.org/packages/?O=0&SeB=nd&K=Anbox&outdated=&SB=n&SO=a&… Jan 16, 2022, 08:37 by aur-requests(a)lists.archlinux.org: > Thanks for pointing that out Jonathon, Ill fix it tomorrow, as I have done in the past when requested changes. > > I have concerns about the intent of the user requesting the deletion; for some unknown reason the request came out of thin air to an actively maintained package, created a duplicate -git, removed all Contributors to the header comment, then filed a merge request, which was merged even after changes had been made. > > env25 suggested I add pkgver. I took the users word for it and the user did not cancel the original merge request which moved all the history of non git to the git repo. It was approved as I wasn’t subscribed at the time to the mailing list, and didn’t respond on the list. I certainly responded in the comments however, as per the guidelines. > > Env25 was a brand new account but knew everything about the AUR which can insinuate multiple conclusions. > > All I care about is the security of the package. The package history which I have kept in absolute full had been dormant since 2017. I decided to revive it after almost 5 years and I’m actively maintaining it. > > I have no attachment to the package, however I’m just concerned for the security of the package which at the time was from a brand new user, yet knew everything about the AUR process. > > The most appropriate thing to do is merge the -git package back into non git, which restores all the comment history including Fabio’s original suggestions to fix, to which I addressed. > > Then env25 should recreate the git package as all of the historical and important comments were moved to the new one and make no sense as there’s now no git history, no previous maintainer information, no changelog, nowhere to submit PR, and does not respond to comments. > > I don’t understand why eNV25 was in a rush to merge the package yet knows I’m trivially contactable. > > Now wants to delete the pinned package, which helps nobody who wants to use it. > > That’s my security paranoid hat on, but I still don’t get the logic behind why the user was in a rush to take over a highly maintained package. > > I added a forewarning to the wiki specifically to address security with the package > https://wiki.archlinux.org/title/Anbox#Security > > Regards, > > In good faith, > > Sick Codes of the Security Research Team > @SickCodes <https://twitter.com/sickcodes> > > https://sick.codes > https://github.com/sickcodes > https://twitter.com/sickcodes > https://www.linkedin.com/in/sickcodes/ > https://www.youtube.com/c/sickcodes > https://parler.com/profile/sickcodes/ > https://hackerone.com/sickcodes > https://bugcrowd.com/sickcodes > https://hub.docker.com/r/sickcodes > > > Jan 16, 2022, 04:21 by aur-requests(a)lists.archlinux.org: > >> On 15/01/2022 19:00, Sick Codes via aur-requests wrote: >> >>> anbox-modules-dkms follows last working commit with the patch for 5.10 >>> >>> anbox-modules-dkms-git follows master branch with sed instead of a patch >>> >> >> As of [1], anbox-modules-dkms is pinned to upstream commits. It is therefore not a VCS package (and doesn't need a pkgver() function, so I'm not sure why one was added). >> >> The sed and patch are now a moot point as 5.10 is no longer in the repos (and looking at the discussion on [2] I'm not convinced either approach is the correct one). >> >> [1] https://aur.archlinux.org/cgit/aur.git/commit/?h=anbox-modules-dkms&id=d77a… >> [2] https://github.com/choff/anbox-modules/pull/1 >> > >

1 0

[aur-requests] [PRQ#31577] Deletion Request for ruby-stringio
by notify＠aur.archlinux.org 19 Jan '22

19 Jan '22

Segaja [1] filed a deletion request for ruby-stringio [2]: moved to [community]: https://archlinux.org/packages/community/any/ruby-stringio/ [1] https://aur.archlinux.org/account/Segaja/ [2] https://aur.archlinux.org/pkgbase/ruby-stringio/

1 1

[aur-requests] [PRQ#31572] Deletion Request for bear
by notify＠aur.archlinux.org 19 Jan '22

19 Jan '22

grawlinson [1] filed a deletion request for bear [2]: Package is in the community repository now. Thanks for maintaining! :) [1] https://aur.archlinux.org/account/grawlinson/ [2] https://aur.archlinux.org/pkgbase/bear/

1 1

[aur-requests] [PRQ#31570] Orphan Request for gnome-shell-extension-hidetopbar-git
by notify＠aur.archlinux.org 19 Jan '22

19 Jan '22

amfern [1] filed an orphan request for gnome-shell-extension- hidetopbar-git [2]: Hi, After emailing the owner and receiving no response, I would like to take ownership and update this package. [1] https://aur.archlinux.org/account/amfern/ [2] https://aur.archlinux.org/pkgbase/gnome-shell-extension-hidetopbar-git/

1 1

[aur-requests] [PRQ#31527] Deletion Request for pipewire-dropin
by notify＠aur.archlinux.org 19 Jan '22

19 Jan '22

dvzrv [1] filed a deletion request for pipewire-dropin [2]: Once pipewire-jack >= 1:0.3.43-2 is in [extra], jack will be provided (conflicting with jack2). [1] https://aur.archlinux.org/account/dvzrv/ [2] https://aur.archlinux.org/pkgbase/pipewire-dropin/

1 1

[aur-requests] [PRQ#31526] Deletion Request for pipewire-jack-replacement
by notify＠aur.archlinux.org 19 Jan '22

19 Jan '22

dvzrv [1] filed a deletion request for pipewire-jack-replacement [2]: This uses the wrong JACK headers (jack1 instead of jack2) and is generally not supported. Somewhat related, with pipewire-jack >= 1:0.3.43-2 jack will be provided. [1] https://aur.archlinux.org/account/dvzrv/ [2] https://aur.archlinux.org/pkgbase/pipewire-jack-replacement/

1 1

[aur-requests] [PRQ#31568] Deletion Request for pipewire-jack-replacement
by notify＠aur.archlinux.org 19 Jan '22

19 Jan '22

juicemaguice [1] filed a deletion request for pipewire-jack- replacement [2]: Doesn't perform intended task [1] https://aur.archlinux.org/account/juicemaguice/ [2] https://aur.archlinux.org/pkgbase/pipewire-jack-replacement/

1 1