- Arch-general - lists.archlinux.org

[arch-general] Stronger Hashes for PKGBUILDs
by fnodeuser 16 Dec '16

16 Dec '16

hello eli, you have misread and misunderstood a few things. reread carefully all the messages about the subject, and check the links in my second email. i will write only about things that are not covered by the previous messages. >Sure they're the same. It is the same underlying technology you have some studying to do about checksums and message digests. >Um, what? `pacman -Syu` does, in fact, check that every package is >signed by a Developer or Trusted User whose key is in archlinux-keyring. what i said is that the users must check the integrity of the sources too. it is not something that only the package maintainers must do. the users must check the PKGBUILD files to compare message digests and key fingerprints. >sha256sums is plenty secure enough. So I assume the Firefox maintainer >uses that mega-file to validate the download, then uses updpkgsums to >update the current sha256sums rather than using copypasta on Firefox's >SHA512SUMS file. no. you will never use less secure than upstream. the best must be used to future-proof also. copypasta? no one said to copy-paste anything without verifying first. >Arch Linux doesn't even have a gnupg1 package, if you want to blame >someone for the absolute inability to validate that key on Arch Linux >(independent of makepkg) blame the GnuPG developers for dropping support >of insecure and tremendously outdated keys. it does not matter. he will download it on his own to verify it, and then he will add the sha512 message digest in the PKGBUILD file to future-proof it. >Assuming they care about being securely identified on IRC. Maybe they do >connect securely when they care about proving their identity for a >specific conversation where it matters. > >I will grant you that for common sense alone you might as well connect >securely whenever possible as it doesn't cost anything. But equally, it >doesn't cost anything to *not* do so. "With great power comes great responsibility." -Uncle Ben AL team members must be responsible with their power. they must follow best security practices.

5 5

[arch-general] Regular service freezes the system
by Jeanette C. 16 Dec '16

16 Dec '16

Hi List, I have encountered this issue several times now. I can't be sure, which job actually freezes the system, a good runner up is updatedb, though I have a feeling that somethi9ng ran after that one. updatedb (mlocate) definitely eats a lot of system resources, eventhough it only concentrates on my internal sata disk with ext3/ext4 only filesystems. The last entries in the journal are related to the update of the mandb. The issue in question doesn't arise every day, thus it may be a service run weekly - or even more infrequently - or some other interaction of my own causes these freezes. I don't always work on my computer around midnight. Can anyone help or guide me in further research, please? Best wishes, Jeanette -------- When you need someone, you just turn around and I will be there <3

1 0

[arch-general] GTK3 theming issues in i3wm
by Giovanni Santini 15 Dec '16

15 Dec '16

Good evening, I started having fun with i3wm. I find myself pretty well with it and my setup is working well... I tried to set up the settings.ini file in the appropriate GTK3 folder, in order to have the same configuration I've in my GNOME Shell setup. But, setting up the GTK style file, makes Firefox totally not working, making the theme to not be used and removing all text from tabs and elsewhere, except the rendered pages. Thunderbird, on the other hand, works perfectly with the same file... And Nautilus doesn't accept the file. An option could be to use the i3-gnome session, but it was pretty broken for me (I wasn't able to exit i3) while normal i3 worked flawlessly. Not sure how can I debug stuff, I will provide here everything needed. Thanks in advance! -- Giovanni Santini My blog: http://giovannisantini.tk My code: https://git{hub,lab}.com/ItachiSan My GPG: 2FADEBF5

1 0

[arch-general] excerpt from typescript file
by Jude DaShiell 11 Dec '16

11 Dec '16

I did software update and in post-install got the following message about systemd. I have an x86-64 machine running bios since it was built in 1994 before efi was a Microsoft dream. (5/8) Upgrading systemd-boot... Couldn't find EFI system partition. It is recommended to mount it to /boot. Alternatively, use --path= to specify path to mount point. [1;31merror: [0mcommand failed to execute correctly --

1 0

[arch-general] virtualbox-bin x-server connection refused
by David C. Rankin 09 Dec '16

09 Dec '16

All, I'm a bit confused with a connection refused from the X-server attempting to start fluxbox within an Arch guest. I don't know if I'm doing something wrong or if I have a module problem after the last kernel update. (dkms says everything was rebuilt) I have the following installed: virtualbox-bin 5.1.8-1 virtualbox-ext-oracle 5.1.8-1 on 4.8.12-3-ARCH I start virtualbox headless $ VBoxManage startvm "arch_1_64" --type headless and then connect to the vm with rdesktop, e.g. $ rdesktop fenrir -u david -g 1280x800 -x l & The connection to the guest is fine, it pops up with the 1152x864 framebuffer resolution I set. If I start it without 'headless', the console starts over ssh and mouse-pointer integration is automatic, just as it should be. But either way, if I attempt to start x, via 'startx' as I do normally with my `.xinitrc` set to launch fluxbox, I get: xinit: unable to connect to X server: Connection refused. The host modules loaded are: 10:58 fenrir:~/cnf/vbox> lsmod | grep box vboxnetflt 28672 0 vboxnetadp 28672 0 vboxpci 24576 0 vboxdrv 385024 4 vboxnetadp,vboxnetflt,vboxpci which I don't see a vboxvideo or vboxsfs, etc.., but that is where my confusion comes in. Since this is 5.1.8 (well after 5.0.8 as mentioned in the wiki) are those modules even used anymore? and if not, do I have all the modules I need? Checking the Xorg.0.log on the guest it complains it can't find 'vboxvideo', 'fbdev' or 'vesa' modules, e.g. 'no screens found(EE)'. Do I need to do something more in the guest after upgrading the kernel there? -- David C. Rankin, J.D.,P.E.

1 0

[arch-general] Apple Super Drive and Arch Linux?
by L. Rose 08 Dec '16

08 Dec '16

Hi, has anyone used the Apple Super Drive external DVD writer with Arch Linux yet? You need to send some magic byte sequence to enable it. The method [0] has worked for me on all debian-based distributions I've used so far, but as I tried it on my Arch Linux today, it didn't work. 1. Super Drive is not visible as /dev/sr0 after being plugged in, only as /dev/bus/usb/001/0xx 2. "sudo sg_raw /dev/bus/usb/001/010 EA 00 00 00 00 00 01" fails with error message "do_scsi_pt: Inappropriate ioctl for device" lsusb lists "Bus 001 Device 010: ID 05ac:1500 Apple, Inc. SuperDrive [A1379]" and dmesg says "usb 1-3: new high-speed USB device number 10 using xhci_hcd". I installed sg3_utils from extra. I suspect Arch Linux being the problem, since it worked on debian before. Any ideas? Thanks in advance, Lukas [0]: https://christianmoser.me/use-apples-usb-superdrive-with-linux/

2 2

[arch-general] Stronger Hashes for PKGBUILDs
by fnodeuser 08 Dec '16

08 Dec '16

checksums and message digests are not the same thing.[1] checksums are not suitable for integrity verification, and the best (meaning, at the time of writing and for the foreseeable future, most secure), currently supported cryptographic hash function algorithm (that is sha512 in AL's case), must be used to compute the message digests of the files. message digests are one of the things that we can and must use for security. not all upstreams have https enabled and not all of them sign their files with gpg. it was because of me that the 'Use gpg signatures and https sources' task was added to the todo list.[2][3][4] these things must be checked by the users also, not only by the package maintainers. i check everything, most of you check nothing. you just do 'pacman -Syu'. let us start with firefox's PKGBUILD file for the first example. you are using sha256mds instead of sha512mds. you can see at https://ftp.mozilla.org/pub/firefox/releases/50.0.2/, that there are 3 files, KEY, SHA512SUMS, and SHA512SUMS.asc. that is one example where you are using a smaller digest size than upstream, that cannot be verified with the signature. another example is nmap's PKGBUILD file. you continued to use sha1mds instead of sha512mds.[5] in Gentoo they use 3 mds and in Debian they use 2 mds (for all packages, regardless of what upstreams do or do not do (in Debian's case they sign the files containing the mds)).[6][7] there are a few package maintainers who insist on using and/or are still using only a part of the commit or tag hash. the whole commit or tag hash must be used, always. the refusal to future-proof.[8] i talked with the lsof upstream. he told me that he has retired, that he is old, and that he might stop maintaining it. it is unlikely that he will create a new keypair any time soon and he might never do that. another bad thing that many AL team members do, is connecting to irc servers without using tls and certificate verification. that is all for now. _ [1] https://en.wikipedia.org/wiki/Checksum, https://en.wikipedia.org/wiki/Cryptographic_hash_function [2] https://bugs.archlinux.org/task/51579 [3] https://lists.archlinux.org/pipermail/arch-dev-public/2016-October/028416.h… [4] https://bugs.archlinux.org/index.php?opened=23845&status[]=, https://bugs.archlinux.org/index.php?opened=23412&status[]=, and https://bugs.archlinux.org/index.php?opened=23101&status[]= [5] https://nmap.org/dist/sigs/nmap-7.31.tar.bz2.digest.txt [6] https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/firefox/Manifest [7] https://ftp.acc.umu.se/debian/pool/main/f/firefox/firefox_50.0.2-1.dsc [8] https://bugs.archlinux.org/task/50482

2 1

[arch-general] Systemd services start by default
by sivmu 08 Dec '16

08 Dec '16

Today I noticed there were network services running on my system. I DON'T have have permanently running network services. WTF happened? Systemd happened! Or rather systemd-resolved and the systemd time sync daemon. It seems that a recent update set those services to start by default. I thought I would let you know and maybe this is worth an announcement because I won't be the only one not happy about systemd enableing services an my system that I don't need/want.

6 7

[arch-general] gnupg failing strangely
by Magnus Therning 08 Dec '16

08 Dec '16

The last few days I've noticed issues with GnuPG. I'm using `gpg-agent` as my `ssh-agent` and that's were I noticed strangeness first. I can't add keys: ~~~ $ ssh-add /home/lmagnus/.ssh/id_ecdsa_github Enter passphrase for /home/lmagnus/.ssh/id_ecdsa_github: Could not add identity "/home/lmagnus/.ssh/id_ecdsa_github": agent refused operation ~~~ and now I found that I can't encrypt files: ~~~ $ gpg -c TODO gpg: cancelled by user gpg: error creating passphrase: Operation cancelled gpg: symmetric encryption of 'TODO' failed: Operation cancelled ~~~ Anyone else seeing similar behaviour? I'm seeing this behaviour on both the latest package, 2.1.16, and the previous, 2.1.15 (both -1 and -2). I've not dared go back further than that since 2.14 complains "libreadline.so.6: cannot open shared object file". /M -- Magnus Therning OpenPGP: 0x927912051716CE39 email: magnus(a)therning.org jabber: magnus(a)therning.org twitter: magthe http://therning.org/magnus Do not meddle in the affairs of Wizards, for they are subtle and quick to anger. — J.R.R Tolkien

1 0

[arch-general] GRUB doesn't boot Windows behind Secure Boot
by Giovanni Santini 07 Dec '16

07 Dec '16

Good afternoon, I have been using GRUB for a long time, but I'm having a strange issue. My setup consists of ArchLinux as main OS and Windows 10 and Ubuntu 12.04 as secondary OSes. Turning up Secure Boot in my firmware options results in such an error when chainloading Windows: /EndEntire file path: /ACPI(yadda)/PCI(yadda)/Sata(0,0,0)/HD(yaddayadda)/File(\EFI\Microsoft\Boot)/File(bootmgfw.efi)/EndEntire error: cannot load image. The strange thing is that disabling Secure Boot make it works. Not really sure what I'm missing here. -- Giovanni Santini My blog: http://giovannisantini.tk My code: https://git{hub,lab}.com/ItachiSan My GPG: 2FADEBF5

2 3