Arch Linux User Repository

Quick status update:

• The tarball has been migrated off Web Archive to a repository I control on Disroot. The checksums have not been altered at this time.
• I still plan to investigate altering which .mem file is to be used.

Just a heads up; there is a pending merge request with another, freshly generated AUR package. This is rather suspicious as the new AUR package has checksums completely disabled and bypasses makepkg's downloading infrastructure by calling wget manually inside the "package" function.

Please be on alert in case this merge request goes through. I am going to respond to this merge request via the mailing list.

Orphan request went through. I've adopted this package and will look into doing a few updates. Mainly the following:

• Move the source URL off web.archive.org to somewhere more easily audited.
• Change which ".mem" file the package builds from to point to a more up-to-date one from inside the archive.

If anyone has any maintenance requests, feel free to reach out to me via the email listed on my profile.

Big thanks to @AurelienDuval6 for maintaining the package and @redchenjs for submitting it originally!

@bkmo: Good catch, thank you for pointing it out! It's been fixed in v1.1.0-2 which I just pushed.

@usta: I can't comment on the vetting process for new AUR packages (nor do I think I should). I also cannot, nor do I think I should, comment on whether @nikolaizamega is a legitimate user or not. There's no real way to tell. I do think the behavior being displayed is suspicious, though.

You can track the progress on the merge request via the aur-requests mailing list topic here. I have already responded. Just waiting on the response to get seen by the moderators as I accidentally replied before subscribing to the list from my main email and thus it got caught in the moderation queue.

is this guy legit ? i mean that Nikolai Zamega ? created a newpackage named -ng , looks so fishy even its github history have only 1 commit at 1 year ago. Does aur admins check the possible of kind of scam ? ( the downloaded .tar.gz have weird files in it ) [ 200~.git file ]

The PKGBUILD is not referencing the correct source tarball. install: cannot stat 'uPD72020x-Firmware-1.1.0/UPDATE.mem': No such file or directory

Quick status update:

• The tarball has been migrated off Web Archive to a repository I control on Disroot. The checksums have not been altered at this time.
• I still plan to investigate altering which .mem file is to be used.

Just a heads up; there is a pending merge request with another, freshly generated AUR package. This is rather suspicious as the new AUR package has checksums completely disabled and bypasses makepkg's downloading infrastructure by calling wget manually inside the "package" function.

Please be on alert in case this merge request goes through. I am going to respond to this merge request via the mailing list.

@glek great to hear that. Please do ensure to not alter the binary such that the checksum does not change.

Orphan request went through. I've adopted this package and will look into doing a few updates. Mainly the following:

• Move the source URL off web.archive.org to somewhere more easily audited.
• Change which ".mem" file the package builds from to point to a more up-to-date one from inside the archive.

If anyone has any maintenance requests, feel free to reach out to me via the email listed on my profile.

Big thanks to @AurelienDuval6 for maintaining the package and @redchenjs for submitting it originally!

Regardless of the recent comments and the current situation, I’d like to thank you for the work behind this package—it’s been very useful to many. I hope everything is well and that it can be picked up again when possible.

@jronald:

As @gothicVI mentioned, yes, it's because somebody marked it being out of date despite it not being and they have not. They have not removed the flag (over 6 months later) and the current maintainer has not changed the package since then either.

I might just submit an orphan request and take this package over. The user maintaining it hasn't logged in since taking it over and only maintains two packages.

@jronald yes, because someone marked it as outdated even though it is not...

yay always shows the warning:

 -> Flagged Out Of Date AUR Packages: upd72020x-fw