<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<div>Thanks for that,<br></div><div dir="auto"><br></div><div dir="auto">No, there are infinite reasons to have all of -bin -git and non-git packages. Docker containers, upstream changes, security holes in newer/older versions, cloud installs, automation etc.<br></div><div dir="auto"><br></div><div dir="auto">Not everyone is on the Mailing List + Forums + Reddit + IRC + Discord etc.<br></div><div dir="auto"><br></div><div dir="auto">AUR security is at the absolute top of my check-list.<br></div><div dir="auto"><br></div><div dir="auto">Most AUR users don't want actively maintained packages to be randomly transferred to brand new users (at the time), with absolutely no historical proof of trust (at the time). I invite you to evaluate my trustworthiness: <a target="_blank" rel="noopener noreferrer" href="https://github.com/sickcodes/security/tree/master/advisories">https://github.com/sickcodes/security/tree/master/advisories</a>. I happily added you as a co-maintainer. Then the merge went thru, expecting you were going to cancel the request.<br></div><div dir="auto"><br></div><div dir="auto">In my opinion, as you were well aware all of the merge requests items were addressed, you should've cancelled the merge request last month.<br></div><div dir="auto"><br></div><div dir="auto">That's why I am concerned. I'm not attached, I'm concerned about the security of the project.<br></div><div dir="auto"><br></div><div dir="auto">Users still need a pinned version, as do many others on 5.10, 5.11, 5.12, 5.13, 5.14, 5.15, etc.<br></div><div dir="auto"><br></div><div dir="auto">You knew the fixes were made and should've cancelled the merge.<br></div><div dir="auto"><br></div><div dir="auto">Contact the maintainer politely next time, like other AUR users do when they request updates, and similarly, I contact package maintainers with tips.<br></div><div dir="auto"><br></div><div dir="auto"><div dir="auto">A) contact the maintainer<br></div><div dir="auto">B) create a -git and file a merge request<br></div><div dir="auto"><br></div><div dir="auto">You chose option B<br></div></div><div dir="auto"><br></div><div dir="auto">> 2021-12-11 12:21 -git created by @eNV25<br></div><div dir="auto">> 2021-12-11 14:21 [PRQ#30507] Merge Request for anbox-modules-dkms<br></div><div dir="auto">notify at aur.archlinux.org notify at aur.archlinux.org by @eNV25<br></div><div dir="auto"><br></div><div dir="auto">You created a -git version and merge requested 2 hours later.<br></div><div dir="auto"><br></div><div dir="auto">Why would you merge instead of simply contacting me to fix it? I honestly considered the intial request a malicious request, which at the time, was from a brand new account.<br></div><div dir="auto"><br></div><div dir="auto">I would prefer to pkgver using pkgver=5 and pkgrel=15.14, so as to reflect the last supported kernel.<br></div><div dir="auto"><br></div><div dir="auto">All of your requests in the merge request were already fixed and in good faith I believe you probably should've honored your statement to cancel the merge:<br></div><div dir="auto"><br></div><div dir="auto">- Uses git source without a -git pkgname suffix.<br></div><div dir="auto">> Fixed before merge <a target="_blank" rel="noopener noreferrer" href="https://github.com/sickcodes/aur/commit/dffca947ee02be66fe4ea54682a6d5ae1195b798">https://github.com/sickcodes/aur/commit/dffca947ee02be66fe4ea54682a6d5ae1195b798</a><br></div><div dir="auto"><br></div><div dir="auto">- Is not a proper DKMS package.<br></div><div dir="auto">> Yes it is. See <a href="https://wiki.archlinux.org/title/DKMS_package_guidelines">https://wiki.archlinux.org/title/DKMS_package_guidelines</a><br></div><div dir="auto"><br></div><div dir="auto"> - It doesn't use DKMS hooks. It instead runs make install in<br></div><div dir="auto">build().<br></div><div dir="auto">> It was moved and there are no release binaries from the GitHub project, which would be a -bin anyway.<br></div><div dir="auto"><br></div><div dir="auto"> - It depends on linux-headers.<br></div><div dir="auto">> That was fixed before the merge: <a target="_blank" rel="noopener noreferrer" href="https://github.com/sickcodes/aur/commit/5e900cd21fc4d6729bb9d41f0bbc47f060cfd06c#diff-b770532527784a5638d944a5d07854bc60a26c8ef9580f74ff72aa865aa73a75">https://github.com/sickcodes/aur/commit/5e900cd21fc4d6729bb9d41f0bbc47f060cfd06c#diff-b770532527784a5638d944a5d07854bc60a26c8ef9580f74ff72aa865aa73a75</a><br></div><div dir="auto"><br></div><div dir="auto"> - It installs **/dkms.conf to /usr/lib/modules-load.d/ for some<br></div><div dir="auto">reason.<br></div><div dir="auto">> Also fixed before the merge: <a target="_blank" rel="noopener noreferrer" href="https://github.com/sickcodes/aur/commit/5e900cd21fc4d6729bb9d41f0bbc47f060cfd06c#diff-b770532527784a5638d944a5d07854bc60a26c8ef9580f74ff72aa865aa73a75">https://github.com/sickcodes/aur/commit/5e900cd21fc4d6729bb9d41f0bbc47f060cfd06c#diff-b770532527784a5638d944a5d07854bc60a26c8ef9580f74ff72aa865aa73a75</a><br></div><div dir="auto"><br></div><div dir="auto">These were all addressed before the merge, to which you agreed. The fact you didn't cancel the merge concerns me.<br></div><div dir="auto"><br></div><div dir="auto">sickcodes commented on 2021-12-13 01:24 <br></div><div dir="auto"><br></div><div dir="auto"> Removed the build function from previous maintainer<br></div><div dir="auto"> Removed linux-headers from previous maintainer<br></div><div dir="auto"> Removed /usr/lib/modules-load.d/ from previous maintainer<br></div><div dir="auto"> Added 5.10 patch<br></div><div dir="auto"><br></div><div dir="auto"><a target="_blank" rel="noopener noreferrer" href="https://aur.archlinux.org/packages/anbox-modules-dkms-git/#comment-840564">https://aur.archlinux.org/packages/anbox-modules-dkms-git/#comment-840564</a><br></div><div dir="auto"><br></div><div dir="auto">That's why I was more than happy to add you as a co-maintainer.<br></div><div dir="auto"><br></div><div dir="auto">For example 5.16.0-rc5-1 wasn't working:<br></div><div dir="auto"><br></div><div dir="auto">==> dkms install --no-depmod binder/1 -k 5.15.14-1-lts<br></div><div dir="auto">==> dkms install --no-depmod ashmem/1 -k 5.16.0-arch1-1<br></div><div dir="auto">==> dkms install --no-depmod ashmem/1 -k 5.16.0-rc5-1-git-00224-g9eaa88c7036e<br></div><div dir="auto">Error! Bad return status for module build on kernel: 5.16.0-rc5-1-git-00224-g9eaa88c7036e (x86_64)<br></div><div dir="auto">Consult /var/lib/dkms/ashmem/1/build/make.log for more information.<br></div><div dir="auto">==> WARNING: `dkms install --no-depmod ashmem/1 -k 5.16.0-rc5-1-git-00224-g9eaa88c7036e' exited 10<br></div><div dir="auto">==> dkms install --no-depmod binder/1 -k 5.16.0-arch1-1<br></div><div dir="auto">==> dkms install --no-depmod ashmem/1 -k 5.16.0-zen1-1-zen<br></div><div dir="auto">==> dkms install --no-depmod ashmem/1 -k 5.15.14-1-lts<br></div><div dir="auto">==> dkms install --no-depmod binder/1 -k 5.16.0-zen1-1-zen<br></div><div dir="auto"><br></div><div dir="auto">Users need a non-git pegged version if upstream changes, thats the end of the story.<br></div><div><br></div><div><br></div><div>In good faith,<br></div><div><br></div><div>Sick Codes of the Security Research Team <a target="_blank" rel="noopener noreferrer" href="https://twitter.com/sickcodes">@SickCodes</a><br></div><div><div><div><br></div></div><div><a href="https://sick.codes" rel="noopener noreferrer" target="_blank">https://sick.codes</a><br></div></div><div dir="auto"><a href="https://github.com/sickcodes" rel="noopener noreferrer" target="_blank">https://github.com/sickcodes</a><br></div><div dir="auto"><a href="https://twitter.com/sickcodes" rel="noopener noreferrer" target="_blank">https://twitter.com/sickcodes</a><br></div><div dir="auto"><a href="https://www.linkedin.com/in/sickcodes/" rel="noopener noreferrer" target="_blank">https://www.linkedin.com/in/sickcodes/</a><br></div><div dir="auto"><a href="https://www.youtube.com/c/sickcodes" rel="noopener noreferrer" target="_blank">https://www.youtube.com/c/sickcodes</a><br></div><div dir="auto"><a href="https://parler.com/profile/sickcodes/" rel="noopener noreferrer" target="_blank">https://parler.com/profile/sickcodes/</a><br></div><div dir="auto"><a href="https://hackerone.com/sickcodes" rel="noopener noreferrer" target="_blank">https://hackerone.com/sickcodes</a><br></div><div dir="auto"><a href="https://bugcrowd.com/sickcodes" rel="noopener noreferrer" target="_blank">https://bugcrowd.com/sickcodes</a><br></div><div dir="auto"><a href="https://hub.docker.com/r/sickcodes" rel="noopener noreferrer" target="_blank">https://hub.docker.com/r/sickcodes</a><br></div><div><div><br></div><div>Jan 16, 2022, 10:46 by env252525@gmail.com:<br></div></div><blockquote class="tutanota_quote" style="border-left: 1px solid #93A3B8; padding-left: 10px; margin-left: 5px;"><div>On Sun, Jan 16, 2022 at 7:07 AM <info@sick.codes> wrote:<br></div><blockquote><div><br></div><div>Thanks for pointing that out Jonathon, Ill fix it tomorrow, as I have done in the past when requested changes.<br></div><div><br></div><div>I have concerns about the intent of the user requesting the deletion; for some unknown reason the request came out of thin air to an actively maintained package, created a duplicate -git, removed all Contributors to the header comment, then filed a merge request, which was merged even after changes had been made.<br></div><div><br></div><div>env25 suggested I add pkgver. I took the users word for it and the user did not cancel the original merge request which moved all the history of non git to the git repo. It was approved as I wasn’t subscribed at the time to the mailing list, and didn’t respond on the list. I certainly responded in the comments however, as per the guidelines.<br></div></blockquote><div><br></div><div>I did not suggest adding pkgver(). I said a proper VCS package also<br></div><div>needs pkgver(). I never suggested any changes.<br></div><div><br></div><div>Even if I did, it is you who added the change.<br></div><blockquote>Env25 was a brand new account but knew everything about the AUR which can insinuate multiple conclusions.<br></blockquote><div><br></div><div>What are you insinuating? Please stop this useless discussion.<br></div><blockquote><div>All I care about is the security of the package. The package history which I have kept in absolute full had been dormant since 2017. I decided to revive it after almost 5 years and I’m actively maintaining it.<br></div><div><br></div><div>I have no attachment to the package, however I’m just concerned for the security of the package which at the time was from a brand new user, yet knew everything about the AUR process.<br></div></blockquote><div><br></div><div>I made you a co-maintainer for anbox-modules-dkms-git.<br></div><div><br></div><div>The original package was a VCS package that did not have a -git<br></div><div>suffix. You changed to pin a specific commit just to keep an unneeded<br></div><div>package there, it does look like you are attached to the package.<br></div><blockquote><div>The most appropriate thing to do is merge the -git package back into non git, which restores all the comment history including Fabio’s original suggestions to fix, to which I addressed.<br></div><div><br></div><div>Then env25 should recreate the git package as all of the historical and important comments were moved to the new one and make no sense as there’s now no git history, no previous maintainer information, no changelog, nowhere to submit PR, and does not respond to comments.<br></div></blockquote><div><br></div><div>I wrote the PKGBUILD for anbox-modules-dkms-git from scratch, there's<br></div><div>no need for Git history.<br></div><blockquote>I don’t understand why eNV25 was in a rush to merge the package yet knows I’m trivially contactable.<br></blockquote><div><br></div><div>Your package was a VCS package. This request is separate.<br></div><blockquote>Now wants to delete the pinned package, which helps nobody who wants to use it.<br></blockquote><div><br></div><div>What's the use for the pinned package? There is no use if you are just<br></div><div>going to update it every commit.<br></div><blockquote>That’s my security paranoid hat on, but I still don’t get the logic behind why the user was in a rush to take over a highly maintained package.<br></blockquote><div><br></div><div>I don't consider taking an old PKGBUILD and uploading it to AUR as is,<br></div><div>a highly maintained package.<br></div><blockquote><div>I added a forewarning to the wiki specifically to address security with the package https://wiki.archlinux.org/title/Anbox#Security<br></div><div><br></div><div>Regards,<br></div><div><br></div><div>In good faith,<br></div><div><br></div><div>Sick Codes of the Security Research Team @SickCodes<br></div><div><br></div><div>https://sick.codes<br></div><div>https://github.com/sickcodes<br></div><div>https://twitter.com/sickcodes<br></div><div>https://www.linkedin.com/in/sickcodes/<br></div><div>https://www.youtube.com/c/sickcodes<br></div><div>https://parler.com/profile/sickcodes/<br></div><div>https://hackerone.com/sickcodes<br></div><div>https://bugcrowd.com/sickcodes<br></div><div>https://hub.docker.com/r/sickcodes<br></div><div><br></div><div><br></div><div>Jan 16, 2022, 04:21 by aur-requests@lists.archlinux.org:<br></div><div><br></div><div>On 15/01/2022 19:00, Sick Codes via aur-requests wrote:<br></div><div><br></div><div>anbox-modules-dkms follows last working commit with the patch for 5.10<br></div><div><br></div><div>anbox-modules-dkms-git follows master branch with sed instead of a patch<br></div><div><br></div><div><br></div><div>As of [1], anbox-modules-dkms is pinned to upstream commits. It is therefore not a VCS package (and doesn't need a pkgver() function, so I'm not sure why one was added).<br></div><div><br></div><div>The sed and patch are now a moot point as 5.10 is no longer in the repos (and looking at the discussion on [2] I'm not convinced either approach is the correct one).<br></div><div><br></div><div>[1] https://aur.archlinux.org/cgit/aur.git/commit/?h=anbox-modules-dkms&id=d77ac721b2e845eb537f23f936287f8b6bbb0363<br></div><div>[2] https://github.com/choff/anbox-modules/pull/1<br></div></blockquote></blockquote><div dir="auto"><br></div> </body>
</html>