[aur-general] TU application: hashworks

[Jelle van der Waa]

On 08/06/2020 15:08, hashworks via aur-general wrote:
> Hello everyone,
> 
> My name is Justin Kromlinger aka hashworks and I'm applying as a
> Trusted User with the sponsorship of Thore Bödecker aka foxxx0 and
> Christian Rebischke aka shibumi who recently reviewed my AUR packages
> [1] – thanks for that! Some may know me from freenode#archlinux.de,
> where I'm lingering since a few years. I am and will be reachable there
> anytime.
> 
> I was born in Germany in 1994. My oldest Arch installation dates back
> to the month of July in 2015, at least according to my pacman logs.
> Just a year later I successfully qualified as an IT specialist in
> application development, together with a (soon to be expired) LPIC-1
> certificate. Last year I got my bachelor's degree in informatics in
> Leipzig (come visit me at the C3!), where I currently study for a
> master's degree. So you could say Arch Linux accompanied my whole
> education!
> 
> I started my first job at a small web agency as a Developer, but I
> slowly but surely turned into their System Administrator. At my current
> job for a larger IT company my external e-mail signature states I'm a
> "DevOps Engineer" – and while that term is by all means not fully
> defined, it kinda describes what I do. I create and maintain pipelines
> (mainly GitLabCI), design deployment processes and try to make our
> Docker Images a bit saner every day. And since I was able to enforce
> using Arch Linux on my work ThinkPad the distribution keeps on
> supporting my life, so I might try to give a little back! While I try
> to do some FOSS development in Go or – more recently – Rust now and
> then [2], my free time mostly flows into the maintenance of software
> and infrastructure for friends and family – and I have to admit that
> BASH remains my most fluent language.
> 
> Regarding my own packages I would like to move filebin and pam-ihosts
> since I use those on my servers. srrdb-terminal-client is also
> something I regularly use that I would like to move. Additionally I
> would like to ask to take over kiwix-desktop of which I maintain the
> dependency chain (kiwix-lib, libzim and mustache) – and while I'm at it
> the whole stack (mainly kiwix-tools). Other small packages that would
> suite Community are mdcat and insect if the current maintainers agree.
> i3blocks-contrib is another possible candidate, but I would need to
> request new and frequent releases for that. Out of the orphaned
> packages the only one I could reasonably maintain is hddtemp (since I
> still use it).

I quickly looked at your packages and found a few issues:

* filebin - the package is not -git but does pull from git master,
ideally it would use #commit= and maybe verify the commit if it's signed.

   source=("git+https://github.com/Bluewind/filebin.git"

* srrdb-terminal-client is not reproducible at least not as you embed
the build date.

https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=srrdb-terminal-client#n26

   This can be fixed with using SOURCE_DATE_EPOCH as for example is
applied here:

https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/prometheus-blackbox-exporter#n33

  You can check if your package is reproducible by using `makerepropkg`.

Greetings,

Jelle van der Waa

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/aur-general/attachments/20200608/3d825514/attachment.sig>