- Arch-general - lists.archlinux.org

[arch-general] Package signing (was: Arch Linux security is still poor)
by Linas 18 Mar '10

18 Mar '10

I had already this email draft in my head, but Ananda 'Arch Linux security is still poor' thread, on which the point was also brought up, moved me to really write it. First off, there's an implicit level of trust on the package software, no matter which OS you use. When using Windows, you trust in Microsoft, when using Mac OS, you trust in Apple, when using a Linux distro, you trust the packagers and upstream. Either you do that or trust just whatever came installed and not install anything ever (thus not patching to new vulnerabilities). The problem with Arch current packaging system is not that you must trust people able to write in core not to add a rm -rf / (to name the classical 'attack') nor that you didn't install arch with an infected media. The problem is that every time you do pacman -Syu, you must blindly trust that your dns, network, and mirror are reliable, too. The packages are verified with a md5 from the server list, but should you update from a compromised mirror (or impersonated, eg. arp poisoning, dns spoofing, bofh proxy operator...) you have lost. A pacman -Syu from an open wifi might be enough. A later update may 'clean' it, so you may not even notice that you were once compromised. There are several ways to close the gap: *Always download the package list from ftp.archlinux.org It's the easier solution, but it only protects against the mirror operator. Moreover, it increases load on that server and makes it a single point of failure. *Package lists are signed from a trusted master key. There may be up to a key per repo. Easy to provide, allows backward compatibility. *Packages are automatically signed by ftp.archlinux.org before distributing them. Removes the dependancy over the package list. Packages can be shared securely (eg. getting a downgrade for an untrusted user). *Each developer signs its own packages prior to uploading. Each repository key signs the keys of the developers with write access. Users can blacklist or trust independent developers. Needless to say, the last solution is the one I like most. However, being more complete, it also means more work. :) The package signing could be a simple text file with filenames and hashes (preferably something more secure than md5) signed with gpg, or could be expanded if more fields are needed. Do you think this is a good idea? Which solution do you prefer? And most important, what would be needed to reach there? __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

5 5

[arch-general] howto get kde3 to appear as a session in kdm greeter?
by David C. Rankin 18 Mar '10

18 Mar '10

Guys, In Arch, how do I make kde3 appear as a choice in the kdm greeter? I thought I just had to add a kde.desktop launching /opt/kde/bin/startkde in /usr/share/xsessions, but that didn't do it. What's the trick? -- David C. Rankin, J.D.,P.E. Rankin Law Firm, PLLC 510 Ochiltree Street Nacogdoches, Texas 75961 Telephone: (936) 715-9333 Facsimile: (936) 715-9339 www.rankinlawfirm.com

2 2

[arch-general] [signoff] dmraid-1.0.0rc16-3
by Tobias Powalowski 18 Mar '10

18 Mar '10

HI, readded static dmraid again to fix: http://bugs.archlinux.org/task/18348 please signoff both arches, greetings tpowa -- Tobias Powalowski Archlinux Developer & Package Maintainer (tpowa) http://www.archlinux.org tpowa(a)archlinux.org

3 2

[arch-general] Does anybody still have kde3 running? libpng problems preventing apps from running?
by David C. Rankin 18 Mar '10

18 Mar '10

Guys, I still have kde3 installed primarily because the apps konqueror (a real konqueror) kwrite, kate, etc. in kde3 are much lighter to run in fluxbox or other wm's than the kde4 apps and the kde3 apps don't spew reams of text to your xterm when they run. Are there any tips or trick to keeping these apps viable a bit longer? If so, how? The error I get is probably just a sym link issue: 13:47 archangel:~> /opt/kde/bin/konqueror --profile filemanagement /opt/kde/bin/konqueror: error while loading shared libraries: libpng12.so.0: cannot open shared object file: No such file or directory I then start the kde4 version and suddenly I have 5,000 lines of crap on my xterm: 17:10 archangel:~> konqueror --profile filemanagement konqueror(20906)/kdecore (KSycoca) KSycocaPrivate::checkDatabase: We have no database.... launching kdeinit konqueror(20906)/kdecore (kdelibs) KToolInvocation::klauncher: klauncher not running... launching kdeinit kdeinit4: preparing to launch /usr/lib/libkdeinit4_klauncher.so Connecting to deprecated signal QDBusConnectionInterface::serviceOwnerChanged(QString,QString,QString) klauncher(20918)/kio (KIOConnection) KIO::ConnectionServer::listenForRemote: Listening on "local:/tmp/ksocket-david/klauncherT20918.slave-socket" kdeinit4: preparing to launch /usr/lib/libkdeinit4_kded4.so kdeinit4: preparing to launch /usr/lib/libkdeinit4_kbuildsycoca4.so klauncher(20918)/kio (KLauncher) KLauncher::processRequestReturn: "/usr/bin/kbuildsycoca4" (pid 20924) up and running. kbuildsycoca4 running... kbuildsycoca4(20924)/kdecore (KSycoca) KSycocaPrivate::openDatabase: Trying to open ksycoca from "/var/tmp/kdecache-david/ksycoca4" kbuildsycoca4(20924) KBuildSycoca::checkTimestamps: checking file timestamps kbuildsycoca4(20924) KBuildSycoca::checkDirTimestamps: timestamp changed: "/usr/share/kde4/servicetypes/" kbuildsycoca4(20924) kdemain: Reusing existing ksycoca kbuildsycoca4(20924) KBuildSycoca::recreate: Recreating ksycoca file ("/var/tmp/kdecache-david/ksycoca4", version 162) kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "okularGenerator.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "plasma-applet.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "kwineffect.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "solidpowermanager.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "plasma-packagestructure.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "kopeteplugin.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "krfb-framebuffer.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "ktexteditor_loadsavefiltercheckplugin.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "kpropertiesdialogplugin.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "kcmoduleinit.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "kateplugin.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "dbustexttospeech.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "kregexpeditor.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "solidremotecontrolmanager.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "korganizerpart.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "plasma-containment.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "krdc_plugin.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "kompareviewpart.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "screensaver.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "kerfufflePlugin.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "thumbcreator.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "plasma-scriptengine.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "kdedmodule.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "kmediaplayer.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "findpart.desktop" kbuildsycoca4(20924) KBuildSycoca::createEntry: modified: "plasma-wallpaper.desktop" <big snip> konqueror(20906)/konqtree KonqSidebarDirTreeModule::addSubDir: KonqSidebarDirTreeModule(0x1024ee0) KonqSidebarDirTreeModule::addSubDir "file:///home/david/ss" konqueror(20906)/konqtree KonqSidebarDirTreeModule::addSubDir: KonqSidebarDirTreeModule(0x1024ee0) KonqSidebarDirTreeModule::addSubDir "file:///home/david/scripts" konqueror(20906)/konqtree KonqSidebarDirTreeModule::addSubDir: KonqSidebarDirTreeModule(0x1024ee0) KonqSidebarDirTreeModule::addSubDir "file:///home/david/dcrsig" konqueror(20906)/konqtree KonqSidebarDirTreeModule::addSubDir: KonqSidebarDirTreeModule(0x1024ee0) KonqSidebarDirTreeModule::addSubDir "file:///home/david/img" konqueror(20906)/kio (KIOConnection) KIO::ConnectionServer::listenForRemote: Listening on "local:/tmp/ksocket-david/konquerorw20906.slave-socket" konqueror(20906)/kio (Slave) KIO::Slave::createSlave: createSlave "thumbnail" for KUrl("thumbnail:/home/david/img") konqueror(20906)/kio (KIOConnection) KIO::ConnectionServer::listenForRemote: Listening on "local:/tmp/ksocket-david/konquerorP20906.slave-socket" klauncher(20918)/kio (KLauncher) KLauncher::requestSlave: KLauncher: launching new slave "kio_thumbnail" with protocol= "thumbnail" args= ("thumbnail", "local:/tmp/ksocket-david/klauncherT20918.slave-socket", "local:/tmp/ksocket-david/konquerorP20906.slave-socket") kdeinit4: preparing to launch /usr/lib/kde4/kio_thumbnail.so klauncher(20918)/kio (KLauncher) KLauncher::processRequestReturn: "kio_thumbnail" (pid 20933) up and running. kio_thumbnail(20933)/kdecore (KSycoca) KSycocaPrivate::openDatabase: Trying to open ksycoca from "/var/tmp/kdecache-david/ksycoca4" kio_thumbnail(20933)/kdecore (trader) KMimeTypeTrader::query: query for mimeType "text/plain" , "ThumbCreator" : returning 1 offers konqueror(20906)/kio (KIOJob) KIO::SlaveInterface::dispatch: error 104 "Cannot create thumbnail for directory" If possible, I would very much like to have the kde3 versions running. Can I just sym link to the latest libpng? -- David C. Rankin, J.D.,P.E. Rankin Law Firm, PLLC 510 Ochiltree Street Nacogdoches, Texas 75961 Telephone: (936) 715-9333 Facsimile: (936) 715-9339 www.rankinlawfirm.com

11 21

[arch-general] Thunderbird 3 annoyance
by David Rosenstrauch 18 Mar '10

18 Mar '10

I'm having a little annoyance with TBird 3, and was wondering if anyone was experiencing the same thing and/or had a workaround. I have a large tree of folders in TBird, from 2 different IMAP accounts. So I use the "Unread Folders" view, in conjunction with the mail.check_all_imap_folders_for_new config setting. Problem is that since the upgrade to TBird 3, when TBird grabs new email, it automatically selects a different folder in the left ("Unread Folders") pane. This is really irritating. I really want TBird to just stay on the folder I've selected - no matter whether it gets new email or not. Anyone know how to fix this? Is there some magic new config setting for this? I tried googling on this, but it's hard to find good search terms to describe the problem. Thanks, DR

3 5

[arch-general] DVD's won't read
by Nilesh Govindarajan 18 Mar '10

18 Mar '10

Hi, I'm experiencing this problem from quite a long time. But I don't know why. I have a LG DVD Writer. It supports writing and reading DVD-R DVD+R DVD-RW DVD+RW, all CDs and some other DVD flavors I don't remember. I tried a Fedora boot DVD at boot, it worked. But inside arch (it was the same problem with fedora), it won't work. I don't think this needs any special driver because previously I'd never configured a special driver for that. CD's work fine though. -- Nilesh Govindarajan Site & Server Adminstrator www.itech7.com

2 2

[arch-general] kernel26 2.6.32.10-1 Boot Failure at initrd/initramfs
by David C. Rankin 18 Mar '10

18 Mar '10

Guys, I just attempted an update which installed kernel26 2.6.32.10-1 on my x86_64 box. After the update, the box failed to boot and the boot process stopped at the initrd/initramfs. (I have the slash because I can't remember the exact init----) But it was very early in the boot process. I have checked logs and nothing for this boot attempt was written to the logs. I suspect it was too early in the boot process for logging to be enabled. I have never tried to recover from a failed arch boot before. What's the proper way. Boot with the install cd and chroot your install and either downgrade to the last kernel or try mkinitcpio again? -- David C. Rankin, J.D.,P.E. Rankin Law Firm, PLLC 510 Ochiltree Street Nacogdoches, Texas 75961 Telephone: (936) 715-9333 Facsimile: (936) 715-9339 www.rankinlawfirm.com

4 8

[arch-general] pdftk - almost build but died - need help figuring out if I can find a work-around
by David C. Rankin 18 Mar '10

18 Mar '10

Guys, I need pdftk for a script I use that does fax processing. I ran into this problem 6-7 months ago, but still had another server with pdftk on it so it wasn't critical. Now, I need to solve it. Currently pdftk in AUR is out of date due to it a dependency of gcc-gcj requiring it to be built against gcc-4.3. The building gcc-4.3 and then gcc-gcj part of the pdftk build goes fine (takes forever, but goes fine). The build seems to crater on a java-lib issue. Here is the actual error with a few lines of context: patching file pdftk/Makefile.Base patching file java_libs/com/lowagie/text/pdf/PdfEncryption.java patching file java_libs/Makefile make -C ../java_libs make[1]: Entering directory `/home/david/arch/pkg/bld/pdftk/src/pdftk-1.41/java_libs' make -C "/home/david/arch/pkg/bld/pdftk/src/pdftk-1.41/java_libs/com/lowagie/text"; make[2]: Entering directory `/home/david/arch/pkg/bld/pdftk/src/pdftk-1.41/java_libs/com/lowagie/text' gcj -march=x86-64 -mtune=generic -O2 -pipe -w --encoding=UTF-8 --classpath="/usr/share/java/libgcj-4.3.jar:/home/david/arch/pkg/bld/pdftk/src/pdftk-1.41/java_libs" -c Anchor.java -o Anchor.o Exception in thread "main" java.lang.NoClassDefFoundError: org.eclipse.jdt.internal.compiler.batch.GCCMain at gnu.java.lang.MainThread.run(libgcj.so.9) Caused by: java.lang.ClassNotFoundException: org.eclipse.jdt.internal.compiler.batch.GCCMain not found in gnu.gcj.runtime.SystemClassLoader{urls=[file:/usr/share/java/eclipse-ecj.jar], parent=gnu.gcj.runtime.ExtensionClassLoader{urls=[], parent=null}} at java.net.URLClassLoader.findClass(libgcj.so.9) at java.lang.ClassLoader.loadClass(libgcj.so.9) at java.lang.ClassLoader.loadClass(libgcj.so.9) at gnu.java.lang.MainThread.run(libgcj.so.9) make[2]: *** [Anchor.o] Error 1 make[2]: Leaving directory `/home/david/arch/pkg/bld/pdftk/src/pdftk-1.41/java_libs/com/lowagie/text' make[1]: *** [itext] Error 2 make[1]: Leaving directory `/home/david/arch/pkg/bld/pdftk/src/pdftk-1.41/java_libs' make: *** [java_libs] Error 2 The problem is I am no good at figuring out what this is telling me I need to do to fix it. I know there was an exception thrown in thread "main" java.lang.NoClassDefFoundError: ........ what I don't know is whether this is telling me there is a javalib version mismatch or something similar and whether this is something I might work around by loading/building some alternative java package, etc.. If you have any idea what is going on here, please pass along a pointer or two. If this is just one of those areas where I'm screwed and there isn't a way around it -- well knowing that would be helpful too. Thanks. -- David C. Rankin, J.D.,P.E. Rankin Law Firm, PLLC 510 Ochiltree Street Nacogdoches, Texas 75961 Telephone: (936) 715-9333 Facsimile: (936) 715-9339 www.rankinlawfirm.com

2 5

[arch-general] Abort forced filesystem check on boot
by Rorschach 17 Mar '10

17 Mar '10

Hi, I have written a small patch for rc.sysinit which gives the user the ability to abort a forced filesystem check with pressing the escape-key. I haven't found another feature-request in the bugtracker for this so I opened one: http://bugs.archlinux.org/task/18400 . What do you think about it?

3 2

[arch-general] HAL depreciation
by Damjan Georgievski 17 Mar '10

17 Mar '10

Does anyone know how much of HAL is needed in ArchLinux these days? I'm asking because I've learned that both udev and HAL configure the keymap of input devices nowdays and I wonder what other former HAL features are already implemented in udev. -- damjan

12 16