January 2024 - Aur-requests - lists.archlinux.org

[PRQ#52927] Deletion Request for smtp-git
by notify＠aur.archlinux.org 20 Jan '24

20 Jan '24

MarsSeed [1] filed a deletion request for smtp-git [2]: Upstream is barely maintained: had 2 minor commits in 2018, and one in 2019, 2020 and 2021 each. [a] The package also has 0 votes/comments. Its name is too generic. /usr/bin/smtp is also carried by extra/opensmtpd. The package also does not align with smtp package conventions of Arch repo - namely, to virtually provide 'smtp-server' and/or 'smtp- forwarder', whichever is relevant. But the main reason for deletion is that no one should use this application. Upstream is brazenly amateurish in their coding practices. The source of the server executable uses sprintf to write unsanitized input strings to a buffer whose allocated memory is shorter than the allowed string. This is the kind of basic vulnerability that is the prime target of even script-kiddies for remote code execution. (Or if the build is enhanced with PIE and RELRO, which currently it isn't, then such overflow will just result in a crash, hence a denial-of-service vulnerability.) On top of all this, upstream requires hard-coded plaintext username, password, email address, server address and port in the config.h header file, to be baked-in to the executable at build-time. (Coupled with the above-mentioned remote code execution vulnerability, one's server authentication credentials could easily be retrieved by online adversaries.) All this clearly indicates that this was never intended to be taken seriously, nor for using it in any kind of deployment. Nor has it received any scrutiny from anyone whatsoever. The code also depends on mbedtls, but it does not clarify which API version it requires. (Only one commit in 2020 adapted the former polarssl code to use some unversioned header entries of mbedtls.) Upstream also lacks a bug tracking system, a security vulnerability reporting contact, and the code is not signed electronically. I see zero reason to keep this. Repo has many smtp-servers and smtp- forwarders, and AUR carries additional ones. [a]: http://repo.or.cz/w/smtp.git [1] https://aur.archlinux.org/account/MarsSeed/ [2] https://aur.archlinux.org/pkgbase/smtp-git/

1 1

[PRQ#52934] Merge Request for mdev-cli
by notify＠aur.archlinux.org 20 Jan '24

20 Jan '24

davispuh [1] filed a request to merge mdev-cli [2] into mdev-gpu-cli [3]: Got it flagged by MarsSeed: > This should be renamed to mdev-gpu or md3v-gpu-cli, because mdev is an udev alternative. So sure why not, renaming it to `mdev-gpu-cli` [1] https://aur.archlinux.org/account/davispuh/ [2] https://aur.archlinux.org/pkgbase/mdev-cli/ [3] https://aur.archlinux.org/pkgbase/mdev-gpu-cli/

1 1

[PRQ#52937] Deletion Request for algorithmia-bin
by notify＠aur.archlinux.org 20 Jan '24

20 Jan '24

anowell [1] filed a deletion request for algorithmia-bin [2]: Was outdated, then startup was acquired, then the associated API deprecated [1] https://aur.archlinux.org/account/anowell/ [2] https://aur.archlinux.org/pkgbase/algorithmia-bin/

1 1

[PRQ#52938] Deletion Request for algorithmia-git
by notify＠aur.archlinux.org 20 Jan '24

20 Jan '24

anowell [1] filed a deletion request for algorithmia-git [2]: Was outdated, then startup was acquired, then the associated API deprecated [1] https://aur.archlinux.org/account/anowell/ [2] https://aur.archlinux.org/pkgbase/algorithmia-git/

1 1

[PRQ#52942] Deletion Request for gq
by notify＠aur.archlinux.org 20 Jan '24

20 Jan '24

patlefort [1] filed a deletion request for gq [2]: Buggy and long abandoned. [1] https://aur.archlinux.org/account/patlefort/ [2] https://aur.archlinux.org/pkgbase/gq/

1 1

[PRQ#52955] Deletion Request for alterant
by notify＠aur.archlinux.org 20 Jan '24

20 Jan '24

c6p [1] filed a deletion request for alterant [2]: Abandoned [1] https://aur.archlinux.org/account/c6p/ [2] https://aur.archlinux.org/pkgbase/alterant/

1 1

[PRQ#52959] Deletion Request for ocaml-menhir-compcert
by notify＠aur.archlinux.org 20 Jan '24

20 Jan '24

xuanruiqi [1] filed a deletion request for ocaml-menhir-compcert [2]: No longer needed. [1] https://aur.archlinux.org/account/xuanruiqi/ [2] https://aur.archlinux.org/pkgbase/ocaml-menhir-compcert/

1 1

[PRQ#52958] Deletion Request for ocaml-menhir-compcert
by notify＠aur.archlinux.org 20 Jan '24

20 Jan '24

xuanruiqi [1] filed a deletion request for ocaml-menhir-compcert [2]: No longer needed. [1] https://aur.archlinux.org/account/xuanruiqi/ [2] https://aur.archlinux.org/pkgbase/ocaml-menhir-compcert/

1 1

[PRQ#52968] Deletion Request for mattermost-desktop-gitlab
by notify＠aur.archlinux.org 20 Jan '24

20 Jan '24

arakmar [1] filed a deletion request for mattermost-desktop-gitlab [2]: Not useful anymore because a recent release fixed the problem with Gitlab [1] https://aur.archlinux.org/account/arakmar/ [2] https://aur.archlinux.org/pkgbase/mattermost-desktop-gitlab/

1 1

[PRQ#52971] Deletion Request for intel-ucode-clear
by notify＠aur.archlinux.org 20 Jan '24

20 Jan '24

xiota [1] filed a deletion request for intel-ucode-clear [2]: This package should be deleted because using outdated ucode packages is harmful. Raison d'etre of this package is to be updated sooner than extra/intel-ucode, but it has been unmaintained for over 1.5 years, so is now far behind the official package. I was unable to locate a download link to update this package within a reasonable amount of time, so converted it into a metapackage to transition users to the better maintained official package. [1] https://aur.archlinux.org/account/xiota/ [2] https://aur.archlinux.org/pkgbase/intel-ucode-clear/

1 1