- Arch-general - lists.archlinux.org

Any though of having archlinux-keyring-wkd-sync check for iptables and recommend rule?
by David C. Rankin 24 Sep '23

24 Sep '23

Archdevs, Depending on how restrictive the iptables rules, if the IP for archlinux-keyring-wkd-sync falls into a blocked range, the logs quickly fill. An idea is to have the service insert a temporary rule to either (1) allow the IP for the sync check, or (2) allow established, related connections while the service runs. It may also be worth updating the wiki to provide model rules for iptables/nftables to allow archlinux-keyring-wkd-sync to run successfully. Just food for thought. -- David C. Rankin, J.D.,P.E.

6 15

Webkit2gtk 2.42.0-1 upgrade breaks claws mail fancy plugin html rendering
by Richard Ullger 23 Sep '23

23 Sep '23

Hi, As the subject states. The preview pane for html emails is blank. Downgrading webkit2gtk to 2.40.5-2 fixes the issue. Regards, Richard

2 2

New spurious journal entry begins 9/11 - DIGEST-MD5 common mech free
by David C. Rankin 22 Sep '23

22 Sep '23

All, There a number of reports from different distributions over time of spurious log messages of "XXXXX DIGEST-MD5 common mech free" that have been encountered with everything from mail packages to web servers. Starting September 11, this started on Arch with php-legacy installed. On this box I have 32 journals going back to April, 2023, After saving the entries from the journal, it's clear this error started on September 11 and that roughly corresponds to my setup of nextcloud on this box. The journal entries get quite chatty, e.g. Sep 22 06:55:25 2pi httpd[35305]: DIGEST-MD5 common mech free Sep 22 06:58:34 2pi systemd[1]: Started Nextcloud; run cron.php. Sep 22 06:58:36 2pi php-legacy[35340]: DIGEST-MD5 common mech free Sep 22 06:58:36 2pi systemd[1]: nextcloud-cron.service: Deactivated successfully. Sep 22 06:59:58 2pi httpd[35307]: DIGEST-MD5 common mech free Sep 22 07:03:35 2pi systemd[1]: Started Nextcloud; run cron.php. Sep 22 07:03:36 2pi php-legacy[35405]: DIGEST-MD5 common mech free Sep 22 07:03:36 2pi systemd[1]: nextcloud-cron.service: Deactivated successfully. Sep 22 07:08:27 2pi sudo[35454]: david : TTY=pts/1 ; PWD=/home/david ; USER=root ; COMMAND=/usr/bin/journalctl --no-pager --full -f Sep 22 07:08:27 2pi sudo[35454]: pam_unix(sudo:session): session opened for user root(uid=0) by david(uid=1000) Sep 22 07:08:35 2pi systemd[1]: Started Nextcloud; run cron.php. Sep 22 07:08:36 2pi php-legacy[35457]: DIGEST-MD5 common mech free Sep 22 07:08:36 2pi systemd[1]: nextcloud-cron.service: Deactivated successfully. Sep 22 07:08:47 2pi systemd[1]: Reloading Apache Web Server... Sep 22 07:08:47 2pi httpd[35289]: DIGEST-MD5 common mech free Sep 22 07:08:47 2pi httpd[35294]: DIGEST-MD5 common mech free Sep 22 07:08:47 2pi httpd[35308]: DIGEST-MD5 common mech free Sep 22 07:08:47 2pi systemd[1]: Reloaded Apache Web Server. Sep 22 07:08:47 2pi httpd[35310]: DIGEST-MD5 common mech free Sep 22 07:08:47 2pi httpd[35293]: DIGEST-MD5 common mech free Sep 22 07:08:47 2pi httpd[35295]: DIGEST-MD5 common mech free Sep 22 07:08:47 2pi httpd[35296]: DIGEST-MD5 common mech free Sep 22 07:08:47 2pi httpd[35303]: DIGEST-MD5 common mech free Sep 22 07:08:47 2pi httpd[35304]: DIGEST-MD5 common mech free Sep 22 07:08:47 2pi httpd[35309]: DIGEST-MD5 common mech free Sep 22 07:08:50 2pi httpd[35292]: DIGEST-MD5 common mech free Sep 22 07:09:16 2pi httpd[35473]: DIGEST-MD5 common mech free Sep 22 07:09:23 2pi php-fpm-legacy[35063]: pool nextcloud[35063]: DIGEST-MD5 common mech free Sep 22 07:09:30 2pi php-fpm-legacy[35207]: pool nextcloud[35207]: DIGEST-MD5 common mech free Sep 22 07:09:35 2pi httpd[35470]: DIGEST-MD5 common mech free Sep 22 07:13:35 2pi systemd[1]: Started Nextcloud; run cron.php. Sep 22 07:13:36 2pi php-legacy[35525]: DIGEST-MD5 common mech free There are a dozen or so on server startup and then when nextcloud runs it's cron job. Dumping the journal entries, it's clear when it started and it looks like most entries are due to php-legacy, but there are httpd and php-fpm-legacy in there as well e,g, $ jcnl | grep 'DIGEST-MD5 common mech free' > tmp/DIGEST-MD5commonMechFree.txt $ head tmp/DIGEST-MD5commonMechFree.txt Sep 11 02:44:53 2pi php-legacy[12486]: DIGEST-MD5 common mech free Sep 11 02:49:53 2pi php-legacy[12526]: DIGEST-MD5 common mech free Sep 11 02:54:53 2pi php-legacy[12558]: DIGEST-MD5 common mech free Sep 11 03:00:03 2pi php-legacy[12589]: DIGEST-MD5 common mech free Sep 11 03:05:03 2pi php-legacy[12727]: DIGEST-MD5 common mech free Sep 11 03:10:03 2pi php-legacy[12763]: DIGEST-MD5 common mech free Sep 11 03:15:03 2pi php-legacy[12798]: DIGEST-MD5 common mech free Sep 11 03:20:13 2pi php-legacy[12895]: DIGEST-MD5 common mech free Sep 11 03:25:13 2pi php-legacy[25576]: DIGEST-MD5 common mech free Sep 11 03:30:13 2pi php-legacy[25691]: DIGEST-MD5 common mech free Is this something of concern or just something that is chatty but does no harm? -- David C. Rankin, J.D.,P.E.

1 0

bash 5.2 and BASH_COMPAT question
by Genes Lists 19 Sep '23

19 Sep '23

Hi: I believe that bash 5.2 was/is held back due to incompatible Changes with 5.1 [1]. The obvious first thought would be to set BASH_COMPAT="5.1" globally and then update to the current 5.2 version. This would work for any shell which sees the BASH_COMPAT variable. User login shells, users running things which in turn invoke bash would get the variable passed down. Users who want to use the 5.2 features would have the ability to unset the variable - but recognizing the caveat below. I do see one caveat (may be others): When bash is invoked from a non-login shell without the BASH_COMPAT variable or from a tool which cleans it's env before invoking bash, those would need adjusting to set their own BASH_COMPAT variable should they depend on the 5.1 behavior or be changed to support 5.2 Which leads to: - do we have a list of tools that invoke bash but clean env variables before doing so? (pacman perhaps) - is their a task list of what needs to be done (either fix the incompatibilities or push the BASH_COMPAT variable down). - what else needs to be done to allow us to update to 5.2 Thoughts? thanks gene [1] https://github.com/bminor/bash/blob/master/COMPAT

2 2

gdm3 stalled
by Zener 19 Sep '23

19 Sep '23

After an upgrade several months ago, gdm3 get stalled at each boot and gnome can't run properly. So, I've disabled gdm.service and gnome start properly without gdm. All the upgrade system in these months have not been able to solve. Could you help me to do an useful debug in order to solve? Thanks.

3 9

keyboard shortcut became really slow after update.
by Zener 19 Sep '23

19 Sep '23

After an update in june/july keyboard shortcut became really slow (and gdm doesn’t work any more). I use wayland on Arch. Could you help me to solve please? tnks.

1 1

Does anyone have Fresh Nextcloud Install on PHP-legacy with cache working?
by David C. Rankin 18 Sep '23

18 Sep '23

All, I've spent a few days trying to get either APCu or Redis (or both) caching working with a fresh install of nextcloud on php-legacy. Nextcloud works fine and I can enable both caches per the wiki but adding anything to /etc/webapps/nextcloud/config/config.php as shown in the wiki immediately results in an "Internal server error" crash of nextcloud. A full explanation of all steps tried is in https://bbs.archlinux.org/viewtopic.php?id=288622 Does anyone have nextcloud 27.0.2 running on php-legacy with APCu or Redis (or both) enabled and working? Something is really wrong here. -- David C. Rankin, J.D.,P.E.

3 3

Archlinux Con
by Hritik Vijay 17 Sep '23

17 Sep '23

Hello I attended debconf23 yesterday and it got me wondering about Arch Cons. According to what I've seen, we mostly had online cons (if any). Can we plan for an offline con for archlinux ? Is there enough interest around it ? Are there enough sponsors for us (｡◕‿‿◕｡) ? Hritik

1 0

Arch Mailing List queries
by Polarian 16 Sep '23

16 Sep '23

Hello, So I have two things I would like to address which I have realised: Firstly is the fact that Arch Linux almost always picks IPv4 over IPv6 when delivery the mail. I am aware this is not a big issue because I still receive the email but Arch Linux has full support for IPv6, and I would like to have it used (especially for the hope in the future we can all use single stack IPv6 and get rid of legacy IPv4). I believe this is not an issue with Arch Linux, but the mailing list software used (which I believe is mailman). I have discussed the same issue with the Gajim developers on XMPP. I believe GNU mailman uses Happy Eyeballs (like which Gajim uses) (more info: https://en.wikipedia.org/wiki/Happy_Eyeballs) which when I test it on my network for about 200-300 attempts, IPv6 is picked 299/300 of the times, so I should be seeing almost always IPv6, but I get the opposite. I assume GNU mailman uses the GNU python network library (forgot what it is called) which contains a Happy Eyeballs implementation (the same one Gajim uses). So there is a strong likelihood that it is an issue with the library being biased towards picking IPv4 over IPv6, because I do not have this issue with any other software. So this is not something which Arch is responsible for, but if anyone has more information about this, I would be grateful to be given it :) I did think for a while I had setup IPv6 incorrectly, but when I see Microsoft delivering emails solely over IPv6 (not a single use of IPv4), I do not believe it is an issue on my end, but correct me if I am wrong :D The second issue I want to bring up is the issue of gmail (and also sometimes outlook emails) spamming my emails. I have a few thoughts on this: - Google employs IP whitelisting, my email server is small and thus is suspicious, other small email servers know the going trend of "it being impossible to stay out of gmail spam folders", even legitimate emails from big companies sometimes end up in gmail spam, so for those who keep complaining about my emails being put into your spam, it is not an issue on my end, I have checked numerous times. - DKIM signatures are broken in transit, and depending on how the spam filter classifies something as spam, it could be picked up as a incorrect DKIM signature and thus spammed instantly, I will use David Rankin's email from this morning as a reference for this (https://lists.archlinux.org/archives/list/arch-general@lists.archlinux.org/…) Here are the relevant headers: Received: from mail.polarian.dev by email with LMTP id +Pw5ALfTAmV1LwAAotfoXQ (envelope-from <arch-general-bounces(a)lists.archlinux.org>) for <polarian@localhost>; Thu, 14 Sep 2023 09:34:47 +0000 Received: from lists.archlinux.org (lists.archlinux.org [IPv6:2a01:4f9:c010:9eb4::1]) by mail.polarian.dev (Postfix) with ESMTPS id 9B5AB10A0772 for <polarian(a)polarian.dev>; Thu, 14 Sep 2023 09:34:46 +0000 (UTC) Authentication-Results: mail.polarian.dev; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=(a)gmail.com header.a=rsa-sha256 header.s=20221208 header.b=S2HFsXca Received: from lists.archlinux.org (localhost [IPv6:::1]) by lists.archlinux.org (Postfix) with ESMTP id AD29AF4E9A0; Thu, 14 Sep 2023 09:34:30 +0000 (UTC) Received: from mail-oo1-xc35.google.com (mail-oo1-xc35.google.com [IPv6:2607:f8b0:4864:20::c35]) by lists.archlinux.org (Postfix) with ESMTPS id 3AC84F4E993 for <arch-general(a)lists.archlinux.org>; Thu, 14 Sep 2023 09:34:20 +0000 (UTC) Authentication-Results: lists.archlinux.org; dkim=pass header.d=gmail.com header.s=20221208 header.b=S2HFsXca; spf=pass (lists.archlinux.org: domain of drankinatty(a)gmail.com designates 2607:f8b0:4864:20::c35 as permitted sender) smtp.mailfrom=drankinatty(a)gmail.com; dmarc=pass (policy=none) header.from=gmail.com Received: by mail-oo1-xc35.google.com with SMTP id 006d021491bc7-57355a16941so450114eaf.2 for <arch-general(a)lists.archlinux.org>; Thu, 14 Sep 2023 02:34:20 -0700 (PDT) Sorry for the bad formatting, and apologies to David Rankin for using your email headers as a reference, but I assume its fine because it was posted to a public mailing list which we can already see, its public information, but if you do mind, I am sorry. The bottom hop is just google hopping the email between their servers, but once it hits lists.archlinux.org you can see that the authentication results is that it passes both spf and dkim, also I would like to draw attention to the fact that it was delivered to the mailing list via IPv6, which does show that IPv6 is definitely functioning on Arch's end. It is then hopped to my mail server, this was the only email which I have so far which was hopped to me via IPv6, so I was amazed when I saw it, so it definitely seems to be a issue with Happy Eyeballs. Anyways back to the topic, the signature then fails dkim validation (Yes I do not currently check spf, ip address spoofing is trivial compared to cryptographic signing and thus I was lazy and haven't yet bothered (its been over a year since my current mail server was configured :P). I assume that Google with their strict (and pointless) spam filter, sees that their mail server has failed to validate dkim and spams said email. I know I am not the only person being spammed too, I have seen other people being informed "hey your email was spammed for me", and 9 times out of 10 its those who self host, and thus are less known. Welcome to Googles dictatorship on email. I believe people running rspamd picks up that further down the hop chain it was valid, and thus takes that into account possibly, because I haven't heard people struggling to pass rspamd filtering. The reason for me bringing this up is getting an email every time I post to a mailing list from 3 different people complaining how google spammed my emails is a pain, and heres the kicker, half the time DKIM is valid and half the time it is broken when hopping through lists.archlinux.org, so wrap your ahead around that one! If you are getting legitimate emails spammed, then you either need to relax your email spam filter, or simply get used to checking your spam often to pull legitimate emails out. Personally I do not employ a spam filter, because just the likelihood of a legitimate email being spammed or bounced is a bad idea in my mind. As people complain about my email length, I will give a TL;DR: - Arch Linux (or GNU mailman) seems to have issues when it comes to picking between IPv4 and IPv6. - DKIM signatures are randomly broken when passing through lists.archlinux.org - If emails from the mailing list are being spammed, it might be wise to relax your spam settings, as even fully verified emails can be spammed from companies like google simply because their AI doesn't like the content of said email, or their IP whitelist doesn't include the sender. Maybe I should start putting a TL;DR at the top of every email? and then below that is the usual email with all the context and explanation. If someone thinks this is a good idea let me know (any way for me to annoy people less is a good thing :P) Any advice on how to improve (or hopefully fix) the two above issues would be highly appreciated. Take care, -- Polarian GPG signature: 0770E5312238C760 Website: https://polarian.dev JID/XMPP: polarian(a)icebound.dev

6 6

I am unable to upgrade my system today
by Łukasz Michalski 15 Sep '23

15 Sep '23

Hi, I tried to pacman -Suy today and it failed: (42/42) checking keys in keyring [##############################################################################################] 100% warning: Public keyring not found; have you run 'pacman-key --init'? downloading required keys... error: keyring is not writable error: keyring is not writable error: keyring is not writable error: keyring is not writable error: keyring is not writable error: keyring is not writable error: keyring is not writable error: keyring is not writable error: required key missing from keyring error: failed to commit transaction (unexpected error) Errors occurred, no packages were upgraded. Then I checked database with pacman-key: [root@archdevel ~]# pacman-key --list-sigs ==> ERROR: You do not have sufficient permissions to read the pacman keyring. ==> Use 'pacman-key --init' to correct the keyring permissions. [root@archdevel ~]# pacman-key --init ==> Generating pacman master key. This may take some time. gpg: Generating pacman keyring master key... gpg: revocation certificate stored as '/etc/pacman.d/gnupg/openpgp-revocs.d/A99B568F9C124056C01DEBFAE33864D7C9C3D4FB.rev' gpg: Done ==> Updating trust database... gpg: public key of ultimately trusted key 489992F0B03F986A not found gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 2 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 2u ==> ERROR: Trust database could not be updated. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Is this a root of my problem? [root@archdevel ~]# gpg --homedir /etc/pacman.d/gnupg --list-keys gpg: WARNING: unsafe permissions on homedir '/etc/pacman.d/gnupg' /etc/pacman.d/gnupg/pubring.kbx ------------------------------- pub rsa4096 2014-11-04 [SC] 5C81C9D6C8D7475DF65A0C884FE7F4FEAC8EBE67 uid [ unknown] Justin Kromlinger <hashworks(a)archlinux.org [a lot of entries....] Then I tried again: [root@archdevel ~]# pacman -Suy -v Root : / Conf File : /etc/pacman.conf DB Path : /var/lib/pacman/ Cache Dirs: /var/cache/pacman/pkg/ Hook Dirs : /usr/share/libalpm/hooks/ /etc/pacman.d/hooks/ Lock File : /var/lib/pacman/db.lck Log File : /var/log/pacman.log GPG Dir : /etc/pacman.d/gnupg/ Targets : None :: Synchronizing package databases... core is up to date extra is up to date community is up to date multilib is up to date :: Starting full system upgrade... resolving dependencies... looking for conflicting packages... Packages (41) btrfs-progs-6.5.1-1 chromium-117.0.5938.62-1 cmake-3.27.5-1 code-1.82.0-2 containerd-1.7.6-1 curl-8.3.0-1 dotnet-host-7.0.11.sdk111-1 dotnet-runtime-7.0.11.sdk111-1 dotnet-sdk-7.0.11.sdk111-1 dotnet-targeting-pack-7.0.11.sdk111-1 ffmpeg-2:6.0-10 filelight-23.08.1-1 firefox-117.0.1-1 ghostscript-10.02.0-1 glib2-2.78.0-2 graphviz-9.0.0-1 kompare-23.08.1-1 lib32-curl-8.3.0-1 lib32-glib2-2.78.0-2 lib32-libtiff-4.6.0-1 libarchive-3.7.2-1 libimagequant-4.2.1-1 libkomparediff2-23.08.1-1 liblouis-3.27.0-1 libportal-0.7-1 libportal-gtk3-0.7-1 libreoffice-fresh-7.6.1-1 librsvg-2:2.57.0-1 libtiff-4.6.0-1 libwebp-1.3.2-1 linux-6.5.3.arch1-1 linux-headers-6.5.3.arch1-1 linux-lts-6.1.53-1 linux-lts-headers-6.1.53-1 netstandard-targeting-pack-7.0.11.sdk111-1 nvidia-535.104.05-6 python-gobject-3.46.0-1 python-sphinx-7.2.6-1 qt5-script-5.15.15-1 qt5-webengine-5.15.15-1 sqlite-3.43.1-1 Total Installed Size: 2583.28 MiB Net Upgrade Size: -0.07 MiB :: Proceed with installation? [Y/n] y (41/41) checking keys in keyring [##############################################################################################] 100% downloading required keys... :: Import PGP key 771DF6627EDF681F, "Tobias Powalowski <tpowa(a)archlinux.org>"? [Y/n] y :: Import PGP key 3B94A80E50A477C7, "Jan Alexander Steffens (heftig) <heftig(a)archlinux.org>"? [Y/n] y :: Import PGP key 6D42BDD116E0068F, "Christian Hesse <eworm(a)archlinux.org>"? [Y/n] y :: Import PGP key 94657AB20F2A092B, "Andreas Radke <andyrtr(a)archlinux.org>"? [Y/n] y :: Import PGP key 51E8B148A9999C34, "Evangelos Foutras <foutrelis(a)archlinux.org>"? [Y/n] y :: Import PGP key 7A4E76095D8A52E4, "Antonio Rojas <arojas(a)archlinux.org>"? [Y/n] y :: Import PGP key EA4F7B321A906AD9, "Daniel M. Capella <polyzen(a)archlinux.org>"? [Y/n] y y( 9/41) checking package integrity [###########-----------------------------------------------------------------------------------] 12(41/41) checking package integrity [##############################################################################################] 100% error: btrfs-progs: signature from "Tobias Powalowski <tpowa(a)archlinux.org>" is unknown trust :: File /var/cache/pacman/pkg/btrfs-progs-6.5.1-1-x86_64.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)). Do you want to delete it? [Y/n] n Following wiki I tried to repopulate database: [root@archdevel ~]# pacman-key --populate ==> Appending keys from archlinux.gpg... gpg: public key of ultimately trusted key 489992F0B03F986A not found ==> Locally signing trusted keys in keyring... ==> ERROR: 2AC0A42EFB0B5CBC7A0402ED4DC95B6D7BE9892E could not be locally signed. ==> ERROR: 69E6471E3AE065297529832E6BA0F5A2037F4F41 could not be locally signed. ==> ERROR: D8AFDDA07A5B6EDFA7D8CCDAD6D055F927843F1C could not be locally signed. ==> ERROR: 91FFE0700E80619CEB73235CA88E23E377514E00 could not be locally signed. [root@archdevel ~]# pacman-key --refresh-keys gpg: key 4FE7F4FEAC8EBE67: "Justin Kromlinger <justin(a)kromlinger.eu>" not changed gpg: key 4FE7F4FEAC8EBE67: "Justin Kromlinger <justin(a)kromlinger.eu>" not changed gpg: Total number processed: 2 gpg: unchanged: 2 [lot of entries, some errors like this: ==> ERROR: Could not update key: BBE43771487328A9 gpg: error retrieving 'ibiru(a)archlinux.org' via WKD: No data gpg: error reading key: No data gpg: refreshing 1 key from hkp://pool.sks-keyservers.net gpg: keyserver refresh failed: No name ==> ERROR: Could not update key: E8F18BA1615137BC gpg: error retrieving 'jonno.conder(a)gmail.com' via WKD: No data gpg: error reading key: No data gpg: refreshing 1 key from hkp://pool.sks-keyservers.net gpg: keyserver refresh failed: No name ==> ERROR: Could not update key: AF7EF7873CFD4BB6 ...] Now I am not even able to reinstall archlinux-keyring: [root@archdevel ~]# pacman -S archlinux-keyring warning: archlinux-keyring-20230821-2 is up to date -- reinstalling resolving dependencies... looking for conflicting packages... Packages (1) archlinux-keyring-20230821-2 Total Installed Size: 1.62 MiB Net Upgrade Size: 0.00 MiB :: Proceed with installation? [Y/n] y (1/1) checking keys in keyring [##############################################################################################] 100% (1/1) checking package integrity [##############################################################################################] 100% error: archlinux-keyring: signature from "Christian Hesse <eworm(a)archlinux.org>" is unknown trust :: File /var/cache/pacman/pkg/archlinux-keyring-20230821-2-any.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)). Do you want to delete it? [Y/n] n What could I do to fix this problem? Do I understand it right that ths is a problem with pacman-key --init ? Regards, Łukasz

2 2