- Arch-general - lists.archlinux.org

[ANNOUNCE] Proposed fix for dnssec-anchors package (outdated trust anchors + unused makedepends)
by meowmeowbeanz 24 May '25

24 May '25

Hi arch-dev-public, I'm announcing a proposed moderate change to the dnssec-anchors package per the developer manual guidelines. ## Summary Fix for 5+ year old DNSSEC trust anchors and unused makedepends in the dnssec- anchors package. ## Issues Addressed - GitLab Issue: #2 (outdated trust anchors) - Existing Bug: #77100 (unused makedepends, assigned to jelly) ## Proposed Changes - Restore dynamic trust anchor generation in build() function - Filter for KSK records (flag 257) to eliminate DNSSEC warnings - Update package version to 20250523-1 - Remove dependency on static 2019 files ## Testing - Verified DNSSEC validation works correctly - Eliminated knot-resolver warnings - Confirmed proper ad flag behavior with drill/kdig ## Merge Request Available at: https://gitlab.archlinux.org/archlinux/packaging/packages/ dnssec-anchors/-/merge_requests/1 The change preserves the established purpose (providing DNSSEC trust anchors) while updating to current practices and fixing confirmed bugs. Comments and feedback welcome. Thanks, meowmeowbeanz

1 0

openSUSE removes Deepin from official distro on security grounds - Arch have similar concerns?
by David C Rankin 14 May '25

14 May '25

Devs, The Register posted an article about openSUSE removing the Deepin desktop based on dbus abuse and other security and packaging violations. The issues are documented and linked in the article: https://go.reg.cx/tdml/dfd67/684a187f/7019d634/4gJn Has Arch done a similar analysis or have similar concerns? openSUSE have removed it from the distro, but left the package available in the community packager's repoo (similar to AUR setup). Not sure whether that is something to consider here. The concern being that by providing official packages openSUSE gave Deepin the aura of being up to the distros security standards where apparently that isn't something that was warranted. -- David C. Rankin, J.D.,P.E.

2 1

Bash [[ foo =~ regex ]] behavior changed with last update, gentoo patches?
by David C Rankin 09 May '25

09 May '25

Arch devs, I have a script that parses IP and CIDR notation using the following to capture IPs: [[ $1 =~ ^([^.]{1,3})[.]([^.]{1,3})[.]([^.]{1,3})[.]([^.]{1,3})$ ]] # validate 5 elements in BASH_REMATCH array if [ "${#BASH_REMATCH[@]}" -eq 5 ]; then ... (yes, I can improve it -- but that's not the point here) Then to capture CIDR: [[ $1 =~ ^([^.]{1,3})[.]([^.]{1,3})[.]([^.]{1,3})[.]([^.]{1,3})/(.*)$ ]] # validate 6 elements in BASH_REMATCH array if [ "${#BASH_REMATCH[@]}" -eq 6 ]; then ... This script was used to automatically update ipset lists and save /etc/ipset.conf. It has worked for years. Today after update to bash-5.2.037-3-x86_64 I get: $ ipsa 38.0.0.0/8 /home/david/scr/adm/ipset_add.sh: line 6: [: 0/8: integer expression expected /home/david/scr/adm/ipset_add.sh: line 6: [: 0/8: integer expression expected valid IP: 38.0.0.0/8 ipset v7.23: Hash is full, cannot add more elements The problem being for the first time ever, the regex in: [[ $1 =~ ^([^.]{1,3})[.]([^.]{1,3})[.]([^.]{1,3})[.]([^.]{1,3})$ ]] parsed the IP as 38 0 0 0/8 (with the "/8") instead of 38 0 0 0 filling the ipset blocklist completely with sequential 38.x.x.x IPs. Technically this regex matching is correct as the final character list [^.] doesn't preclude inclusion of '/', but this is a definite change from all prior bash versions. Is this the intended result of the gentoo patches change to the package? I've since fixed the regex with [^./] as the final list. Are there any other known changes to regex parsing with the changes to the bash PKGBUILD and patches? -- David C. Rankin, J.D.,P.E.

3 3

Package building and signing
by Pocket 06 May '25

06 May '25

I am building packages using makepkg for the raspberry pi 4 platform I changed the CFLAGS adding -march=armv8-a -mtune=cortex-a72 (makepkg.conf). I started to build all the packages that make up the "Building in a clean chroot" following the building in a claen chroot on the wiki. All when well. I will then build all the "base" package followed by all the packages I use on a "desktop" system. I would now like to make a custom repository for those packages and then have pacman install from there, eventually to remove the core extra etc repositories. I know how to create the custom repository (from the various wiki docs) using repo-add. I have a nginx web server on a remote raspberry pi and it will serve those packages from /etc/pacman.conf [custom] SigLevel = Optional TrustAll Server = http://www.home.arpa/Repository So my questions are as follows 1. How to get pacman to pull the packages from the custom repository first 2. I would like to sign the packages in the custom repository. I have looked at some of the information regarding signing packages(maybe missing some of them). It was totally confusing. I need guidance in the form of Step 1, step 2 etc. Is there such docs in existance? -- Hindi madali ang maging ako

5 8

Stop makepkg from running gpg on .sig files
by Sebastian Wiesner 06 May '25

06 May '25

Hello, apparently makepkg automatically attempts to verify .sig files in the SOURCES array with gpg. Can I somehow stop this behaviour? I have .sig URLs but these aren't GPG signatures, but SSH signatures I'd like to validate in a custom verify() function. Currently, I'm working around this by renaming the upstream .sig files to .sigssh in SOURCES, but that's rather inconvenient. Cheers, Basti

2 4

Building in a clean chroot
by Pocket 05 May '25

05 May '25

I am getting this error when running is there a way to fix this? Using makechrootpkg -c -r "$CHROOT" -- --ignorearch --skippgpcheck works fine $ arch-nspawn $CHROOT/root pacman -Syy :: Synchronizing package databases... custom 11.5 KiB 261 KiB/s 00:00 [#############################################] 100% core.db failed to download extra 9.5 MiB 15.9 MiB/s 00:01 [#############################################] 100% alarm.db failed to download aur.db failed to download error: failed retrieving file 'aur.db' from mirror.archlinuxarm.org : The requested URL returned error: 404 error: failed retrieving file 'alarm.db' from mirror.archlinuxarm.org : The requested URL returned error: 404 error: failed retrieving file 'core.db' from mirror.archlinuxarm.org : The requested URL returned error: 404 warning: too many errors from mirror.archlinuxarm.org, skipping for the remainder of this transaction error: failed to synchronize all databases (failed to retrieve some files) -- Hindi madali ang maging ako

3 6

Refreshing pacman database
by Pocket 04 May '25

04 May '25

pacman -Syy refreshes all db for all repositories Is there a way to have pacman only refresh a single repository db? Ie pacman -Syy custom only refreshes custom withou refreshing core extra etc -- Hindi madali ang maging ako

2 1

Arrogant reply on forums
by Qtra Gabriex 03 May '25

03 May '25

Guy with 63,000+ forum posts replies arrogantly over me asking for actual deletion to be implemented. Brings up multiple tragedies. This upsets me because I once donated $20 to the Software in the Public Interest and wish for positivity and inclusion. https://bbs.archlinux.org/viewtopic.php?id=305290

12 13

Does redis returning to AGPL license effect the redis/valkey package replacement decision?
by David C Rankin 02 May '25

02 May '25

Devs, I was a bit surprised to see the following as the lead article on The Register daily stories for today: Redis 'returns' to open source with AGPL license https://www.theregister.com/2025/05/01/redis_returns_to_open_source/ After Arch's recent transition from redis to valkey due redis switching to the SSPLv1 license last year, does the decision by redis to relicense ver. 8 going forward under AGPL mean that redis will come back as a package or is Arch sticking with valkey? -- David C. Rankin, J.D.,P.E.

2 2

Re: Arch-general Digest, Vol 29, Issue 3
by Alessandra 02 May '25

02 May '25

Hi, I am weighing in as a user. Sure community spirit is important but someone already said it, please don't use historical events that affected millions of people as a comparison for an issue you are having that's not really impeding on your ability to staying alive. Milk was spilled, share the link to the post, we can all weigh in collectively whether it is a matter the community should investigate further or leave it. Thank you to anyone that spend time, modding, contributing to packages and thats answered my questions in post or on Reddit ! Cheerio! 2025-05-02T08:06:06Z arch-general-request(a)lists.archlinux.org: > Send Arch-general mailing list submissions to > arch-general(a)lists.archlinux.org > > To subscribe or unsubscribe via email, send a message with subject or > body 'help' to > arch-general-request(a)lists.archlinux.org > > You can reach the person managing the list at > arch-general-owner(a)lists.archlinux.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Arch-general digest..." > > Today's Topics: > > 1. Re: Arrogant reply on forums (LuKaRo) > 2. Re: Arrogant reply on forums (Óscar García Amor) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 2 May 2025 09:46:21 +0200 > From: LuKaRo <lists(a)lrose.de> > Subject: Re: Arrogant reply on forums > To: arch-general(a)lists.archlinux.org > Message-ID: <a18f92b5-4050-4f7f-b953-9f37dc907549(a)lrose.de> > Content-Type: multipart/alternative; > boundary="------------0zPYycE2iWyI60ADO9wAssk9" > > Out of curiosity: Is it? I couldn't find a source, where the purpose of > arch-general is defined, but I thought it is for "general Arch Linux > stuff", which includes community topics for me. > > lukaro > > On 5/2/25 6:00 AM, Martin Zecher wrote: >> Please stop spamming our emails, this is for technical stuff. You can >> freely discuss about human rights and whatever you want somewhere else. >> >> >> ==== >> Martin Zecher >> >> El jue, 1 may 2025, 22:55, Ralf Mardorf <ralf-mardorf(a)riseup.net> >> escribió: >> >> On Fri, 2025-05-02 at 00:51 +0200, Camelia Lavender wrote: >> > I think that the direct reference and comparison to hitler and >> nazism >> > (in the reply) was completely inappropriate and quite frankly >> > unacceptable, because it is antisemitic, and it makes it look like >> > those things weren't extremely serious. >> >> The accusation of anti-Semitism does not make sense. A comparison with >> Hitler and the NAZIS is inappropriate in most cases, but not >> automatically anti-Semitic. There is currently a world situation in >> which diplomacy should be practiced and insinuations of anti-Semitism >> should be treated with great caution. Labeling unpopular >> worldviews and >> questionable opinions as anti-Semitic per se does not help in any way. >> You don't necessarily have to go one better. Please stop! >>

1 0