- Arch-dev-public - lists.archlinux.org

[arch-dev-public] RFC Final Comment Period: Store PGP keys for source file signatures alongside PKGBUILDs
by Allan McRae 27 Mar '22

27 Mar '22

An RFC has now entered Final Comment Period. In 14 days, discussion will end and the proposal will either be accepted, rejected or withdrawn: https://gitlab.archlinux.org/archlinux/rfcs/-/merge_requests/11 Please visit the above link for discussion. Summary: Store the PGP signing keys listed in a PKGBUILDs `validpgpkeys` array alongside the PKGBUILD in our VCS. Motivation: The PGP keyserver infrastructure has become increasingly brittle over recent years. This can make helping with updates or rebuilds of packages difficult due to lack of access to the valid signing key. Having the signing key exported alongside the PKGBUILD would allow for anybody to import the key into their keyring and verify the source.

1 1

[arch-dev-public] RFC: Forbid dummy packages from AUR
by Brett Cornwall 24 Mar '22

24 Mar '22

A new RFC (request for comment) has been opened here: https://gitlab.archlinux.org/archlinux/rfcs/-/merge_requests/12 Please visit the above link for discussion. Summary: Reject AUR packages that fulfill package dependencies without providing the files/binaries of the package in question.

3 4

[arch-dev-public] sdl12-compat
by Jelle van der Waa 18 Mar '22

18 Mar '22

Hi all, SDL1 has been deprecated for a while now but we still have some games and programs which depend on it. Fedora started using SDL's compatbility library sdl12-compat which implements sdl1 using sdl2 which means you can run games under wayland, get better controller support and an actual maintainer library. [1] I've packaged sdl12-compat in [community-testing] and it replaces sdl, it was tested with chromium-bsu, caph and dwarffortress which all runs fine under the compatibility layer. Virtualbox and caph were successfully recompiled to test if we can still rebuild SDL1 programs. Please go forth and test :) [1] https://fedoraproject.org/wiki/Changes/SDL12onSDL2 Greetings, Jelle van der Waa

1 0

[arch-dev-public] Disowning some packages
by Felix Yan 17 Mar '22

17 Mar '22

Hi, I am disowning the following packages as an attempt to shorten my TODO and focus on packages I still use. certbot certbot-apache certbot-dns-cloudflare certbot-dns-cloudxns certbot-dns-digitalocean certbot-dns-dnsimple certbot-dns-dnsmadeeasy certbot-dns-gehirn certbot-dns-google certbot-dns-linode certbot-dns-luadns certbot-dns-nsone certbot-dns-ovh certbot-dns-rfc2136 certbot-dns-route53 certbot-dns-sakuracloud certbot-nginx dart python-acme python-jaraco.envs python-pkginfo python-readme-renderer python-sqlalchemy python-telegram-bot python-tqdm ruby-bundler treefrog-framework twine Please consider adopting what you or your packages use. Thanks. -- Regards, Felix Yan

4 3

[arch-dev-public] Arch Linux in February 2022
by Levente Polyak 08 Mar '22

08 Mar '22

## Staff sudoforge has applied [0] to become a Trusted User and the vote is currently in progress. On top we would like to welcome freswa and Foxboron to their new additional duties as Arch Linux Developers. Furthermore we have onboarded the project maintainers Torxed (archinstall) and kevr (aurweb) as Arch Linux support staff. Last but not least we held our bi-yearly Arch Linux Project Leader election where Levente Polyák was re-elected [1]. Further details about future plans, priorities and discussed topics will be posted to our arch-dev-public mailinglist. ## Aurweb With the v6.0.0 release [2], aurweb now runs on Python using the Starlette/FastAPI framework. A complete list of changes from v6.0.0 up to the current patch (v6.0.6) can be viewed at gitlab [3]. Regarding there have been some modifications to the RPC API endpoints which have broken some clients in AUR helpers. ## Toolchain A new toolchain has been released to our stable repositories including gcc 11.2.0, binutils 2.38 and glibc 2.35. Frederik has joined forces with Giancarlo as an additional toolchain maintainer and helps to reduce the workload. ## archlinux-keyring Giancarlo Razzolini has been added as a new main key holder [4] and will provide trust to our packaging keys by verifying and signing them. [0] https://lists.archlinux.org/pipermail/aur-general/2022-January/036781.html [1] https://archlinux.org/news/arch-linux-leader-election-results/ [2] https://lists.archlinux.org/pipermail/aur-general/2022-February/036786.html [3] https://gitlab.archlinux.org/archlinux/aurweb/-/tags [4] https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/commit/bae4859fd…

1 0

[arch-dev-public] News draft: Keycloak 17.0.0-3 update requires manual reconfiguration
by Leonidas Spyropoulos 07 Mar '22

07 Mar '22

The `keycloak` package prior to version 17.0.0-3 was running with WildFly server. Since upstream moved to Quarkus, Arch Linux follows this approach. This means current configurations need to be migrated. The new config location needs to be adjusted from the old `.xml` format to the new `.conf` ``` /etc/keycloak/keycloak.conf ``` The new $HOME of Keycloak is in `/usr/share/java/keycloak` See Keycloak [migration docs](https://www.keycloak.org/migration/migrating-to-quarkus) and Keycloak Quarkus [server docs](https://www.keycloak.org/server/configuration) -- Leonidas Spyropoulos PGP: 59E43E106B247368

1 1

[arch-dev-public] Moving base-devel dependencies to [core]
by Allan McRae 04 Mar '22

04 Mar '22

Hi all, I notice when using devtools, the following packages from [extra] get pulled into our clean build root: extra/gc extra/guile extra/libcroco extra/libsysprof-capture extra/libxml2 These are all dependencies of base-devel packages. I'd like to move them to [core] so they are captured by the signoff process. Thank you for your lack of objection. :) Allan

2 3

[arch-dev-public] Away for most of March
by David Runge 03 Mar '22

03 Mar '22

Hi all, I'll be away for most of March and beginning of April. I still have time sporadically over the next week but will likely not be available for packaging or other things afterwards until the beginning of April. Feel free to upgrade packages that are out-of-date while I'm away. Best, David -- https://sleepmap.de

1 0

[arch-dev-public] RFC: Store PGP keys for source file signatures in SVN
by Allan McRae 02 Mar '22

02 Mar '22

A new RFC (request for comment) has been opened here: https://gitlab.archlinux.org/archlinux/rfcs/-/merge_requests/11 Please visit the above link for discussion. Summary: Store the PGP signing keys listed in a PKGBUILDs `validpgpkeys` array in the trunk directory of SVN. Motivation: The PGP keyserver infrastructure has become increasingly brittle over recent years. This can make helping with updates or rebuilds of packages difficult due to lack of access to the valid signing key. Having the signing key exported along side the PKGBUILD would allow for anybody to import the key into their keyring and verify the source.

1 0

[arch-dev-public] Urgent reminder about packager PGP keys and packages
by David Runge 24 Feb '22

24 Feb '22

Hi all, as mentioned mid January [1] we are currently en-route to deprecating Allan's main signing key [2]. For this purpose I have added 11 rebuild TODOs for packages signed by packager keys that have been superseded by newer ones (and should then also be removed). These packages need to be rebuilt using the new packager key (or any other valid packager key, that is not explicitly mentioned in any of the TODOs), as they block the removal of Allan's main signing key. You can do so with the help of rebuild-todo (which is part of archlinux-contrib). Have a look at its help output for all available options. Please also make sure to setup your current PGP key ID in your archweb profile, so that the information on the website [3] is correct and up-to-date. The following packagers have not yet created a new key and block the effort towards deprecating Allan's signing key as well: - bgyorgy (CE0BDE71A759A87F23F0F7D8B61DBCE10901C163) - archange (69DA34D78FE0EFD596AC6D049D893EC4DAAF9129) - arodseth (962855F072C7A01846405864FCF3C8CB5CF9C8D4) - kylekeen (48C3B1F30DDD0FE67E516D16396E3E25BAB142C1) - farseerfc (4B1DE545A801D4549BFD3FEF90CB3D62C13D4796) Please make sure to create new packager keys, have them signed by at least three main signing keys and rebuild all packages signed by the old packager key until the beginning of April. After that we will start mass-rebuilds of the remaining packages in question and commence with the revocation of Allan's key (which means that the above packager keys can not be used for packaging anymore) unless other blockers come up. If you have questions, please reach out via e-mail, or in #archlinux-staff on libera.chat. Best, David [1] https://lists.archlinux.org/pipermail/arch-dev-public/2022-January/030617.h… [2] https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/issues/148 [3] https://archlinux.org/master-keys/ -- https://sleepmap.de

1 0