- Arch-dev-public - lists.archlinux.org

[arch-dev-public] Away until 2021-06-28
by David Runge 20 Jun '21

20 Jun '21

Hey all, I'll be away for about a week for holidays. If anything urgent comes up, feel free to bump or fix my packages. Best, David -- https://sleepmap.de

1 0

[arch-dev-public] Looking for co-maintainers (and proposal to join cross toolchain packages)
by Filipe Laíns 16 Jun '21

16 Jun '21

Hi all, Over the past few weeks, perhaps months(?), I have been struggling a little bit with mental health and that has made it a bit harder to keep up-to-date with packaging. For this reason, I would like find co-maintainers for my packages, so that it eases things in times like this. Feel free to adopt any of my packages, just let me know via email or IRC that you have done so. https://archlinux.org/packages/?maintainer=FFY00 Some of the packages that give me the most work are the cross toolchains, not because they are difficult to maintain, they aren't, they just take some work. I was wondering if perhaps we could maybe join them together in one single PKGBUILD? Anatol, Eli, NicoHood and Felix maintain the rest of the cross toolchains, so if they agree maybe we could join all architectures into a single PKGBUILD for each component? Cheers, Filipe Laíns

2 1

[arch-dev-public] News draft: sorting old password hashes
by Christian Hesse 06 Jun '21

06 Jun '21

Hello everybody, old password hashes like MD5 are no longer accepted by recent libxcrypt. On next login user may be enforced to update password. To make sure nobody is worried I would like to add install message and news post: --- >8 --- Starting with libxcrypt 4.4.21 weak password hashes are no longer accepted. If you still have one in your shadow file do not worry if you are enforced to update your password on next login. --- >8 --- -- main(a){char*c=/* Schoene Gruesse */"B?IJj;MEH" "CX:;",b;for(a/* Best regards my address: */=0;b=c[a++];) putchar(b-1/(/* Chris cc -ox -xc - && ./x */b/42*2-3)*42);}

3 3

[arch-dev-public] Transitioning out my master key
by Allan McRae 06 Jun '21

06 Jun '21

It is time for my master key to be retired. That can not happen any time soon, as revoking my key means ~25% of packagers will not be able to validly sign packages... For now, I will no longer be signing new packager keys with my master key. I am unlikely to revoke signatures for people who retire from packaging either. Allan

3 2

[arch-dev-public] retracting libxcrypt 4.4.22-1 from [testing]
by Christian Hesse 06 Jun '21

06 Jun '21

Hello everybody, the testing package libxcrypt 4.4.22-1 was reported to be bad... Andreas was forced to change his password on login, which resulted in him being locked out of his system. We are trying to clarify... So I removed libxcrypt from [testing] for the time being. -- main(a){char*c=/* Schoene Gruesse */"B?IJj;MEH" "CX:;",b;for(a/* Best regards my address: */=0;b=c[a++];) putchar(b-1/(/* Chris cc -ox -xc - && ./x */b/42*2-3)*42);}

1 1

[arch-dev-public] TIER 0 Mirror Access for All
by Jelle van der Waa 03 Jun '21

03 Jun '21

Hi All, For everyone with the correct role (Developers, Trusted Users or Support Staff) the tier 0 mirror is available for usage to get the absolute latest packages. The authentication is done with a basic auth which pacman supports and a token has to be generated in archweb to be able to use the mirror. [1] Note that the mirror is mostly useful for rebuilds or when you require the absolute latest packages the server is located in Germany so might not be ideal for everyone. [1] https://archlinux.org/devel/tier0mirror/ Greetings, Jelle van der Waa

1 0

[arch-dev-public] New Arch Linux Developer: Jonas Witschel (diabonas)
by Levente Polyak 15 May '21

15 May '21

I would like to welcome Jonas Witschel (diabonas) among the Arch Linux Developers. Jonas has been a Trusted User since 2019 and lately joined the Arch Linux Security Team. We wish you good luck and joy with your new responsibilities within Arch Linux! cheers, Levente

3 3

[arch-dev-public] GCC 11 and new toolchain on [testing]
by Giancarlo Razzolini 14 May '21

14 May '21

Hi, GCC 11 and a new toolchain rebuild has lended on [testing]. So, until it's moved, if you build anything that uses gcc against testing, it'll have to wait and be moved together. Also, if you guys notice any issues, let me know. Regards, Giancarlo Razzolini

1 0

[arch-dev-public] gnupg 2.3.1-1 pulled from [testing]
by Morten Linderud 11 May '21

11 May '21

Yo! It seems like gnupg 2.3.1-1 was built and pushed to [testing] briefly before being removed. The reason from the removal is because there are changes to how gnupg verifies signatures that depends on the key UIDs being properly signed. In the case of my key, "foxboron(a)archlinux.org" is of marginal trust while "morten(a)linderud.pw" is fully trusted. Since packages are signed with "--sender foxboron(a)archlinux.org" gnupg cares about this trust level starting from 2.3.0-1. This results in failing signature checks if you have this package and attempt to fetch packages signed by me. Related issue: https://dev.gnupg.org/T4735 Why was this removed with no headsup? It caused a fair bit of confusion for a few people and the cause of this issue isn't very clear when packaged fail to verify. Ideally we should have pushed gnupg with an epoch? To testers: The best course of action is to downgrade the gnupg package to 2.2.27-1 from the package archive or your local package cache. https://archive.archlinux.org/packages/g/gnupg/ <sidenote> gnupg is terrible :) </sidenote> -- Morten Linderud PGP: 9C02FF419FECBE16

4 6

[arch-dev-public] Spring cleanup '21
by Antonio Rojas 11 May '21

11 May '21

It's been over a year since our last package cleanup and orphans keep piling up. Please head to https://archlinux.org/devel/reports/unneeded-orphans/ and adopt packages you'd like to keep in the repos. If you are not a dev and would like to adopt some orphan in [extra], reply here or ping me on IRC and I'll move it. I'll start dropping the remaining packages to AUR in about 10 days.

6 8