Arch Linux User Repository

Hi @xfs, I've tried reproducing the issue but I'm unable to. Are you the same person as the person that reported it upstream?

I've got a PKGBUILD ready with

sed -i -E 's/(tar\s+)(.*\$part_efi.*)/\1--no-same-owner \2/g' "$_pkgname-$pkgver/multios-usb.sh"

in the prepare() function.

Installation fails on Arch Linux with GNU tar 1.35 when extracting the GRUB archive onto the FAT32 EFI partition, because tar tries to preserve file ownership. Adding --no-same-owner to the tar command in multios-usb.sh fixes the issue.

It's already reported upstream on GitHub.

Hi @syl, thanks for your feedback. Good call on the bsdtar dependency, I didn't know it wasn't included by default in de base/base-devel pkgs. I've added libarchive to depends.

Regarding the PGP/GPG authenticity verification: I don't believe any archives/artefacts are signed by the developer.

I'm currently not too active on the maintainership, but extra eyes are always welcome! I try to get updates within a week of them being released, but sometimes I might forget them. Mexit (the upstream author) also has Co-Maintainership here on the AUR, so can also take control whenever needed.

Hi @Ebbez, again thanks for maintaining this package! I've reviewed your PKGBUILD and wanted to share a few gentle suggestions that could help strengthen it according to Arch packaging best practices. Nothing is urgent or blocking—just things to consider for future iterations some security improvements:

Add PGP Signature Verification Currently the package downloads from GitHub releases over HTTPS without verifying the upstream release authenticity with GPG signatures. If you have access to the developer's public key (likely on GitHub or Keybase), consider adding validpgpkeys and downloading signature files alongside the sources. This protects against MITM attacks or compromised GitHub accounts.

Less important: missing bsdtar Dependency The prepare() function uses bsdtar, but this tool isn't listed in the depends array. While most systems have it by default, it would be safer to either add it explicitly or switch to the standard tar command which is guaranteed available on all Arch installations.

@Timothee, thanks for the feedback. I have added dosfstools as a hard dependency for the update to v0.11.1.

Hi, and thanks for maintaining this package.

I ran into an issue on first use: sudo multios-usb /dev/sdc exits immediately with:

mkfs.fat is required but not installed. Exiting

mkfs.fat is provided by dosfstools, which is currently listed only as an optional dependency ("FAT support"). The catch is that fat32 is the default --fs_type, so the package is unusable out of the box (without passing any extra flag) unless dosfstools is installed.

Would it make sense to promote dosfstools to a hard dependency (depends)? The other filesystem tools (e2fsprogs, exfatprogs, ntfs-3g) make perfect sense as optdepends, since they're only needed when their filesystem is explicitly selected — but dosfstools is required for the default behavior.

Thanks!

@ebbez, if you need bit of help from inexperienced hand, don't hesitate.

thanks for bringing it to Arch ^.^y