Search results for "Deletion request for pkgbase" - Aur-requests

[PRQ#52588] Deletion Request for youtube

by notify＠aur.archlinux.org

xiota [1] filed a deletion request for youtube [2]: This package should be deleted because it compromises the security of the systems on which it is installed. This package uses Electron as a web browser to navigate a streaming media website. Electron is *not* a web browser. Although it uses the same rendering engine as Chromium, it is not Chromium, and it does not have the same security features Chromium does. On the contrary, Electron intentionally has reduced security because it is intended for desktop apps, not web browsing. At [Security](https://www.electronjs.org/docs/latest/tutorial/security), Electron developers state: > A security issue exists whenever you receive code from an untrusted source (e.g. a remote server) and execute it locally. As an example, consider a remote website being displayed inside a default BrowserWindow. If an attacker somehow manages to change said content (either by attacking the source directly, or by sitting between your app and the actual destination), they will be able to execute native code on the user's machine. This apps does what Electron devs describe avoiding: ``` const mainWindow = new BrowserWindow(...) ... mainWindow.loadURL('https://...') ``` Further, this package is named in a way that some users may think it is an official package, which it is not. [1] https://aur.archlinux.org/account/xiota/ [2] https://aur.archlinux.org/pkgbase/youtube/

1 year, 11 months

[PRQ#52589] Deletion Request for youtubemusic

by notify＠aur.archlinux.org

xiota [1] filed a deletion request for youtubemusic [2]: This package should be deleted because it compromises the security of the systems on which it is installed. This package uses Electron as a web browser to navigate a streaming media website. Electron is *not* a web browser. Although it uses the same rendering engine as Chromium, it is not Chromium, and it does not have the same security features Chromium does. On the contrary, Electron intentionally has reduced security because it is intended for desktop apps, not web browsing. At [Security](https://www.electronjs.org/docs/latest/tutorial/security), Electron developers state: > A security issue exists whenever you receive code from an untrusted source (e.g. a remote server) and execute it locally. As an example, consider a remote website being displayed inside a default BrowserWindow. If an attacker somehow manages to change said content (either by attacking the source directly, or by sitting between your app and the actual destination), they will be able to execute native code on the user's machine. This apps does what Electron devs describe avoiding: ``` const mainWindow = new BrowserWindow(...) ... mainWindow.loadURL('https://...') ``` Further, this package is named in a way that some users may think it is an official package, which it is not. [1] https://aur.archlinux.org/account/xiota/ [2] https://aur.archlinux.org/pkgbase/youtubemusic/

1 year, 11 months

Re: [aur-requests] [PRQ#1282] Deletion Request for lib32-rtmpdump-stable

by Jake Daffer

I am ok with the deletion. But I want to be clear that this is not from git and this is from the website that is the host of the package. And let me also be clear that the claim of a high-jacking attempt has no basis in its aligation. Also my claim as to why I am felt that GordonGR's packgage is from git is because it is using a specific commit. Which is understandably a saved state of a git development, but this does mean that it is still from git. Next time ask me about this because the PKGBUILD's are different. On 10/29/14 08:07, notify(a)aur.archlinux.org wrote: > GordonGR [1] filed a deletion request for lib32-rtmpdump-stable [2]: > > This package is duplicate of aur/lib32-rtmpdump [a], maintained by me. > Its creator claims (in the comments section of [a]), that his package > is stable while mine is the developmental edition, which is not true; > the package in [extra] [b] uses git, and therefore [a] mine uses git > as well. The same practice is used for other packages, eg the old now > gstreamer0.10 packages. There is simply no place for this package, I > would go insofar as to say this is high-jacking attempt. Please > delete. > > [a] https://aur.archlinux.org/packages/lib32-rtmpdump/ > [b] https://www.archlinux.org/packages/extra/x86_64/rtmpdump/ > > [1] https://aur.archlinux.org/account/GordonGR/ > [2] https://aur.archlinux.org/pkgbase/lib32-rtmpdump-stable/ >

11 years, 1 month

Re: [aur-requests] [PRQ#10358] Deletion Request for nodejs-fake

by Mar77i

Sent with ProtonMail Secure Email. -------- Original Message -------- On January 19, 2018 7:24 PM, Eric Jardas via aur-requests <aur-requests(a)archlinux.org> wrote: >On 19/01/2018 sL1pKn07 fabio via aur-requests wrote: >>FabioLolix [1] filed a deletion request for nodejs-fake [2]: >>>pacman --assume-installed option exist >>>[1] https://aur.archlinux.org/account/FabioLolix/>[2] https://aur.archlinux.org/pkgbase/nodejs-fake/ > >Of course it does, but that has to be used on every update and >installation of package that has nodejs as dependency (which lets be >honest not a lot of people look into before installing a package). >This >pseudo package helps nvm be the only source of nodejs regardless of >installs and updates. Since the package is in aur, it doesn't have to be > used if you want to do the hassle of using --assume-installed on every >install and update. Having a choice is a good thing in my opinion. > I just had a philosoraptor moment: if every dimwit can come up with a dummy package to pretend X was installed, does that mean we have to treat your dummy package as valuable? For each real package that already exists, there's a potential *-fake package to be created, are you sure you want to have thousands upon thousands of *-fake packages on AUR? And we're definitely not talking about the apulse kind of fake. I somewhat cannot tell. Part of me insists in "good riddance". cheers! mar77i

7 years, 10 months

[PRQ#40487] Orphan Request for scalafmt-native

by notify＠aur.archlinux.org

PolarianDev [1] filed an orphan request for scalafmt-native [2]: This package has no maintainer, and has not been updated for years. Grounds for orphan not for deletion! [1] https://aur.archlinux.org/account/PolarianDev/ [2] https://aur.archlinux.org/pkgbase/scalafmt-native/

2 years, 9 months

Re: [aur-requests] [PRQ#17157] Deletion Request for f5vpn

by Marius Burba

Hello, i will not receive your emails, please delete my data, from your system. Thanks. burba_marius(a)yahoo.com On Wednesday, January 1, 2020, 6:10:50 PM UTC, Zach Hoffman <zach(a)zrhoffman.net> wrote: The package absolutely does not contain university-specific installation files. The reason the two linked files contain different hashes is that they are different versions. Steps to verify this:1. Download both RPMs2. Extractthe RPM 3. Open ${srcdir}/opt/f5/vpn/f5vpn in the editor of your choice4. Search for the text Version:5. Notice that it.emory.edu's RPM is version 7171.2018.0808.1, while vpn.uts.edu.au's RPM is version 7181.2019.0620.1 These RPMs would have been downloaded originally from F5's website by downloading the APM Clients ISO (latest version is 7182.2019.923.1603-4727.0) and copying linux_f5vpn.x86_64.rpm. This ISO does not vary based on who downloads it. On Wed, Jan 1, 2020 at 7:50 AM <notify(a)aur.archlinux.org> wrote: HailHydra [1] filed a deletion request for f5vpn [2]: Package contains university specific installation files with no indication of such in package naming or description. The 'linux_f5vpn.x86_64.rpm' file is specific to the university it is downloaded from, this can be seen by the differing hash sums of the file linked in the PKGBUILD ("https://it.emory.edu/vpntools/linux_f5vpn.x86_64.rpm") and one provided by a different university (ie. "https://vpn.uts.edu.au/public/download/linux_f5vpn.x86_64.rpm") [1] https://aur.archlinux.org/account/HailHydra/ [2] https://aur.archlinux.org/pkgbase/f5vpn/

5 years, 11 months

[PRQ#75128] Orphan Request for vintagestory-server

by notify＠aur.archlinux.org

oech3 [1] filed an orphan request for vintagestory-server [2]: OOD at 2025-03, replace PRQ#75127 (deletion request) [1] https://aur.archlinux.org/account/oech3/ [2] https://aur.archlinux.org/pkgbase/vintagestory-server/

4 months, 1 week

RE: [PRQ#65870] Merge Request for rtl-433-git

by archlinux.org＠felixvandyck.be

Hi, you could do an orphan request and after it has been orphaned adopt the package. Kind regards InFerNo *From:* dreieck <oid-maps(a)seznam.cz> *Sent:* Tuesday, November 19, 2024 at 2:54 PM UTC+1 *To:* aur-requests(a)lists.archlinux.org *Cc:* archlinux.org(a)felixvandyck.be *Subject:* RE: [PRQ#65870] Merge Request for rtl-433-git > I see that rtl_433-git now build for me despite that the issue [0] got > no attention from the maintainer. > > Maybe an upstream change. > > So I now also think `rtl-433-git` should be removed in favour of > `rtl_433-git`, and I am going to submit a deletion request because of > duplocate. > > [0]https://aur.archlinux.org/packages/rtl_433-git#comment-902241 > > On Tue, 19 Nov 2024 13:07:44 +0100,oid-maps(a)seznam.cz wrote: > >> Ahoj, >> >> thanks for the request! >> >> If I remember correctly, `rtl_433-git` has issues and did not get >> updated on a reported issue [0] >> >> [0]https://aur.archlinux.org/packages/rtl_433-git#comment-902241 >> >> .. so maybe make the merge request the other way round? >> >> Regards! >> >> On Sun, 17 Nov 2024 13:13:24 +0000,notify(a)aur.archlinux.org wrote: >> >>> InFerNo [1] filed a request to merge rtl-433-git [2] into >>> rtl_433-git [3]: >>> >>> Are these the same? >>> >>> [1]https://aur.archlinux.org/account/InFerNo/ >>> [2]https://aur.archlinux.org/pkgbase/rtl-433-git/ >>> [3]https://aur.archlinux.org/pkgbase/rtl_433-git/

1 year

Re: [aur-requests] [PRQ#1301] Deletion Request for update

by Colin Keenan

Please do not delete my package in the AUR, 'update'. Although the script contains only one line of relevant code that could better be done with an alias, the package also contains a desktop file which can easily be put on a panel or other launcher for one-click updating similar to a GUI. When installing Arch to other people's computers, people who may not be all that comfortable with the command line, it's much easier for me to install this update package for them than to find and copy the script and desktop file onto their computer. The idea behind this package is to add the desktop launcher to your panel (for example the Xfce panel), and then just click on it when you want to update your computer. The user just enters their password when asked for, and the rest is done automatically (unless it takes so long that another password entry is required). By making updating as easy as possible, users will update more frequently. The script and desktop file are so simple that anyone can see it's safe. What would be the harm in leaving it in the AUR? On Fri, Oct 31, 2014 at 4:24 PM, <notify(a)aur.archlinux.org> wrote: > karol_007 [1] filed a deletion request for update [2]: > > A package is a bit of an overkill for this oneliner. > > [1] https://aur.archlinux.org/account/karol_007/ > [2] https://aur.archlinux.org/pkgbase/update/ > >

11 years, 1 month

Re: [aur-requests] [PRQ#31469] Deletion Request for soundconverter-git

by Brett Cornwall

On 2022-01-14 01:33, Stefan Husmann via aur-requests wrote: > >Brett Cornwall via aur-requests <aur-requests(a)lists.archlinux.org> writes: > >> [[PGP Signed Part:Undecided]] >> On 2022-01-13 23:11, Stefan Husmann via aur-requests wrote: >>> >>>notify--- via aur-requests <aur-requests(a)lists.archlinux.org> writes: >>> >>>> ronch808 [1] filed a deletion request for soundconverter-git [2]: >>>> >>>> The build of this package fails. Say that autogen.sh in missing, >>>> which it is. So no way to build the package at this point. >>>> >>>> [1] https://aur.archlinux.org/account/ronch808/ >>>> [2] https://aur.archlinux.org/pkgbase/soundconverter-git/ >>> >>> >>>Read the comments. The issue is mentioned there. An Orphan request would >>>be more appropiate than a deletion request in this case. >>> >>>Best Regards >>>Stefan >> >> Am I missing something, or are there not actually any comments >> mentioning that? There is someone that submitted a patch 1.5 years ago >> that switched to the proper build process but the package looks >> largely dead despite that. >> >> [[End of PGP Signed Part]] > >Hello, > >Isn't one comment enough? The program itself is well maintained, has >versioned tarball releases (latest in Octobre 2021) and works as expected. A comment from 1.5 years ago is not very recent... If the package has been broken for that whole time without rectification I'd say that the package is poorly maintained. :) The program itself is well maintained and is included in the official repos. This is in regards to the -git version.

3 years, 11 months

Aur-requests search results for query "Deletion request for pkgbase"