- Aur-general - lists.archlinux.org

How can we help with the recent AUR outages?
by David Heinemeier Hansson 18 Aug '25

18 Aug '25

AUR seems to have had some very rough days this week. Uncharacteristically so. I've only been in the Arch world for a short time, but I'd really like to help sort whatever is going on out, if at all possible. If the AUR servers are straining, I'm sure I can marshal some resources to have those expanded. If it's because there's an attack, I already have a commitment from the Cloudflare CTO to help protect against it. I'm not sure who to reach out to in order to deliver assistance, resources, or whatever is needed, though. Again, I'm quite new here in the Arch world, but I'm incredibly motivated to help resolve whatever is plaguing the server farm. Thanks in advance for everything all of those working on this and the rest of the Arch infrastructure does! ✌️

5 6

Cannot receive password reset email for new AUR account
by cilgin 17 Aug '25

17 Aug '25

Hello, I recently created a new account on the AUR (aur.archlinux.org) but I have not received the password reset email despite several attempts. I have checked my spam/junk folder. There is a chance that I might have mistyped my email address during registration. Also, I am using a Microsoft email address (Outlook/Hotmail), which I know sometimes causes issues with receiving automated messages. Could you please check if my account is registered with the correct email and help me receive the reset email or update my account if necessary? Username: "cilgin" Email: "cilgincc(a)outlook.com" Thank you very much for your help.

4 4

Error timeout or connection reset by peer
by Ernesto Acosta 15 Aug '25

15 Aug '25

Hello... For a few days now, I've been having problems connecting to AUR, and I'd like to know if my IP was banned by you or if my ISP (Spectrum Internet) is meddling in my business. I understand they've been hit by a DDoS attack recently, so I don't know if this has any connection. But the funny thing is that if I use a VPN, it works. The errors I've received have been the following: $ yay -Ss localsend -> Error during AUR search: 1 error occurred: * request failed: Get "https://aur.archlinux.org/rcp?arg=localsend&by=name-desc&type=search&v=5": read tcp 192.168.x.x:51298->95.216.144.15:443: read: connection reset by peer. This is new: $ yay -Ss localsend -> Error during AUR search: 1 error occurred: * request failed: Get "https://aur.archlinux.org/rpc?arg=localsend&by=name-desc&type=search&v=5": dial tcp 95.216.144.15:443: i/o timeout Thanks

2 1

Package Maintainer application
by Martin Rys 15 Aug '25

15 Aug '25

Hi, my name's Martin, you can more often find me under "C0rn3j". Professionally, I work as a DevOps, and in my free time I do things I've most recently stumbled upon, which usually has to do with FOSS. I've been using Arch for about a decade, I mostly hang out in the unofficial Telegram group*, which I help moderate. I sometimes contribute to the Wiki, send patches over GitLab when relevant, or otherwise participate in discussions if I happen to see anything I can add my two cents to. I've been maintaining a random assortment of things in the AUR, a lot of the times simply because I was using a package that the previous maintainer disowned, and I figured I might pick up the torch. Which brings me to why I want to become a PM - I would like to see some of the things I currently maintain in the official repositories, such as sc-controller** or Tauon**, and to help out with the maintenance in general. I use ALARM on some of my devices too, so I'd possibly like to help out with the porting efforts to Arch in the future, when that becomes relevant. I've attached links to my accounts and also my personal site below. My sponsors are Gian (grazzolini) and Tomaz Canabrava. Special thanks goes out to Muflone for additional packaging feedback. I think that covers everything necessary, have a good day and I hope you'll consider my application! * https://t.me/archlinuxgroup ** https://github.com/Taiko2k/Tauon ** https://github.com/C0rn3j/sc-controller https://aur.archlinux.org/account/c0rn3j https://gitlab.archlinux.org/c0rn3j https://github.com/C0rn3j https://gitlab.com/C0rn3j https://rys.rs/ - GPG key used for signing is also present here

12 21

Licensing following RFC40 and RFC52
by Lex Black 05 Aug '25

05 Aug '25

Hello list, I have a question regarding adding LICENSES to the aurweb repos. The simple solution would be to add the 0BSD text to the repo. So far so good. I looked additionally into REUSE, as this is mostly deployed by the repo packages and got mentioned on the respective wiki page[0]. As the pkgctl programm from the devtools package has the subcommand `license setup` and `license check` I looked into using this. But the resulting structure doesn't conform to the aurweb submission guidelines as subdirectories aren't allowed. But would be required to be REUSE-compliant? Will this be changed to allow this specific subdir? Or should the suggestion to use REUSE dropped from the wiki page? If the latter, how to attribute patches that are added from upstream? Best regards ________ [0] https://wiki.archlinux.org/title/AUR_submission_guidelines#Rules_of_submiss… "Add a LICENSE file or a REUSE.toml file to your repository."

2 2

Possible malicous PKGBUILD
by Lex Black 29 Jul '25

29 Jul '25

Hi Will only be able top later create a deletion requests for a package, but maybe someone else wants to step up? https://aur.archlinux.org/packages/gdox Not a really stealthy and working approach to do harm, but such a PKGBUILD shouldn't stay up in my opinion. Best regards

2 1

Command in DLAGENTS works in shell but not in makepkg
by Aaron Liu 22 Jul '25

22 Jul '25

Hey, Part of a PKGBUILD I'm trying to make looks like this: source=(Lark-linux_x64-${pkgver}.deb::https://www.larksuite.com/api/package… DLAGENTS=("https::/usr/bin/sh -c curl\ -LO\ \"\$$curl\ \'%u\'\ \|\ grep\ -oP\ \'\(\?\<=\"download_link\":\"$\[\^\"\]\*\'\ --\ \|\ sed\ \'s/\\\\u0026/\\\&/g\'\ --\)\"") The command (/usr/bin/sh...) works when I run it in my shell, but not when I run makepkg on the PKGBUILD. Any help would be really, really appreciated. I don't even know how to make makepkg tell me what command it runs, and even that would be nice. -- Cheers, Aᴀʀᴏɴ

1 1

Re: [SECURITY] firefox-patch-bin, librewolf-fix-bin and zen-browser-patched-bin AUR packages contain malware
by Shay Gover 19 Jul '25

19 Jul '25

Hi Quentin, Can you send us the packages description so we can identify other attempts in the future? Thanks Shay Date: Fri, 18 Jul 2025 18:53:19 +0200 > From: Quentin MICHAUD <mh4ckt3mh4ckt1c4s(a)archlinux.org> > Subject: [SECURITY] firefox-patch-bin, librewolf-fix-bin and > zen-browser-patched-bin AUR packages contain malware > To: aur-general(a)lists.archlinux.org > Message-ID: <4156647e-59ab-4026-9778-19d7cda6d4bc(a)archlinux.org> > Content-Type: text/plain; charset=UTF-8; format=flowed > > On the 16th of July, at around 8pm UTC+2, a malicious AUR package was > uploaded to the AUR. Two other malicious packages were uploaded by the > same user a few hours later. These packages were installing a script > coming from the same GitHub repository that was identified as a Remote > Access Trojan (RAT). > > The affected malicious packages are: > > - librewolf-fix-bin > - firefox-patch-bin > - zen-browser-patched-bin > > The Arch Linux team addressed the issue as soon as they became aware of > the situation. As of today, 18th of July, at around 6pm UTC+2, the > offending packages have been deleted from the AUR. > > We strongly encourage users that may have installed one of these > packages to remove them from their system and to take the necessary > measures in order to ensure they were not compromised. >

1 0

[SECURITY] firefox-patch-bin, librewolf-fix-bin and zen-browser-patched-bin AUR packages contain malware
by Quentin MICHAUD 18 Jul '25

18 Jul '25

On the 16th of July, at around 8pm UTC+2, a malicious AUR package was uploaded to the AUR. Two other malicious packages were uploaded by the same user a few hours later. These packages were installing a script coming from the same GitHub repository that was identified as a Remote Access Trojan (RAT). The affected malicious packages are: - librewolf-fix-bin - firefox-patch-bin - zen-browser-patched-bin The Arch Linux team addressed the issue as soon as they became aware of the situation. As of today, 18th of July, at around 6pm UTC+2, the offending packages have been deleted from the AUR. We strongly encourage users that may have installed one of these packages to remove them from their system and to take the necessary measures in order to ensure they were not compromised.

1 0

A nightmare in nesting for DLAGENTS
by Aaron Liu 08 Jul '25

08 Jul '25

Ey, A package recently started making their download links be dynamically-generated and expire. I've found that the download link can be gotten through `curl 'https://www.larksuite.com/api/package_info?platform=10' | grep -oP '(?<="download_link":")[^"]*' --`. I've decided to implement this into the package through setting source to the API link and specifying DLAGENTS. However, I'm having trouble wrangling the quotes. Currently, I have DLAGENTS=('https::/bin/sh -c '\''curl -LO $(curl -s %u | grep -oP "(?<=\"download_link\":\")[^"]*")'\'''). The shell complains -LO: -c: line 1: unexpected EOF while looking for matching `''. (I'm not using jq because 1. it's an extra makedepends 2. I tried replacing the grep part with `jq -r .download_link` and it changes nothing.) I've been working at different ways of expressing this for a while now and all I've managed to change is which kind of quotation mark the shell complains about. Any ideas? -- Cheers, Aᴀʀᴏɴ

1 1