Are you suggesting that every AUR package that is up to date with master where there is a -git package should be removed? bbswitch-ati-dkms-git 0.8.5.gddbd243-1 3 bbswitch-ati-git 0.8.5.gddbd243-1 darling r3131.fa5348c8a-1 darling-git r3131.fa5348c8a-1 yay 11.1.0-1 yay-git 11.1.0.r0.gac13060-1 AUR rules https://wiki.archlinux.org/title/AUR_submission_guidelines#Rules_of_submissi... “If it is currently maintained, changes can be submitted in a comment for the maintainer's attention. If it is unmaintained or the maintainer is unresponsive, the package can be adopted and updated as required. Do not create duplicate packages.“ It’s not a duplicate, it’s the pegged non-git package which uses a specific commit. The package was merged because I removed myself from the mailing list and didn’t reply stating that the issues were resolved. Why did you merge instead of suggesting changes? And why do you want the package deleted so urgently? Jan 15, 2022, 20:00 by env252525@gmail.com:

It is still a duplicate. There are no releases upstream. What's the point of having a non git version if it's just going to follow the latest git commit anyway?

Yes this matter was resolved. The package was merged. That is why anbox-modules-dkms should not exist.

On Sat, Jan 15, 2022 at 4:08 PM <info@sick.codes> wrote:

...

Hey eNV25,

Just because the non-git and git packages are on the same commit id does not mean the whole package should be wiped and its changelog, comments, AUR git history, and any other informative discussion should be deleted.

Once master is updated, the non-git will be out of date. That's what Out of Date is for.

# non-git source=("git+>> https://github.com/choff/${_pkgname}.git#commit=8148a162755bf5500a07cf41a65a02c8f3eb0af9 <https://github.com/choff/$%7B_pkgname%7D.git#commit=8148a162755bf5500a07cf41a65a02c8f3eb0af9>>> "

# git source=("git+$url#branch=master")

As you know your original Merge Request reasons were already addressed.

Merge request: >> https://lists.archlinux.org/pipermail/aur-requests/2021-December/063155.html

Fixes: >> https://aur.archlinux.org/cgit/aur.git/commit/?h=anbox-modules-dkms&id=8790fadcc199ff742f1f21b1530675b8efca46b5

And: >> https://aur.archlinux.org/cgit/aur.git/commit/?h=anbox-modules-dkms&id=20a63e6c219e218edc49731cc21c2b3db1336e0b

- Removed the build function from previous 2017 maintainer - Removed linux-headers from previous 2017 maintainer - Removed /usr/lib/modules-load.d/ from previous 2017 maintainer

I didn't create the original pkgbuild, I simply revived it as-is, including it's git history for transparency. I didn't write the original PKGBUILD. I re-uploaded it with accurate git history so that anyone else can actually see the commit history of the package: >> https://aur.archlinux.org/cgit/aur.git/log/?h=anbox-modules-dkms

Given you are well aware I was actively maintaining the package, why would you submit a merge request instead of emailing me or submit a pull request?

I really don't understand your sudden urgency to remove the package from the AUR.

Why did you merge instead of suggesting changes?

And why do you want the package deleted so urgently?

In good faith,

Sick Codes of the Security Research Team >> @SickCodes <https://twitter.com/sickcodes>

https://sick.codes https://github.com/sickcodes https://twitter.com/sickcodes https://www.linkedin.com/in/sickcodes/ https://www.youtube.com/c/sickcodes https://parler.com/profile/sickcodes/ https://hackerone.com/sickcodes https://bugcrowd.com/sickcodes https://hub.docker.com/r/sickcodes

Jan 15, 2022, 09:05 by >> env252525@gmail.com>> :

...

On Sat, Jan 15, 2022 at 11:10 AM <info@sick.codes> wrote:

...

This is a false deletion request, the maintainer knows this is a correct non-git dkms PKGBUILD

I don't think so.

...

https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=anbox-modules-dkms

The maintainer discussion between myself and the other maintainer is on >>>> https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=anbox-modules-dkms

I don’t we know what the current maintainer is trying to achieve here but the two packages are distinct.

1) I personally maintain the fork with the GitHub user

fine

...

2) I had already made env25 a co maintainer

And I made you a co-maintainer for anbox-modules-dkms-git

...

3) I am on the WayDroid dev team

It's not relevant who you are

...

2) this fork was created by myself and Choff

fine

...

3) the non-git is perfectly fine now

No it's not it's a duplicate of anbox-modules-dkms-git

...

4) eNV25 has already merged requested this, in a rush, for no apparent reason.

The TU ainola merged this. I submitted the request.

https://lists.archlinux.org/pipermail/aur-requests/2021-December/063155.html https://lists.archlinux.org/pipermail/aur-requests/2021-December/063596.html

...

Please reject this merge & deletion request for the following reasons:

Please don't reject this deletion request.

...

And if possible please merge back the non-git repo comment history as you can clearly see

I have been maintaining the WIKI on Anbox to be accurate >>>> https://wiki.archlinux.org/title/Anbox

fine

...

In good faith,

Sick Codes of the Security Research Team @SickCodes

https://sick.codes https://github.com/sickcodes https://twitter.com/sickcodes https://www.linkedin.com/in/sickcodes/ https://www.youtube.com/c/sickcodes https://parler.com/profile/sickcodes/ https://hackerone.com/sickcodes https://bugcrowd.com/sickcodes https://hub.docker.com/r/sickcodes

Jan 14, 2022, 22:57 by >>>> notify@aur.archlinux.org>>>> :

eNV25 [1] filed a deletion request for anbox-modules-dkms [2]:

This package is a duplicate of anbox-modules-dkms-git.

I previously submitted a merge request from anbox-modules-dkms to anbox-modules-dkms-git.

I maintain anbox-modules-dkms-git.

[1] >>>> https://aur.archlinux.org/account/eNV25/ [2] >>>> https://aur.archlinux.org/pkgbase/anbox-modules-dkms/

anbox-modules-dkms follows last working commit with the patch for 5.10 anbox-modules-dkms-git follows master branch with sed instead of a patch https://wiki.archlinux.org/title/VCS_package_guidelines#Guidelines “Suffix pkgname with -cvs, -svn, -hg, -darcs, -bzr, -git etc. unless the package fetches a specific release.” The commit is in the PKGBUILD, as there are no releases. Said commit is 8148a162755bf5500a07cf41a65a02c8f3eb0af9" `source=("git+https://github.com/choff/${_pkgname}.git#commit=8148a162755bf5500a07cf41a65a02c8f3eb0af9"` Jan 15, 2022, 23:59 by env252525@gmail.com:

bbswitch-ati-dkms-git bbswitch-ati-git are split packages from the same PKGBUILD. Of course they have same version.

darling is a duplicate of darling-git

yay follows upstream release, yay-git follows git branch

On Sat, Jan 15, 2022 at 9:57 PM <info@sick.codes> wrote:

...

Are you suggesting that every AUR package that is up to date with master where there is a -git package should be removed?

bbswitch-ati-dkms-git 0.8.5.gddbd243-1 3 bbswitch-ati-git 0.8.5.gddbd243-1

darling r3131.fa5348c8a-1 darling-git r3131.fa5348c8a-1

yay 11.1.0-1 yay-git 11.1.0.r0.gac13060-1

AUR rules https://wiki.archlinux.org/title/AUR_submission_guidelines#Rules_of_submissi...

“If it is currently maintained, changes can be submitted in a comment for the maintainer's attention. If it is unmaintained or the maintainer is unresponsive, the package can be adopted and updated as required. Do not create duplicate packages.“

It’s not a duplicate, it’s the pegged non-git package which uses a specific commit.

The package was merged because I removed myself from the mailing list and didn’t reply stating that the issues were resolved.

Why did you merge instead of suggesting changes?

Your package is git package that does not have -git sufflix.

...

And why do you want the package deleted so urgently?

It's not urgent.

...

Jan 15, 2022, 20:00 by env252525@gmail.com:

It is still a duplicate. There are no releases upstream. What's the point of having a non git version if it's just going to follow the latest git commit anyway?

Yes this matter was resolved. The package was merged. That is why anbox-modules-dkms should not exist.

On Sat, Jan 15, 2022 at 4:08 PM <info@sick.codes> wrote:

Hey eNV25,

Just because the non-git and git packages are on the same commit id does not mean the whole package should be wiped and its changelog, comments, AUR git history, and any other informative discussion should be deleted.

Once master is updated, the non-git will be out of date. That's what Out of Date is for.

# non-git source=("git+https://github.com/choff/${_pkgname}.git#commit=8148a162755bf5500a07cf41a65a02c8f3eb0af9"

# git source=("git+$url#branch=master")

As you know your original Merge Request reasons were already addressed.

Merge request: https://lists.archlinux.org/pipermail/aur-requests/2021-December/063155.html

Fixes: https://aur.archlinux.org/cgit/aur.git/commit/?h=anbox-modules-dkms&id=8790fadcc199ff742f1f21b1530675b8efca46b5

And: https://aur.archlinux.org/cgit/aur.git/commit/?h=anbox-modules-dkms&id=20a63e6c219e218edc49731cc21c2b3db1336e0b

- Removed the build function from previous 2017 maintainer - Removed linux-headers from previous 2017 maintainer - Removed /usr/lib/modules-load.d/ from previous 2017 maintainer

I didn't create the original pkgbuild, I simply revived it as-is, including it's git history for transparency. I didn't write the original PKGBUILD. I re-uploaded it with accurate git history so that anyone else can actually see the commit history of the package: https://aur.archlinux.org/cgit/aur.git/log/?h=anbox-modules-dkms

Given you are well aware I was actively maintaining the package, why would you submit a merge request instead of emailing me or submit a pull request?

I really don't understand your sudden urgency to remove the package from the AUR.

Why did you merge instead of suggesting changes?

And why do you want the package deleted so urgently?

In good faith,

Sick Codes of the Security Research Team @SickCodes

https://sick.codes https://github.com/sickcodes https://twitter.com/sickcodes https://www.linkedin.com/in/sickcodes/ https://www.youtube.com/c/sickcodes https://parler.com/profile/sickcodes/ https://hackerone.com/sickcodes https://bugcrowd.com/sickcodes https://hub.docker.com/r/sickcodes

Jan 15, 2022, 09:05 by env252525@gmail.com:

On Sat, Jan 15, 2022 at 11:10 AM <info@sick.codes> wrote:

This is a false deletion request, the maintainer knows this is a correct non-git dkms PKGBUILD

I don't think so.

https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=anbox-modules-dkms

The maintainer discussion between myself and the other maintainer is on https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=anbox-modules-dkms

I don’t we know what the current maintainer is trying to achieve here but the two packages are distinct.

1) I personally maintain the fork with the GitHub user

fine

2) I had already made env25 a co maintainer

And I made you a co-maintainer for anbox-modules-dkms-git

3) I am on the WayDroid dev team

It's not relevant who you are

2) this fork was created by myself and Choff

fine

3) the non-git is perfectly fine now

No it's not it's a duplicate of anbox-modules-dkms-git

4) eNV25 has already merged requested this, in a rush, for no apparent reason.

The TU ainola merged this. I submitted the request.

https://lists.archlinux.org/pipermail/aur-requests/2021-December/063155.html https://lists.archlinux.org/pipermail/aur-requests/2021-December/063596.html

Please reject this merge & deletion request for the following reasons:

Please don't reject this deletion request.

And if possible please merge back the non-git repo comment history as you can clearly see

I have been maintaining the WIKI on Anbox to be accurate https://wiki.archlinux.org/title/Anbox

fine

In good faith,

Sick Codes of the Security Research Team @SickCodes

https://sick.codes https://github.com/sickcodes https://twitter.com/sickcodes https://www.linkedin.com/in/sickcodes/ https://www.youtube.com/c/sickcodes https://parler.com/profile/sickcodes/ https://hackerone.com/sickcodes https://bugcrowd.com/sickcodes https://hub.docker.com/r/sickcodes

Jan 14, 2022, 22:57 by notify@aur.archlinux.org:

eNV25 [1] filed a deletion request for anbox-modules-dkms [2]:

This package is a duplicate of anbox-modules-dkms-git.

I previously submitted a merge request from anbox-modules-dkms to anbox-modules-dkms-git.

I maintain anbox-modules-dkms-git.

[1] https://aur.archlinux.org/account/eNV25/ [2] https://aur.archlinux.org/pkgbase/anbox-modules-dkms/

Thanks for pointing that out Jonathon, Ill fix it tomorrow, as I have done in the past when requested changes. I have concerns about the intent of the user requesting the deletion; for some unknown reason the request came out of thin air to an actively maintained package, created a duplicate -git, removed all Contributors to the header comment, then filed a merge request, which was merged even after changes had been made. env25 suggested I add pkgver. I took the users word for it and the user did not cancel the original merge request which moved all the history of non git to the git repo. It was approved as I wasn’t subscribed at the time to the mailing list, and didn’t respond on the list. I certainly responded in the comments however, as per the guidelines. Env25 was a brand new account but knew everything about the AUR which can insinuate multiple conclusions. All I care about is the security of the package. The package history which I have kept in absolute full had been dormant since 2017. I decided to revive it after almost 5 years and I’m actively maintaining it. I have no attachment to the package, however I’m just concerned for the security of the package which at the time was from a brand new user, yet knew everything about the AUR process. The most appropriate thing to do is merge the -git package back into non git, which restores all the comment history including Fabio’s original suggestions to fix, to which I addressed. Then env25 should recreate the git package as all of the historical and important comments were moved to the new one and make no sense as there’s now no git history, no previous maintainer information, no changelog, nowhere to submit PR, and does not respond to comments. I don’t understand why eNV25 was in a rush to merge the package yet knows I’m trivially contactable. Now wants to delete the pinned package, which helps nobody who wants to use it. That’s my security paranoid hat on, but I still don’t get the logic behind why the user was in a rush to take over a highly maintained package. I added a forewarning to the wiki specifically to address security with the package https://wiki.archlinux.org/title/Anbox#Security Regards, In good faith, Sick Codes of the Security Research Team @SickCodes <https://twitter.com/sickcodes> https://sick.codes https://github.com/sickcodes https://twitter.com/sickcodes https://www.linkedin.com/in/sickcodes/ https://www.youtube.com/c/sickcodes https://parler.com/profile/sickcodes/ https://hackerone.com/sickcodes https://bugcrowd.com/sickcodes https://hub.docker.com/r/sickcodes Jan 16, 2022, 04:21 by aur-requests@lists.archlinux.org:

On 15/01/2022 19:00, Sick Codes via aur-requests wrote:

...

anbox-modules-dkms follows last working commit with the patch for 5.10

anbox-modules-dkms-git follows master branch with sed instead of a patch

As of [1], anbox-modules-dkms is pinned to upstream commits. It is therefore not a VCS package (and doesn't need a pkgver() function, so I'm not sure why one was added).

The sed and patch are now a moot point as 5.10 is no longer in the repos (and looking at the discussion on [2] I'm not convinced either approach is the correct one).

[1] https://aur.archlinux.org/cgit/aur.git/commit/?h=anbox-modules-dkms&id=d77ac721b2e845eb537f23f936287f8b6bbb0363 [2] https://github.com/choff/anbox-modules/pull/1

Thanks for that, No, there are infinite reasons to have all of -bin -git and non-git packages. Docker containers, upstream changes, security holes in newer/older versions, cloud installs, automation etc. Not everyone is on the Mailing List + Forums + Reddit + IRC + Discord etc. AUR security is at the absolute top of my check-list. Most AUR users don't want actively maintained packages to be randomly transferred to brand new users (at the time), with absolutely no historical proof of trust (at the time). I invite you to evaluate my trustworthiness: https://github.com/sickcodes/security/tree/master/advisories. I happily added you as a co-maintainer. Then the merge went thru, expecting you were going to cancel the request. In my opinion, as you were well aware all of the merge requests items were addressed, you should've cancelled the merge request last month. That's why I am concerned. I'm not attached, I'm concerned about the security of the project. Users still need a pinned version, as do many others on 5.10, 5.11, 5.12, 5.13, 5.14, 5.15, etc. You knew the fixes were made and should've cancelled the merge. Contact the maintainer politely next time, like other AUR users do when they request updates, and similarly, I contact package maintainers with tips. A) contact the maintainer B) create a -git and file a merge request You chose option B

2021-12-11 12:21 -git created by @eNV25 2021-12-11 14:21 [PRQ#30507] Merge Request for anbox-modules-dkms notify at aur.archlinux.org notify at aur.archlinux.org by @eNV25

You created a -git version and merge requested 2 hours later. Why would you merge instead of simply contacting me to fix it? I honestly considered the intial request a malicious request, which at the time, was from a brand new account. I would prefer to pkgver using pkgver=5 and pkgrel=15.14, so as to reflect the last supported kernel. All of your requests in the merge request were already fixed and in good faith I believe you probably should've honored your statement to cancel the merge: - Uses git source without a -git pkgname suffix.

Fixed before merge https://github.com/sickcodes/aur/commit/dffca947ee02be66fe4ea54682a6d5ae1195...

- Is not a proper DKMS package.

Yes it is. See https://wiki.archlinux.org/title/DKMS_package_guidelines

  - It doesn't use DKMS hooks. It instead runs make install in build().

It was moved and there are no release binaries from the GitHub project, which would be a -bin anyway.

  - It depends on linux-headers.

That was fixed before the merge: https://github.com/sickcodes/aur/commit/5e900cd21fc4d6729bb9d41f0bbc47f060cf...

  - It installs **/dkms.conf to /usr/lib/modules-load.d/ for some reason.

Also fixed before the merge: https://github.com/sickcodes/aur/commit/5e900cd21fc4d6729bb9d41f0bbc47f060cf...

These were all addressed before the merge, to which you agreed. The fact you didn't cancel the merge concerns me. sickcodes commented on 2021-12-13 01:24        Removed the build function from previous maintainer     Removed linux-headers from previous maintainer     Removed /usr/lib/modules-load.d/ from previous maintainer     Added 5.10 patch https://aur.archlinux.org/packages/anbox-modules-dkms-git/#comment-840564 That's why I was more than happy to add you as a co-maintainer. For example 5.16.0-rc5-1 wasn't working: ==> dkms install --no-depmod binder/1 -k 5.15.14-1-lts ==> dkms install --no-depmod ashmem/1 -k 5.16.0-arch1-1 ==> dkms install --no-depmod ashmem/1 -k 5.16.0-rc5-1-git-00224-g9eaa88c7036e Error! Bad return status for module build on kernel: 5.16.0-rc5-1-git-00224-g9eaa88c7036e (x86_64) Consult /var/lib/dkms/ashmem/1/build/make.log for more information. ==> WARNING: `dkms install --no-depmod ashmem/1 -k 5.16.0-rc5-1-git-00224-g9eaa88c7036e' exited 10 ==> dkms install --no-depmod binder/1 -k 5.16.0-arch1-1 ==> dkms install --no-depmod ashmem/1 -k 5.16.0-zen1-1-zen ==> dkms install --no-depmod ashmem/1 -k 5.15.14-1-lts ==> dkms install --no-depmod binder/1 -k 5.16.0-zen1-1-zen Users need a non-git pegged version if upstream changes, thats the end of the story. In good faith, Sick Codes of the Security Research Team @SickCodes <https://twitter.com/sickcodes> https://sick.codes https://github.com/sickcodes https://twitter.com/sickcodes https://www.linkedin.com/in/sickcodes/ https://www.youtube.com/c/sickcodes https://parler.com/profile/sickcodes/ https://hackerone.com/sickcodes https://bugcrowd.com/sickcodes https://hub.docker.com/r/sickcodes Jan 16, 2022, 10:46 by env252525@gmail.com:

On Sun, Jan 16, 2022 at 7:07 AM <info@sick.codes> wrote:

...

Thanks for pointing that out Jonathon, Ill fix it tomorrow, as I have done in the past when requested changes.

I have concerns about the intent of the user requesting the deletion; for some unknown reason the request came out of thin air to an actively maintained package, created a duplicate -git, removed all Contributors to the header comment, then filed a merge request, which was merged even after changes had been made.

env25 suggested I add pkgver. I took the users word for it and the user did not cancel the original merge request which moved all the history of non git to the git repo. It was approved as I wasn’t subscribed at the time to the mailing list, and didn’t respond on the list. I certainly responded in the comments however, as per the guidelines.

I did not suggest adding pkgver(). I said a proper VCS package also needs pkgver(). I never suggested any changes.

Even if I did, it is you who added the change.

...

Env25 was a brand new account but knew everything about the AUR which can insinuate multiple conclusions.

What are you insinuating? Please stop this useless discussion.

...

All I care about is the security of the package. The package history which I have kept in absolute full had been dormant since 2017. I decided to revive it after almost 5 years and I’m actively maintaining it.

I have no attachment to the package, however I’m just concerned for the security of the package which at the time was from a brand new user, yet knew everything about the AUR process.

I made you a co-maintainer for anbox-modules-dkms-git.

The original package was a VCS package that did not have a -git suffix. You changed to pin a specific commit just to keep an unneeded package there, it does look like you are attached to the package.

...

The most appropriate thing to do is merge the -git package back into non git, which restores all the comment history including Fabio’s original suggestions to fix, to which I addressed.

Then env25 should recreate the git package as all of the historical and important comments were moved to the new one and make no sense as there’s now no git history, no previous maintainer information, no changelog, nowhere to submit PR, and does not respond to comments.

I wrote the PKGBUILD for anbox-modules-dkms-git from scratch, there's no need for Git history.

...

I don’t understand why eNV25 was in a rush to merge the package yet knows I’m trivially contactable.

Your package was a VCS package. This request is separate.

...

Now wants to delete the pinned package, which helps nobody who wants to use it.

What's the use for the pinned package? There is no use if you are just going to update it every commit.

...

That’s my security paranoid hat on, but I still don’t get the logic behind why the user was in a rush to take over a highly maintained package.

I don't consider taking an old PKGBUILD and uploading it to AUR as is, a highly maintained package.

...

I added a forewarning to the wiki specifically to address security with the package https://wiki.archlinux.org/title/Anbox#Security

Regards,

In good faith,

Sick Codes of the Security Research Team @SickCodes

https://sick.codes https://github.com/sickcodes https://twitter.com/sickcodes https://www.linkedin.com/in/sickcodes/ https://www.youtube.com/c/sickcodes https://parler.com/profile/sickcodes/ https://hackerone.com/sickcodes https://bugcrowd.com/sickcodes https://hub.docker.com/r/sickcodes

Jan 16, 2022, 04:21 by aur-requests@lists.archlinux.org:

On 15/01/2022 19:00, Sick Codes via aur-requests wrote:

anbox-modules-dkms follows last working commit with the patch for 5.10

anbox-modules-dkms-git follows master branch with sed instead of a patch

As of [1], anbox-modules-dkms is pinned to upstream commits. It is therefore not a VCS package (and doesn't need a pkgver() function, so I'm not sure why one was added).

The sed and patch are now a moot point as 5.10 is no longer in the repos (and looking at the discussion on [2] I'm not convinced either approach is the correct one).

[1] https://aur.archlinux.org/cgit/aur.git/commit/?h=anbox-modules-dkms&id=d77ac721b2e845eb537f23f936287f8b6bbb0363 [2] https://github.com/choff/anbox-modules/pull/1