- Arch-general - lists.archlinux.org

[arch-general] ensuring integrity of sources (was: [arch-dev-public] todo list for moving http -> https sources)
by Patrick Burroughs (Celti) 01 Nov '16

01 Nov '16

On Mon, 31 Oct 2016 16:16:21 +0100 Levente Polyak <anthraxx(a)archlinux.org> wrote: > On 10/31/2016 04:03 PM, Patrick Burroughs (Celti) wrote: > > As a middle ground, I think it would be more reasonable (or at > > least, less unreasonable) to modify makepkg to allow signing > > PKGBUILDs, or at least parts of them. For an existing example, > > OpenBSD's signify(1) uses their cryptographic signature system to > > sign a simple list sha256sums. > > > > Perhaps makepkg could include, e.g., a sha256sumsigs array, that > > contains a PGP signature (signed by the developer/TU's official key) > > of the contents (properly serialised by makepkg so there's a minimum > > of possible ambiguity) of the sha256sums array? > > > > That is literally a _completely_ different topic that addresses > _completely_ different areas. > You are speaking about authenticating the build scripts itself. That > does not solve _anything_ at all what this thread/topic/todo-list is > about. It really is not. I am not speaking of authenticating the build scripts; both this thread and my proposal are talking about ensuring the integrity of downloaded source files. Specifically, I am speaking of cryptographically signing the checksums for source files downloaded by the build scripts, so that they download what the author of the build script _intended_ them to download. This is presumably the same reason for ensuring sources are downloaded via HTTPS instead of HTTP, where possible — adding a cryptographic authentication to ensure someone building a package does not get sources without being aware they are modified: only embedding signatures in the PKGBUILD is trusting the Arch devs via the pacman keyring or parallel method, instead of the (flawed) CA system. If there is another reason to switch to HTTPS, please — make me aware of it! Also the very first reply in the thread talked about adding upstream signatures instead of changing the protocol, where possible — only not every upstream offers or _wants_ to offer them, so I proposed, in response to a prompt for discussion on the subject in the mail I quoted, a way to make that feasible. > Don't get me wrong: I don't judge about it at all, I'm just saying > that both are fully independent from each other and you should please > open a new thread if you want to discuss this rather then hijack this > thread :) I really, really don't think they're independent from each other, and as I'm not authorised to post on arch-dev-public and didn't expect to draw this out into a conversation, I simply replied to the thread on arch-general. Bowing to peers, however... et voila: a new thread. ~Celti

8 13

[arch-general] kde --> xfce how to remove all packages kde
by Maykel Franco 31 Oct '16

31 Oct '16

Hi, I have migrate my archlinux system desktop kde to xfce. How to remove all kde packages and dependecy? Thanks in advanced.

4 3

Re: [arch-general] [arch-dev-public] todo list for moving http -> https sources
by Patrick Burroughs (Celti) 31 Oct '16

31 Oct '16

On Mon, 31 Oct 2016 15:19:40 +0100 NicoHood <arch-dev(a)nicohood.de> wrote: > Using PGP signatures is another discussion, also the hash algorithm. I > think we should discuss that in another post, appart from https. From > my point of view its highly important to use a strong hash function > as its highly important for the source integrity and not only meant > as checksum for corruption detection. And as always: more secure does > not hurt nowadays Not a dev, here, but... I strongly think that source integrity should not rely on hash functions alone. makepkg already includes validation of PGP-signed sources, but it's perhaps not reasonable to expect every upstream to offer signed sources. As a middle ground, I think it would be more reasonable (or at least, less unreasonable) to modify makepkg to allow signing PKGBUILDs, or at least parts of them. For an existing example, OpenBSD's signify(1) uses their cryptographic signature system to sign a simple list sha256sums. Perhaps makepkg could include, e.g., a sha256sumsigs array, that contains a PGP signature (signed by the developer/TU's official key) of the contents (properly serialised by makepkg so there's a minimum of possible ambiguity) of the sha256sums array? ~Celti

5 4

[arch-general] Browsers crashing
by Zorro 29 Oct '16

29 Oct '16

Hi, On my Arch Linux x32 system most (all) browser regularly crash. I have tried Firefox, Midori, Xombrero. For instance for Xombrero journalctl shows: systemd-coredump[6615]: Process 6478 (xombrero) of user 1002 dumped core. Stack trace of thread 6478: #0 0x00000000b4d0be50 n/a (libjavascriptcoregtk-3.0.so.0) #1 0x00000000a7b8e842 n/a (n/a) Midori behaves similarly. It happens on sites with many scripts and pictures when scrolling down. Firefox crashes at startup. It first displays its own start page, processor load goes to 100% and then firefox disappears leaving a core dump. Do others experience this too? Harm-Jan Zwinderman

10 17

Re: [arch-general] Single Drive Fresh Install (mbr/grub2) Fails to boot (can boot existing from .iso??)
by jeff.rollin 29 Oct '16

29 Oct '16

AFAIK it needn't be the first one on the disk - if memory serves, my Linux laptop came with Windows installed and the UEFI boot partition on the second partition, and the first first few Linux-only installed kept that layout - but it must be VFAT and it must be flagged bootable. Sent from Samsung Mobile on O2 -------- Original message --------From: Juan Carlos Villegas Botero via arch-general <arch-general(a)archlinux.org> Date: 29/10/2016 05:03 (GMT+00:00) To: General Discussion about Arch Linux <arch-general(a)archlinux.org> Cc: Juan Carlos Villegas Botero <juankvillegas(a)gmail.com> Subject: Re: [arch-general] Single Drive Fresh Install (mbr/grub2) Fails to boot (can boot existing from .iso??) And I also think that I read somewhere that theboot partition (EFI) must be the first one in the disk. On 10/28/2016 10:59 PM, Juan Carlos Villegas Botero wrote: > Sorry for the html response :S > > On 10/28/2016 10:58 PM, Juan Carlos Villegas Botero wrote: >> >> I'm not 100% sure that this is the solution, but if you are loading >> from UEFI, the boot partition must be formatted using GPT: >> https://wiki.archlinux.org/index.php/EFI_System_Partition >> >> >> On 10/28/2016 09:58 PM, David C. Rankin wrote: >>> All, >>> >>> After 7 years and 30+ installs, I thought I had seen it all. I have a new >>> (used) laptop, that I put a fresh 1T drive in, partitioned and loaded arch. The >>> laptop can't find the drive to boot? Huh? There is only a single drive in the >>> laptop, but it will only boot if booting from grub hd1 (instead of hd0). >>> >>> The failure isn't a "grub prefix/root" problem, the problem is the laptop >>> cannot even find grub to begin with when it is booting on it's own. The only way >>> booting happens is to boot the installer (from USB) and then "Choose existing >>> OS" and edit the prefix (from 0 -> 1). Which itself is wonky, because booting >>> from USB creates the USB thumb-drive as /dev/sdb to begin with and the hard >>> drive as /dev/sda where it should be. >>> >>> This is a strange laptop, it has 2 hard drive bays (HP Elite 8760w). The bios >>> is configured to scan both (as well as USB and PXE) for boot. I can boot the >>> install .iso without issue, install went fine, but in order to boot the new >>> install, I have to "Boot existing OS" from the .iso menu, then 'tab' and change >>> >>> hd0 0 >>> >>> to >>> >>> hd1 0 >>> >>> (I took the existing Win10 SSD out of the same bay I put this drive in - which >>> is also a simple mbr boot - no UEFI). The setup is dead simple (.iso is sdb below) >>> >>> $ lsblk >>> NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT >>> sdb 8:16 1 980M 0 disk >>> ├─sdb2 8:18 1 40M 0 part >>> └─sdb1 8:17 1 792M 0 part >>> sr0 11:0 1 1024M 0 rom >>> sda 8:0 0 931.5G 0 disk >>> ├─sda7 8:7 0 880G 0 part /home >>> ├─sda5 8:5 0 500M 0 part /boot >>> ├─sda1 8:1 0 1K 0 part >>> ├─sda8 8:8 0 1G 0 part >>> └─sda6 8:6 0 50G 0 part / >>> >>> and >>> >>> $ sudo fdisk -l /dev/sda >>> Disk /dev/sda: 931.5 GiB, 1000204886016 bytes, 1953525168 sectors >>> Units: sectors of 1 * 512 = 512 bytes >>> Sector size (logical/physical): 512 bytes / 4096 bytes >>> I/O size (minimum/optimal): 4096 bytes / 4096 bytes >>> Disklabel type: dos >>> Disk identifier: 0xff7d45aa >>> >>> Device Boot Start End Sectors Size Id Type >>> /dev/sda1 2048 1953525167 1953523120 931.5G 5 Extended >>> /dev/sda5 * 4096 1028095 1024000 500M 83 Linux >>> /dev/sda6 1030144 105887743 104857600 50G 83 Linux >>> /dev/sda7 105889792 1951383551 1845493760 880G 83 Linux >>> /dev/sda8 1951385600 1953525167 2139568 1G 82 Linux swap / Solaris >>> >>> grub is installed to /dev/sda with >>> >>> grub-install --target=i386-pc /dev/sda (no errors on install), and >>> grub-mkconfig -o /boot/grub/grub.cfg >>> >>> I've searched for anything related to HP laptops or this model, but only find >>> issues failing to boot the install CD or the newer UEFI pages like >>> >>> https://wiki.archlinux.org/index.php/HP_EliteBook_840_G1. >>> >>> Has anyone encountered something similar? There is no longer a >>> /boot/grub/device.map file installed by grub2, but given the fact the bios isn't >>> seeing the drive at all for boot, I don't see how mapping hd0 to hd1 would make >>> a difference. Does anyone have a link or any idea what the issue may be? I'm >>> happy to send whatever additional information may be required. I'm ssh'ed into >>> the box right now, I just need to get the boot and plasma ironed out. Any ideas? >>> Thanks. >>> >>> >>

1 0

[arch-general] LightScribe
by Ralf Mardorf 28 Oct '16

28 Oct '16

Hi, has somebody successfully used LightsScribe on an up-to-date 64bit Arch Linux install? Yesterday I tried to do it on Arch (4.8.4-1-ARCH 64bit, FWIW threadirqs) and another 64bit distro without success. Later I used another old 64bit bit distro's release for lack of time to lightscribe a DVD. FWIW it works on a very old Ubuntu Quantal 12.10 (kernel 3.6.5-rt14 64bit) install, official unsupported since 2½ years ago. Regards, Ralf

3 4

[arch-general] Sata-pmp
by pete nikolic 24 Oct '16

24 Oct '16

Hi . This may seem a little strange but here goes . I am running older hardware and am getting . ata1: softreset failed (device not ready) ata3: softreset failed (device not ready) ata2: softreset failed (device not ready) I have read that sata-pmp is the culprit is it possible to disable this from the boot cmdline or is it a kernel rebuild the motherboard has an AMD chipset 00:05.0 PCI bridge: Advanced Micro Devices, Inc. [AMD/ATI] RS690 PCI to PCI Bridge (PCI Express Port 1) 00:11.0 SATA controller: Advanced Micro Devices, Inc. [AMD/ATI] SB7x0/SB8x0/SB9x0 SATA Controller [IDE mode] kernel 4.8.3-1-ARCH #1 SMP PREEMPT Thu Oct 20 19:53:59 CEST 2016 x86_64 GNU/Linux 3 Sata drives no SSD devices . Thanks pete .

1 0

[arch-general] Problem with powerdns-recursor-4.0.3-1 package
by Roel de Wildt 24 Oct '16

24 Oct '16

Hello, After a upgrade from powerdns-recursor-3.7.3-3 to powerdns-recursor-4.0.3-1 it does not return any dns queries anymore. In the daemon.log is logged: Oct 23 10:50:18 gateway001 pdns_recursor[3008]: Oct 23 10:50:18 Sending SERVFAIL to 10.3.3.134 during resolve of 'google.nl' because: more than 50 (max-qperq) queries sent while resolving ns1.google.com Oct 23 10:50:19 gateway001 pdns_recursor[3008]: Oct 23 10:50:19 Sending SERVFAIL to 10.3.3.134 during resolve of 'google.nl' because: more than 50 (max-qperq) queries sent while resolving ns2.google.com After a downgrade of powerdns-recursor-4.0.3-1 to 3.7.3-3 it is working again, without making changes to /etc/powerdns/recursor.conf. The customized configuration options in /etc/powerdns/recursor.conf: [root@gateway001 powerdns]# grep -v -e "#.*" recursor.conf | grep -e "..*" allow-from=127.0.0.0/8, 10.0.0.0/8, ::1/64, 2001:470:1f15:a09::/64, 2001:470:7b9a::/48 auth-zones=.=/etc/powerdns/root.zone forward-zones=domain.lan=10.3.0.1,home.lan=10.3.0.21 hint-file=/etc/powerdns/named.root local-address=127.0.0.1,10.3.0.253:53,[::1],[2001:470:7b9a:0a03::fd]:53 local-port=5353 log-common-errors=yes loglevel=9 pdns-distributes-queries=yes query-local-address6=:: Do I need something to change to make it working against 4.0.x? I've searched at powerdns.com to options that have changed in the configuration but nothing helped. Kind regards, Roel de Wildt

4 7

[arch-general] Issue with Vim 8.0 and linebreak
by J. C. 24 Oct '16

24 Oct '16

Hey hey list, when I use the set linebreak command, Vim actually splits the lines, inserting CRLF or similar. The help says that it shouldn't do that, nor has it on Vim 7.x, which I ran on another Linux system. When just viewing a text, Vim displays it as expected with proper linebreaks and there are no inserts of CRLFs. Does anyone else have a similar issue or is there something else to take into account? Best wishes, Jeanette -------- When you need someone, you just turn around and I will be there <3

2 2

[arch-general] cp from USB to interal sata uses up all CPU
by J. C. 24 Oct '16

24 Oct '16

Hi list, I just noticed this today. I rebooted the system once, since the proper installation last week. Now cp from a USB drive to the internal sata drive eats up all CPU. The cp command is run as root - currently no alternative possible. The USB drive is mounted during system startup. A copy operation on the internal disk in question doesn't suffer from overuse of CPU resources. Copying from the USB disk to the USB disk isn't perfect, but uses only between 20-40% of CPU resources. The CPU frequency governor is set to ondemand. Can anybody suggest a remedy, please? Best wishes, Jeanette -------- When you need someone, you just turn around and I will be there <3

2 2