2022-05-12
Two days ago the wireplumber
package was made to replace pipewire-media-session
as the latter session manager for PipeWire is considered dead upstream and will see no more releases. Unfortunately, this step was premature.
Our pipewire audio packages (pipewire-alsa
, pipewire-jack
and pipewire-pulse
) ship configuration that prompt media-session to activate PipeWire's audio features. When these packages are not installed and the configuration is missing, PipeWire can be used for screen recording without interfering with ALSA or PulseAudio.
WirePlumber disregards this mechanism and always configures PipeWire to grab audio devices, meaning users of PulseAudio or bare ALSA experience broken audio.
The replacement has been reverted while we attempt to look for a better solution switching to WirePlumber. If you are currently not using PipeWire for audio and wireplumber
got installed on your system, please reinstall pipewire-media-session
and reboot to restore audio functionality.
pacman -Syu pipewire-media-session
Jan Alexander Steffens@Official News
2022-05-09
With the update to qemu 7.0.0 the package has been turned into a more
fine grained split package utilizing meta packages.
- The
qemu
package is now virtually provided by the meta packages
qemu-base
, qemu-desktop
and qemu-full
.
- The functionality of
qemu
prior to 7.0.0 is replaced by
qemu-desktop
- The functionality of
qemu-headless
is replaced by
qemu-base
- The functionality of
qemu-arch-extra
and qemu-headless-arch-extra
is replaced by qemu-emulators-full
- The meta package
qemu-full
provides all QEMU related
packages (excluding qemu-guest-agent
)
David Runge@Official News
2022-04-15
Lets prefix this with: I really love Transparency Logs!
It’s a fairly simple concept: If you hash elements together in a binary tree, you can validate and verify if elements are present on a tree by hashing a couple of elements. This is what is commonly known as a Merkle tree.
I forget the math, but if you have a tree with a million items, you would only really need less than 10 hashes (I think) to figure out what the hash of the top node would be.
Morten Linderud
2022-04-06
In
Arch, a recap I elaborated a bit
on my reasons for getting involved with Arch Linux. In this post I would like
to highlight a few technical details and give a "behind the scenes" when it
comes to packaging on and for Arch Linux.
This post is written from the viewpoint of a distribution packager, but it
is likely to contain information also useful to people packaging on different
distributions or for private purposes.
Read more… (21 min remaining to read)
David Runge@David Runge
2022-04-03
Hello and welcome to another blog article. Today, I would like to discuss one feature of Go 1.18, that I am interested in. No, this will not be another article about generics. The feature I would like to write about is something that might be under the radar for most people, but it still might be useful.
If you ever wrote a CLI app in Go you are very familiar with injecting information during the build process into global variables.
Christian Rebischke
2022-03-26
Valve was kind enough to send Steam Deck devkits to Arch Linux maintainers and developers which gave us an opportunity to mess around with the device.
Personally I find it a bit fun to mess around with video streaming, thus one of the first things I wanted to try figure out was how I could stream the gamemode on the Steam Deck. Installing the OBS flatpak and adding it to the menu doesn’t actually work so we sadly have to be a bit more clever.
Morten Linderud
2022-03-25
The
keycloak
package prior to version 17.0.1-2 was running with WildFly server. Since upstream officially moved to
Quarkus distribution, Arch Linux follows this approach. This means some manual intervention is required for the upgrade.
The configuration needs to be adjusted from the old
.xml
format to the new
/etc/keycloak/keycloak.conf
.
Prior to the upgrade, stop the keycloak service, upgrade the package and migrate the configuration before starting:
systemctl stop keycloak.service
pacman -Syu keycloak
# migrate configuration /etc/keycloak/keycloak.conf
systemctl start keycloak.service
See Keycloak
migration docs and Keycloak Quarkus
server docs
Leonidas Spyropoulos@Official News
2022-02-23
This month we held our leader election, and our current leader Levente Polyák ran unopposed. As per
our election rules he is re-elected for a new term.
Congratulations to Levente Polyak on a new term!
Giancarlo Razzolini@Official News
2022-02-02
We are very happy to announce that debug packages are now available in Arch Linux.
Debug symbols and source listing are provided through our debuginfod instance which can be utilized by debuggers such as gdb and delve.
https://debuginfod.archlinux.org/
A couple of sponsored mirrors are providing the debug repositories while we figure out and communicate the new
mirror requirements.
Not all packages provide debug packages as enabling it for all packages is an ongoing effort.
For more information, please visit the
Debuginfod wiki article, and also our newly renovated
Debugging/Getting traces article.
Morten Linderud@Official News
2022-01-30
One of the things, that has kept me (increasingly) busy over the past few years
is my involvement with the
Linux distribution Arch Linux.
While I have been using
Linux for probably about 14 years it is frankly hard to
pinpoint when exactly I went down the rabbit hole that this operating system/
ecosystem/ community is (relevant
XKCD). However, I can elaborate on my
motivation and where that got me.
Read more… (6 min remaining to read)
David Runge@David Runge
2022-01-21
The linux-firmware package 20220119.0c6a7b3-2 implements kernel
firmware compression. Linux kernel from 5.3 on support loading
from xz compressed firmware.
CONFIG_FW_LOADER_COMPRESS kernel option must be enabled. All official Arch Linux kernel support this for a long time. [1]
The linux-firmware package has been split into smaller packages to
further reduce required disk space. Some big firmware files of
rarely used hardware have been split into separate packages.
This affects firmware for Mellanox Spectrum switches, Marvell devices,
Qualcomm SoCs, Cavium LiquidIO server adapters, QLogic devices,
Broadcom NetXtreme II 10Gb ethernet adapters.
Make sure to install additional firmware packages if needed. [2]
[1]
FS#72899
[2]
FS#72559 +
svn commit
Andreas Radke@Official News
2022-01-19
If you’ve been following my
twitter recently you probably noticed there’s now a
rebuilderd based Debian rebuilder run by the
Purdue Trustworthy Software Ecosystems Lab. The rebuilder backend - the code that’s actually re-creating the build environment and running the build - is
debrebuild.py, written by
Frédéric Pierret from the QubesOS project. The setup as a whole automatically monitors packages in Debian unstable, then downloads the source code, build-dependencies and attempts to compile a bit-for-bit identical binary package. If this succeeds, the package is marked as “reproducible”.
The
62.89% reproducible
number is currently significantly lower than the
94.6% …
kpcyrd
2021-12-27
The libxml2 package prior to version 2.9.12-6 was missing the compiled python modules. This has been fixed in 2.9.12-6, so the upgrade may need to overwrite any untracked pyc files created. If you get errors like these
libxml2: /usr/lib/python3.10/site-packages/__pycache__/drv_libxml2.cpython-310.opt-1.pyc exists in filesystem
libxml2: /usr/lib/python3.10/site-packages/__pycache__/drv_libxml2.cpython-310.pyc exists in filesystem
libxml2: /usr/lib/python3.10/site-packages/__pycache__/libxml2.cpython-310.opt-1.pyc exists in filesystem
libxml2: /usr/lib/python3.10/site-packages/__pycache__/libxml2.cpython-310.pyc exists in filesystem
when updating, use
pacman -Syu --overwrite /usr/lib/python3.10/site-packages/__pycache__/\*
to perform the upgrade.
Jan Alexander Steffens@Official News
2021-11-21
The full configuration for this article can be visited here: https://github.com/shibumi/infra/tree/pulumi-migration
This weekend I had finally some time to have a longer glimpse on Hetzner and Pulumi. Pulumi sparked my interest for a pretty long time now after reading Engin’s blog post about pulumi and Microsoft Azure. I tried Pulumi earlier, but I gave up pretty fast, because it had no Netlify support. The missing Netlify support did not change, but I did not want to invest time in my Terraform configuration, hence I decided to have a look on Pulumi instead.
Christian Rebischke
2021-11-13
As Arch Linux package maintainer I heavily rely on a secure upstream and a secure source code distribution process. I have spent days or maybe even weeks discussing with maintainers why I rely on a secure upstream and how important signatures on tags, commits or source tarballs are. Many maintainers have started signing their source tarballs after such a discussion, others mentioned problems with their PGP keys and a minority saw signing their source tarballs as waste of time.
Christian Rebischke
2021-11-10
This article is a short followup to my last article about cosign. I received many questions for my last article. The most common one was:
“But wait! If the certificates are only valid for 30 minutes, how are my users supposed to validate my artifacts?”
This is very common misconception and to be honest: I ran into the same trap at first. The terms “ephemeral” or “short-lived” do not refer to the signature validation.
Christian Rebischke
2021-11-07
While reading the cosign-installer I have stumbled upon these lines in the documentation:
- name:SigntheimageswithGitHubOIDC**notproductionready**run:cosignsign-oidc-issuerhttps://token.actions.githubusercontent.com${TAGS}env:TAGS:${{steps.docker_meta.outputs.tags}}COSIGN_EXPERIMENTAL:1The shown lines are a step of a Github Action and are still experimental, but very interesting. It allows to sign a docker image via making use of the OpenID Connect standard. OpenID Connect can be summarized as follows: If you login into Github, Github will create a number of tokens. These tokens are then associated with your Github Action and with these tokens you can sign any artifact.
Christian Rebischke
2021-10-18
rebuilderd 0.15.0 very recently released, this is a short intro into what it is, how it works and how to build our own integrations!
rebuilderd monitors an index of artifacts and parses it into a datastructure that looks like this. In the most basic case, based on the
distro
field it’s going to pick the right build script and attempt to generate an artifact identical to the file linked to in
url
.
We’re starting with a script that generates a json. In our case we’ll simply hard-code all values for demonstration purpose. Most of these values can be arbitrary …
kpcyrd
2021-09-30
This is the monthly report of what I’ve been up to in September 2021. 🙌
Reproducible Builds
There have been 3 releases of rebuilderd this month,
0.14.0, and two minor bugfix releases,
0.14.1 and
0.14.2.
The 0.14.0 release introduced experimental support to rebuild
Tails images in
#66. Tails is a portable operating system that’s known for it’s strong focus on privacy and security, and commonly used by activists, journalists and various human-rights NGOs. It already had reproducible images for a long time (since around 2017), but you had to reproduce the images manually. Starting with this release …
kpcyrd
2021-09-24
In this article I want to give a short overview over the current state of Arch Linux with respect to cloud native technologies. I would like to show why I think Arch Linux is perfect as a daily driver in the cloud native ecosystem and how the current state of cloud native software in Arch Linux looks like.
Reason Nr 1: Security At Arch Linux we take security very seriously. Our newly selected project lead has a strong security background (founding member of the Arch Linux security team) and member in a CTF group.
Christian Rebischke
2021-09-01
In looking to moving my phone to LineageOS, I've started thinking about moving
my mail, contacts and calendar data to my own server. After researching solutions for a while, I decided to try out
xandikos. A simple Python carddav/caldav server intended for a single user with a basic feature …
Jelle van der Waa (jelle@vdwaa.nl)@Jelle van der Waa
2021-08-31
This is the monthly report of what I’ve been up to in August 2021. 🙌
Reproducible Builds
There are many different reasons to be interested in Reproducible Builds. When I originally got involved in the project I wasn’t a maintainer in any Linux distribution yet, instead I was wondering if there’s a way to distribute pre-compiled artifacts as an independent open source dev without carrying all the responsibility alone.
A few years later I’ve now published a manual called
i-probably-didnt-backdoor-this. It contains a hello world program and instructions on how to reproduce the various pre-compiled artifacts, explains all build …
kpcyrd
2021-08-21
A few months ago I wrote up some code for mkinitcpio which teaches it how to create UEFI executables utilizing the systemd stub.
The change can be found here: https://github.com/archlinux/mkinitcpio/pull/53
This is a short introduction to why the feature is great, how it makes it easier to boot your system, and how it can be used to better secure your system with something like secure boot.
The Boot Process For the past decade most computers have two ways to boot.
Morten Linderud
2021-08-17
Due to
recent political events there’s an increased interest in Afghanistan’s websites. This is a tutorial on how to run sn0int on
.gov.af
to enumerate as many sites as possible for
archival purpose.
Installation
sn0int can be installed with
pacman -S sn0int
or
brew install sn0int
.
Enumerating an eTLD
We’re going to start sn0int in a new workspace that we call
gov-af
. This can be any name, it’s just a way to organize our data.
We’re then creating a
gov.af
domain object in sn0int so we can run investigations on it. This is technically not how the …
kpcyrd
2021-08-13
Some Linux distributions (like Alpine and Arch Linux) are shipping something called “python bytecode” in their packages. It’s stored in .pyc
files and is generated during the package build. They’re stored in __pycache__
folders and can be seen here:
% tar tvvf /var/cache/pacman/pkg/python-wsproto-1.0.0-1-any.pkg.tar.zst
-rw-r--r-- root/root 5053 2020-12-09 16:24 .BUILDINFO
-rw-r--r-- root/root 2497 2020-12-09 16:24 .MTREE
-rw-r--r-- root/root 436 2020-12-09 16:24 .PKGINFO
drwxr-xr-x root/root 0 2020-12-09 16:24 usr/
drwxr-xr-x root/root 0 2020-12-09 16:24 usr/lib/
drwxr-xr-x root/root 0 2020-12-09 16:24 usr/lib/python3.9/
drwxr-xr-x root/root 0 2020-12-09 16:24 usr/lib/python3.9/site-packages/
drwxr-xr-x root/root 0 2020-12-09 16:24 usr/lib/python3.9/site-packages/wsproto/
drwxr-xr-x root/root 0 2020-12-09 16:24 usr/lib/python3.9/site-packages/wsproto-1.0.0-py3.9.egg-info/
-rw-r--r-- root/root 6997 …
kpcyrd