- Arch-devops - lists.archlinux.org

[arch-devops] Accidentally broke /srv/ftp on nymeria
by Florian Pritz 10 Mar '16

10 Mar '16

Hi, I've accidentally removed some files from /srv/ftp on nymeria by running a find -delete command with incorrectly ordered arguments. I'm currently restoring from our backups and mirrors though this might take a while because the transfer speed is really slow for reasons I don't know yet. I have also disabled rsyncd for now to prevent mirrors from deleting files as well. I currently don't expect any data loss, but let's see. Florian

3 4

Re: [arch-devops] [arch-dev-public] Integrity Check x86_64: core, extra, community, multilib 04-03-2016
by Bartłomiej Piotrowski 09 Mar '16

09 Mar '16

On 2016-03-04 16:39, repomaint(a)archlinux.org wrote: > Summary > --------- > Missing PKGBUILDs: 1 > Invalid PKGBUILDs: 1 > Mismatching PKGBUILD names: 0 > Duplicate PKGBUILDs: 0 > Invalid archs: 0 > Missing (make)dependencies: 20 > Repo hierarchy problems: 500 > Circular dependencies: 6 > In db, but not in tree: 4 > In tree, but not in db: 7 Where is this script located? I don't think we care about repo hierarchy problem related to makedependencies, I'd like to know what "invalid" PKGBUILD means. I really doubt anyone pays attention to these e-mails since Andrea left, so decluttering the message would be a good first step to change this. Bartłomiej

3 3

[arch-devops] Upgrade SSL CAs to SHA-2
by Sébastien Luttringer 29 Feb '16

29 Feb '16

Hello, I upgraded the luna intermediate CA and RootCA to the new StartSSL certs with SHA-2 signatures. The *.archlinux.org certs is still using SHA-1 signature (so no green bar) which expire this April. Should we move to Letsencrypt or do we still want to use the star certificate? Cheers, -- Sébastien "Seblu" Luttringer https://seblu.net | Twitter: @seblu42 GPG: 0x2072D77A

2 1

[arch-devops] [RFC] Planning testing of the new dbscripts
by Florian Pritz 24 Feb '16

24 Feb '16

Hi, CC'in arch-dev-public just so everyone gets a heads-up. Please send all discussion to arch-devops. A long long time ago in a galaxy far, far away.... No wait, just a long long time ago. Work on improving dbscripts[1] has resumed and thanks to Gabriel Souza Franco we finally have something[2] that should easily support git packages as well as debug packages, split packages across multiple repos and with different arches. It has lots of new tests, but it could really use a field test and we need to figure out how we want to deploy it once we are satisfied. Please note that the wiki page is not entirely up to date, especially everything other than the migration plan. [1] https://wiki.archlinux.org/index.php/User:Bluewind/dbscripts-rewrite [2] https://github.com/gbsf/dbscripts/commits/master The new dbscripts no longer change the svn repo so the repos subdir is not needed any more. All they require is some form of a tag (like a git tag) to fetch the PKGBUILD. This means we are pretty much free to use whatever we like (including git) as long as we can tag stuff. For the time being we can stick with svn if we like. Using tags obviously requires that the existing repositories are migrated and that devs/TUs use the new scripts that generate them. This migration is required for the new svn layout and if we switch to git. It is probably a good idea to do both at once so people don't have to update twice, but I'll only do that if we plan this thoroughly. Currently we treat also extra/core and community separately, but I think there is no real reason for that apart from that we migrated it like that from gerolde. If possible, I'd like to get rid of this distinction. RFC: As for testing, I'd like some input on my (rather preliminary) migration plan[3] and opinions on whether we want to test it directly on nymeria or somewhere else. [3] https://wiki.archlinux.org/index.php/User:Bluewind/dbscripts-rewrite#Migr= ation_Plan Florian

2 1

[arch-devops] Arch Linux ISO Checksums on archlinux.org
by Christian Rebischke 24 Feb '16

24 Feb '16

Hello, Linux Mint had a security breach [1] and was serving an infected ISO. I think this would be a good moment for thinking about our Arch Linux Download-page on [2]. I recommend to change the checksums. MD5 and SHA1 are both broken.[3][4] What do you think about using SHA256 ( or even better SHA512 ) for this? Maybe we should also sign the ISO with a GPG-Key. I don't mean that we should remove the MD5 checksum but we should add some other checksum and sign the ISO. You can call me paranoid but I don't want too see such a security fail on archlinux.org Best regards, Chris Arch Linux Security Team [1] http://arstechnica.com/security/2016/02/linux-mint-hit-by-malware-infection… [2] https://www.archlinux.org/download/ [3] http://www.mathstat.dal.ca/~selinger/md5collision/ [4] https://www.schneier.com/blog/archives/2015/10/sha-1_freestart.html

5 5

[arch-devops] Arch DevOps mailing list
by Sébastien Luttringer 23 Feb '16

23 Feb '16

Hello, A new arch-devops mailing list has been added to lists.archlinux.org. The list should be used to discuss Arch Linux infrastructure and operations topics. Permission scheme are based on arch-dev-public; list is open for subscription to anyone and writing only for Arch Linux Staff. So, the moderation flag should be removed by mail to be able to write. If you can't do it, ping me. Cheers, -- Sébastien "Seblu" Luttringer https://seblu.net | Twitter: @seblu42 GPG: 0x2072D77A

6 7

[arch-devops] Email delivery issues to Microsoft
by Florian Pritz 12 Feb '16

12 Feb '16

Hi, Just a quick update to our email situation: Microsoft seems to think we are sending spam mails. I believe this to be related to spam comments posted on the aur. SNDS shows that spam started to be sent on February 6th/7th. Can we track down if a spam comment has been posted on that day? I've enabled Microsoft's Junk Mail Reporting Program (I get the reports I think) and I've contacted their postmaster support. Let's hope they fix the problem or reply. Apart from that I also noticed that I forgot to disable soft_bounce again after I set up DKIM. This might be related since a single mail that is rejected would end up retrying for days even if it is rejected with 550. Yahoo is also still blocking us and doesn't seem impressed that we now have DKIM. Florian

1 1

[arch-devops] DKIM on luna and nymeria
by Florian Pritz 02 Feb '16

02 Feb '16

Hi, Just a quick note: I've set up opendkim on luna and nymeria in the hope that this will help us deliver mail to yahoo again. Florian

2 2

[arch-devops] restricted access to arch-security@archlinux.org for senders
by Christian Rebischke 14 Jan '16

14 Jan '16

Hello, I am Chris from Arch Linux Security Team and I want to ask for restricted acess for senders for the arch-security mailinglist.[1] We had different issues in the past on this list including: - neverending discussions.[2] - broken MTAs (the newest one). Some emails from somebody are bouncing back to the mailinglist.[3] That's the reason why the security-team want a whitelist for this mailinglist. Everybody can subscribe but sending to it should be restricted to avoid this issues. I would be fine with it if the restriction is for everyone except the Arch Linux Developers, Trusted Users, and staff. If you want even more agressive rules I would be also fine if only our security team and some developers can write to it. According to my mail on the arch-dev-public mailinglist the security mailinglist should be for Arch Linux Security Advisories only.[4] best regards Christian Rebischke Member of Arch Linux Security Team [1] arch-security(a)archlinux.org [2] https://lists.archlinux.org/pipermail/arch-security/2015-December/000441.ht… [3] https://paste.archlinux.de/KAV1/ [4] https://lists.archlinux.org/pipermail/arch-dev-public/2015-December/027581.…

2 1