Malicious code has been found and deleted later from 3 AUR packages acroread, blaz and minergate (e,g: acroread PKGBUILD detail ). It was found in a commit released by a malicious user by changing the owner of the orphaned AUR package and including a malicious curl command. The curl command will download the main bash script x then the second script u (u.sh) in order to create a systemd service and using a function to collect some system data (non sensitive data) but the scripts can be modified by the attacker to be uploaded sequentially. In practice not all users have the ability to check the PKGBUILD before building any package on their systems for some reasons (require some knowledge , take more time etc...). To understand how it work I have downloaded and uploaded the 2 bash scripts on this pastbin page . What is the easiest way to check an AUR package for malicious code? naked security : Another Linux community with malware woes Malicious Software Packages Found On Arch Linux User Repository

When I run makepkg -cf, I get an error: ==> ERROR: PKGBUILD does not exist. But if I run makepkg -p PKGBUILD.asc it works. Can someone explain to me someone why the first doesn't work?

So I took over an orphaned AUR package that contains separate sources for 32-bit and 64-bit packages. I'm on a 64-bit machine, but I want to also test that the 32-bit installation works before I push the updated PKGBUILD. I've read through the [PKGBUILD](https://wiki.archlinux.org/title/PKGBUILD) section of the Arch Linux Wiki, but it doesn't mention anything about doing this. Example of what PKGBUILD looks like (simplified):

pkgname=...
pkgver=...
pkgdesc=...
arch=('i686' 'x86_64')
depends_x86_64=(
  'lib32-freetype2')
depends_i686=(
  'freetype2')
source_x86_64=("https://site.com/download/{pkgver}_amd64.deb "
                "https://archive.archlinux.org/packages/l/lib32-freetype2/lib32-freetype2-2.11.0-3-x86_64.pkg.tar.zst ")
source_i686=("https://site.com/download/{pkgver}_i386.deb "
              "https://archive.archlinux.org/packages/f/freetype2/freetype2-2.11.0-4-x86_64.pkg.tar.zst ")
sha256sums_i686=('SKIP'
                 'SKIP')
sha256sums_x86_64=('SKIP'
                   'SKIP')

package() {
	install -d -m0755 "${pkgdir}"/usr/{share/applications,share/pkgname}
}

How can I force makepkg to build the 32bit version?

Some packages like gcc-libs are apparently other packages, under a different name. turns out gcc-libs is just gcc: PKGBUILD if I want to install that package, I know I can run pacman -S gcc-libs, but how can I find the original package, as in, the package which has a PKGBUILD named after it?

In the PKGBUILD file for an AUR I am working on, I get the following error in my package() function:

./install.sh: No such file or directory

here is the function:

package() {
	cd /opt/"$pkgname"/pymoab
	./install.sh
	python setup.py install
}

The file is in the directory, and it is called 'install.sh.cmake'. I have tried changing the command in the package() function multiple ways, including:

bash install.sh
bash install.sh.cmake
bash ./install.sh
bash ./install.sh.cmake
./install.sh
./install.sh.cmake
. ./install.sh
. ./install.sh.cmake

All give the same error. I originally wrote this as a set of shells scripts, which work well. In the shell script the command is:

bash install.sh

So I'm not sure why it doesn't work in the package() function. I am testing this on a fresh arch distro (junest: https://github.com/fsquillace/junest) All input appreciated. Let me know if I can provide more detail.

I already have a GPG key configured. I have cloned the git source code package locally. I'm building in a chroot with extra-x86_64-build. I am able to build packages *without* signing and add them to the local private repo. Now I want to build the package, **sign it** and add it to my private local repo in a way that will require signature validation on the client when installed with pacman. **What are the steps?** Below are my current steps, which I assembled from many different Arch wiki pages, man pages, and other places. I include some detail to show what I'm doing and where I'm still having confusion or trouble. Note: I am able to complete all three of the first sections without any issues. My problems start after that. ### preliminary general steps (all completed): 1. read wiki pages (such as [https://wiki.archlinux.org/index.php/Creating\_packages](https://wiki.archlinux.org/index.php/Creating_packages)) 2. install base-devel, devtools, namcap, shellcheck 3. systemctl status haveged # make sure it is active ### preliminary package signing steps (all completed): * review /usr/share/devtools/pacman-extra.conf * I added my local private/custom repository here (with default SigLevel) * edit /etc/makepkg.conf: * BUILDENV=(!distcc color !ccache check sign) # make sure sign is active * PACKAGER="My Name " * GPGKEY="1234ABCD09876" # use your key full fingerprint uppercase, no whitespace * with an existing GPG key on my user's keyring do these steps: * gpg --armor --output mykey.sec --export-secret-keys 1234ABCD09876 * sudo pacman-key -a mykey.sec * sudo pacman-key --finger 1234ABCD09876 * sudo pacman-key --lsign-key 1234ABCD09876 ### prepare source files, PKGBUILD (completed): 1. git clone ${url} # or git pull if already cloned 2. inspect PKGBUILD 3. namcap -i PKGBUILD 4. makepkg --packagelist # inspect version number (optional) ## Questions: 1. FYI - I am starting with internal & trusted source files. They are not signed and there are no sums in the PKGBUILD I start with. 2. how do I modify the PKGBUILD for including sums of the built package and its .sig file? * at what step is the package's .sig file added to the PKGBUILD? How is that done? 3. when are the sums for the built package added to the PKGBUILD? * when do I run this step? makepkg -g >> PKGBUILD * when is this used instead? updpkgsums ### next, build the package in a chroot env (I can do this *only without* package signing) extra-x86\_64-build NOTE: I am running into this issue: makepkg: fail to sign source package with dynamic version [https://bbs.archlinux.org/viewtopic.php?id=259771](https://bbs.archlinux.org/viewtopic.php?id=259771) (I guess this will be solved with the next release of pacman? For now, I guess the work-around is to hard-code the version number instead of using VCS-derived versions?) ### how to add to private repo (I can do this without pkg signing, but I have not succeeded in creating a signed package to test with): * newpkg="mypackage.r10.918a28e-1-any.pkg.tar.zst" # example * namcap -i "$newpkg" * repoctl add --require-signature "$newpkg" ### repo questions: * is the --require-signature arg needed in the line above?

When trying to install some (though not all) packages from AUR using yay or pacaur, such as rstudio-desktop or zotero, I get the following errors (translated from German):

:: checking integrity of zotero...
==> ERROR: PKGBUILD contains CRLF characters and cannot be executed.
:: preparing zotero...
==> ERROR: PKGBUILD contains CRLF characters and cannot be executed.
:: failed to verify integrity or prepare zotero package
:: failed to verify integrity or prepare zotero package

This is right after a new install and update of Manjaro. It did not occur after another new install yesterday. I can confirm that in ~/.cache/pacaur/ and ~/.cache/yay/ there are PKGBUILDs with CRLF, which also return if I delete them and retry.

The latest release of Brackets (v1.13) is not available in the AUR. So I downloaded the official .deb package from the official site. Now how do I go about installing it ? Do I have to write a PKGBUILD? I won't know it's dependency and all. I have converted it to an arch package with Debtap. But pacman -U throws unresolvable dependency for the following: warning: cannot resolve "libudev>=147", a dependency of "brackets" warning: cannot resolve "lsb-base>=3.2", a dependency of "brackets" How should I go about this ?

I would like to have an backup of all pacaur and pacman packages. Example: https://www.archlinux.org/packages/ How to download it all?

I am trying to install the Agena programming language for a school project on Arch Linux. There is no package in the AUR, so I am trying to make my own PKGBUILD file. I think I have managed to install it, but when I try to run it, I get this error.

agena: error while loading shared libraries: libreadline.so.7: cannot open shared object file: No such file or directory

However, I have installed the readline7 package from the AUR, and there is in fact a symlink usr/lib/readline.so.7 When I try to run agenaedit which is an IDE that comes with the language (in the same deb file) I get a similar error, but with libXext.so.6, which is also already located in /usr/lib/ (I didn't need to install anything for this one) Here is what I have so far as my PKGBUILD. The steps I have gone through to install it are in the prepare and package functions. (This is my first PKGBUILD, so if I am doing anything wrong, please let me know in the comments.)

_pkgname="agena"
pkgname="$_pkgname-bin"
pkgver="2.22.0"
pkgrel=1
pkgdesc="An easy-to-learn procedural programming language designed to be used in science, scripting, and many other applications."
arch=('x86_64')
url="http://$_pkgname.sourceforge.net/ "
license=('GPL')
groups=()
depends=("readline7" "git" "curl")
makedepends=()
checkdepends=()
optdepends=()
provides=()
conflicts=()
replaces=()
backup=()
options=()
install=
changelog=
source=("https://master.dl.sourceforge.net/project/agena/Binaries/Agena%20$pkgver/$_pkgname-$pkgver-linux.i386.deb ")
noextract=()
md5sums=()
validpgpkeys=()

prepare() {
	# extract data.tar.xz from the .deb file
	ar p $_pkgname-$pkgver-linux.i386.deb data.tar.xz | tar x -J

	# download readline7 library (and its gpg key)
	git clone https://aur.archlinux.org/readline7.git 
	curl https://tiswww.case.edu/php/chet/gpgkey.asc  --output chet.asc
	gpg --import chet.asccd
	rm chet.asc
}

package() {
	# copy .deb contents to /usr
	cp -r usr /

	# install readline7
	cd readline7
	makepkg -si --asdeps
}

### Edit Here is the output of strace agena.

execve("/usr/local/bin/agena", ["agena"], 0x7ffe745ab990 /* 55 vars */) = 0
[ Process PID=6296 runs in 32 bit mode. ]
brk(NULL)                               = 0x57d7e000
arch_prctl(0x3001 /* ARCH_??? */, 0xffc0efc8) = -1 EINVAL (Invalid argument)
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=169663, ...}) = 0
mmap2(NULL, 169663, PROT_READ, MAP_PRIVATE, 3, 0) = 0xf7eb1000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib32/libm.so.6", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\3\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\340\302\0\0004\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=833360, ...}) = 0
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf7eaf000
mmap2(NULL, 835600, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xf7de2000
mmap2(0xf7dee000, 557056, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xc000) = 0xf7dee000
mmap2(0xf7e76000, 225280, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x94000) = 0xf7e76000
mmap2(0xf7ead000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xca000) = 0xf7ead000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib32/libdl.so.2", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0 \22\0\0004\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=17880, ...}) = 0
mmap2(NULL, 20532, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xf7ddc000
mmap2(0xf7ddd000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0xf7ddd000
mmap2(0xf7ddf000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0xf7ddf000
mmap2(0xf7de0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0xf7de0000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib32/tls/i686/sse2/libreadline.so.7", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat64("/usr/lib32/tls/i686/sse2", 0xffc0e3f0) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib32/tls/i686/libreadline.so.7", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat64("/usr/lib32/tls/i686", 0xffc0e3f0) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib32/tls/sse2/libreadline.so.7", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat64("/usr/lib32/tls/sse2", 0xffc0e3f0) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib32/tls/libreadline.so.7", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat64("/usr/lib32/tls", 0xffc0e3f0)    = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib32/i686/sse2/libreadline.so.7", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat64("/usr/lib32/i686/sse2", 0xffc0e3f0) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib32/i686/libreadline.so.7", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat64("/usr/lib32/i686", 0xffc0e3f0)   = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib32/sse2/libreadline.so.7", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat64("/usr/lib32/sse2", 0xffc0e3f0)   = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib32/libreadline.so.7", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat64("/usr/lib32", {st_mode=S_IFDIR|0755, st_size=24576, ...}) = 0
writev(2, [{iov_base="agena", iov_len=5}, {iov_base=": ", iov_len=2}, {iov_base="error while loading shared libra"..., iov_len=36}, {iov_base=": ", iov_len=2}, {iov_base="libreadline.so.7", iov_len=16}, {iov_base=": ", iov_len=2}, {iov_base="cannot open shared object file", iov_len=30}, {iov_base=": ", iov_len=2}, {iov_base="No such file or directory", iov_len=25}, {iov_base="\n", iov_len=1}], 10agena: error while loading shared libraries: libreadline.so.7: cannot open shared object file: No such file or directory
) = 121
exit_group(127)                         = ?
+++ exited with 127 +++

I was building font-manager package from AUR on my Arch system. It is throwing a warning while the process :

==> WARNING: Package contains reference to $srcdir 
usr/lib/font-manager/libfontmanager.so.0.7.9

Should I worry about this warning ? Is it harmful to my system anyway ?

I am trying to get Open Build Service to accept this PKGBUILD: ~~~ # Maintainer: Ole Tange pkgname=parallel pkgver=20200622 pkgrel=2 pkgdesc='Build and execute shell command lines from standard input in parallel' arch=('any') url='https://www.gnu.org/software/parallel/ ' license=('GPL3') depends=('perl' 'procps') source=(https://ftp.gnu.org/gnu/$pkgname/$pkgname-$pkgver.tar.bz2{,.sig}) sha256sums=('41ce2f31b7850ad86b88dc756faf78a70e4ae92f45fa6603b7d108148ebe6513' 'SKIP') validpgpkeys=('CDA01A4208C4F74506107E7BD1AB451688888888') prepare() { cd parallel-$pkgver } build() { cd parallel-$pkgver ./configure --prefix=/usr make } package() { cd parallel-$pkgver make DESTDIR="$pkgdir/" install } ~~~ But it complains: nothing provides perl, binutils, procps, gcc, ... I imagine I need a line that says: Please provide me with basic build dependencies. You can see it "live" at: https://build.opensuse.org/package/show/home:tange/parallel What do I need to change to make OBS build the package?

I am running debian stretch and following this guide for building package from source for debian. Sometimes building process takes hours , when I run dpkg-buildpackage -rfakeroot again , it starts building from scratch. dpkg-buildpackage --help does not show any option to resume. How can I resume package building ?

I know the latest Neofetch is available in the official arch repository but I want to build it from the git clone. Since it doesn't have the PKGBUILD so makepkg is out of question and the global step ( make install) doesn't do anything. I have read that Yaourt compiles it with makepkg. But how to do that without any AUR helper?

I have a tree which I need to install with a foder named /usr. This folder exists in src folder. Now I need to write a function in PKGBUILD that installs to the fakeroot before the *.pkg.tar.gz is built. What needs to go in > PKGBULD package() { # I need to copy the 'usr' dir in 'srcdir' to PKGBUILD's fakeroot }

I want to build Vim from source in Arch Linux to get various non-standard features in the resulting binary. I notice that the PKGBUILD file has URLs in it. Does this mean I can do the build with just this file? $ asp export vim (modify PKGBUILD as needed) $ sudo makepkg ...or do I need to checkout the whole source tree?

How can I list dependencies of a PKGBUILD file with shell script? For example, in a [google-chrome's PKGBUILD](https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=google-chrome) , I want the script to extract all dependencies (including makedependencies, dependencies and optdependencies) like this: alsa-lib gtk3 libcups libxss libxtst nss kdialog ... I think this can be achieved with regex, but I don't know how...

While building an rpm package we can use this exclude command in the spec file to exclude the particular file in certain packages. ex. %exclude foobar/bin/printjob_svr.bin How and where do we specify the same while building a deb package? I have a list of files that need to be excluded while building different packages from the source. Right now I am able to build three different packages from the source but all the files are present while installation.

I do know that there are 4 different classes of packages in Linux: 1. Packages provided by the operating system 2. Packages provided by third parties 3. Self-made packages of third-party software 4. Self-made packages of your own software I am trying to find examples for each of these classes so I can better understand it. So I came up with the following: 1. packges like firewalld or kernel packages 2. packages like virtual box or vmware player 3. Am no sure about this one, maybe a developer developing a package that's related to or built on another 3rd party software?? Tmux custom versions ?? maybe 4. this one is just easy Am I right in these examples, I would need just a little bit more elaboration here on #3. Self-made packages of third-party software, do you guys have any examples. Thank you

I want to install the CUPS driver for the Brother QL-1060N label printer on Arch Linux. Fortunately, there is an AUR package available. (Arch is amazing.) However, the AUR package is a bit out of date. My question is, how can I edit the PKGBUILD file to install the latest driver version? Here is the AUR package. It is for version 1.0.1r0 Here is the Brother driver download link. The current version is 1.0.5-0. Below is the PKGBUILD: # Maintainer: Karol Babioch # Inspired by package brother-dcp130c pkgname='brother-ql1060n' pkgver=1.0.1r0 pkgrel=1 pkgdesc='LPR and CUPS driver for Brother QL-1060N label printer' url='http://solutions.brother.com/linux/en_us/ ' arch=('i686' 'x86_64') license=('custom') depends='cups' if [ "$CARCH" = 'x86_64' ]; then depends+=('lib32-glibc') fi install="$pkgname.install" source=("http://download.brother.com/welcome/dlfp002231/ql1060nlpr-${pkgver/r/-}.i386.rpm " "http://download.brother.com/welcome/dlfp002233/ql1060ncupswrapper-${pkgver/r/-}.i386.rpm " 'LICENSE') sha256sums=('f2c2f919ec15b6159e13bfec60bb2d515f8c77a812e349a0ed1ec68ac29f5a25' 'bf7a1d86234d643547fc9052df55524a5e4ddbd4bf07799988c18666e7d2d3eb' 'cdd1955a9996bc246ba54e84f0a5ccbfdf6623962b668188762389aa79ef9811') prepare() { # do not install in '/usr/local' if [ -d $srcdir/usr/local/Brother ]; then install -d $srcdir/usr/share mv $srcdir/usr/local/Brother/ $srcdir/usr/share/brother rm -rf $srcdir/usr/local sed -i 's|/usr/local/Brother|/usr/share/brother|g' grep -lr '/usr/local/Brother' ./ fi # setup cups directories install -d "$srcdir/usr/share/cups/model" install -d "$srcdir/usr/lib/cups/filter" # go to the cupswrapper directory and find the source file from wich to generate a ppd- and wrapper-file cd find . -type d -name 'cupswrapper' if [ -f cupswrapper* ]; then _wrapper_source=ls cupswrapper* sed -i '/^\/etc\/init.d\/cups/d' $_wrapper_source sed -i '/^sleep/d' $_wrapper_source sed -i '/^echo lpadmin/d' $_wrapper_source sed -i '/^lpadmin/d' $_wrapper_source sed -i 's|/usr|$srcdir/usr|g' $_wrapper_source sed -i 's|/opt|$srcdir/opt|g' $_wrapper_source sed -i 's|/model/Brother|/model|g' $_wrapper_source sed -i 's|lpinfo|echo|g' $_wrapper_source export srcdir=$srcdir ./$_wrapper_source sed -i 's|$srcdir||' $srcdir/usr/lib/cups/filter/*lpdwrapper* sed -i "s|$srcdir||" $srcdir/usr/lib/cups/filter/*lpdwrapper* rm $_wrapper_source fi # /etc/printcap is managed by cups rm find $srcdir -type f -name 'setupPrintcap*' } package() { cd "$srcdir" cp -R usr $pkgdir if [ -d opt ]; then cp -R opt $pkgdir; fi install -Dm0644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE" } The .install file in the package archive include only this: post_install() { post_upgrade; } post_upgrade() { echo "Restart CUPS to load the new files" echo "You can now register your new printer using the web interface at:" echo " http://localhost:631/" } Some questions include: Why isn't rpmextract required in the PKGBUILD code? I don't understand how the install is working given that the packages are RPMs and this is Arch. Regarding the sha256sums, I assume I just manually download the rpm files and calculate those sums given that the Brother download page doesn't list them (afaik). The values I come up with are: 05d786b9a5b2cf374d5c286ae8feb77e2a79619cc5b2f6ca2695dbd549eec0a3 ql1060ncupswrapper-1.0.5-0.i386.rpm bf20a00f723d0e12cf055ae359d0e03e2c1bd839bacd52f02b3cc5a63bc652e5 ql1060nlpr-1.0.5-0.i386.rpm I assume the license file and it's sha256sum can remain unchanged. Given that, is updating the PKGBUILD as simple as replacing the sha256sums and updating this one value? pkgver=1.0.1r0 with pkgver=1.0.5-0 #UPDATE The package maintainer has updated the package already. Here is a diff: 5c5 pkgver=1.0.5r0 19,20c19,20 sha256sums=('bf20a00f723d0e12cf055ae359d0e03e2c1bd839bacd52f02b3cc5a63bc652e5' > '05d786b9a5b2cf374d5c286ae8feb77e2a79619cc5b2f6ca2695dbd549eec0a3' However, I'll leave the question up because I would like to understand how this PKGBUILD works and how an RPM package can be installed using this method.