Arch Planet

Planet Arch Linux is a window into the world, work and lives of Arch Linux developers, trusted users and support staff.

RSS Feed

Removing python2 from the repositories


Python 2 went end of life January 2020. Since then we have been actively cutting down the number of projects depending on python2 in our repositories, and we have finally been able to drop it from our distribution. If you still have python2 installed on your system consider removing it and any python2 package. If you still require the python2 package you can keep it around, but please be aware that there will be no security updates. If you need a patched package please consult the AUR, or use an unofficial user repository.

Arch Linux mailing list changes


As part of dropping Python 2 which is EOL, we have migrated our mailing lists from mailman2 to mailman3. Rewriting of the "From" header and subject (to prepend the list name) have been disabled to keep the DKIM signature intact. This means "reply to mailing list" must be used when replying to the list and you may need to update your filters and rules matching the "From" header. All existing subscriptions are migrated and you do not need to re-subscribe. For managing your subscriptions a new mailman3 account must be registered.

Grub bootloader upgrade and configuration incompatibilities


Recent changes in grub added a new command option and changed the way the command is invoked. Depending on your system hardware and setup this could cause an unbootable system due to incompatibilities between the installed bootloader and configuration. After a grub package update it is advised to run both, installation and regeneration of configuration: grub-install ... grub-mkconfig -o /boot/grub/grub.cfg For more specific information on grub-install, please refer to the wiki: GRUB - ArchWiki

Day in the life of a package maintainer: Reproducible Go packages


In this new blog series, I would like to introduce you to the daily adventures of an Arch Linux package maintainer. This time, we will have a look at reproducible package builds. Reproducible package builds are very important for us, as package maintainers, because reproducible package builds create an independently-verifiable path from source to the final package. This means, every Arch Linux user can verify that noone tampered with the Arch Linux package build process.

wxWidgets 3.2 update may need manual intervention


wxWidgets 3.2 provides a Qt frontend in addition to the GTK3 one, so packages have been renamed from wxgtk- to wxwidgets-. The GTK2 frontend is no longer provided. If you have wxgtk2 installed, the upgrade will fail with error: failed to prepare transaction (could not satisfy dependencies) :: removing wxgtk-common breaks dependency 'wxgtk-common' required by wxgtk2 In such case, uninstall wxgtk2 first and then proceed with the upgrade.

Managing binary package repositories


In Packaging for Arch Linux I described the ins and outs of binary repository management and some of the issues that come with the tooling currently used by Arch Linux. In this article I will highlight the work on new tooling and its features. Since my last write-up on this topic, the project formerly known as arch-repo-management has been renamed to repod (as in repo-d) and has just seen its first minor release. 🎉 You can find its documentation at Read more… (2 min remaining to read)

Network-bound disk encryption on Arch Linux


While in a discussion with my coworkers, a coworker brought up that they wanted to have automatic LUKS disk decryption on their desktop while it was at home. Normally they would use a passphrase to decrypt the LUKS volume but would prefer automatic decryption. There are multiple ways to achieve …

萌新的 PolarFire SoC Icicle Kit 初体验


这两天翻出来了去年代收的 PolarFire SoC Icicle Kit。因为隔壁的 FPGA 大佬们看不上这块板子,我打算尝试物尽其用一下,目标只是用板子上的 RISC-V 核启动 Arch Linux RISC-V 的 rootfs 测试(把它当作一块 SD 卡槽没有问题、并且带 PCIE 的 HiFive Unleashed 来用。隔壁嵌入式群的大佬们:买椟还珠!)。如此便开始了年轻人的 FPGA 初体验(可能还是不能算)。 噩梦的开始 一开始尝试的当然是最新版的 Yocto 镜像,毕竟这是“官方”的 Linux 镜像。结果刷完后立刻遇到了启动失败: 一开始我还以为是 SD 卡坏了。在多次尝试未果后…… 当时的猜测是(不一定对),可能因为板子上 FPGA 部分(抱歉,我不知道专业的称呼)不够新,所以我打算刷一下 HSS。结果这成为了噩梦的开始。 可怕的“硬件”工具链 我最初参考的文档来自 U-boot: 这份文档可能已经颇为过时,里面编译 HSS 的部分从一开始就找不到名叫“icicle-kit-es”的 BOARD. 在我加上 mpfs- 前缀,并根据后续报错依次按照我的 CROSS 工具链目标修改了 PLATFORM_RISCV_ABI=lp64d PLATFORM_RISCV_ISA=rv64gc 之后,我遇到了第一个大魔王:SoftConsole。 好在这个工具可以无需注册直接下载。 顺利安装完成后,按照要求设置 SC_INSTALL_DIR,我终于看到了……下个错误:缺少 … Continue reading 萌新的 PolarFire SoC Icicle Kit 初体验 The post 萌新的 PolarFire SoC Icicle Kit 初体验 first appeared on Felix's Blog.

Move away from streaming platforms & take your music offline


I don't use Spotify or any other streaming platform for listening to music. Some call it old habits, some call it needless effort, but I'm very used to downloading MP3 files over the internet and putting them in a folder on my phone then using the whatever default media player I have installed. However, for a couple of years, I have been following a better and automated approach for taking my music offline and feeling a bit less like I'm in a consumerism bubble.

auth-tarball-from-git: Verifying tarballs with signed git tags


I noticed there’s a common anti-pattern in some PKGBUILDs, the short scripts that are used to build Arch Linux packages. Specifically we’re looking at the part that references the source code used when building a package: source=("git+${pkgver}?signed") validpgpkeys=('4DAA67A9EA8B91FCC15B699C85CDAE3C164BA7B4' 'A56EF308A9F1256C25ACA3807EA8F8B94622A6A9') sha256sums=('SKIP') This does:
  • authentication: verify the git tag was signed by one of the two trusted keys.
  • pinning: the source code is not pinned and git tags are not immutable, upstream could create a new signed git tag with an identical name and arbitrarily change the source code without the PKGBUILD noticing.
In contrast consider this PKGBUILD: source=($pkgname-$pkgver.tar.gz::$pkgver.tar.gz) sha256sums=('e48d4b10762c2707bb17fd8f89bd98f0dcccc450d223cade706fdd9cfaefb308') …

Replacing Youtube with Kodi plugin


As Google announced Gsuite is no longer free and I moved to GrapheneOs to de-google further, the last frequently used Google application I use is Youtube. For a long time Youtube has support for RSS feeds for channels although they are not publicly visible. I usually watch videos in my …

Undone replacement of pipewire-media-session with wireplumber


Two days ago the wireplumber package was made to replace pipewire-media-session as the latter session manager for PipeWire is considered dead upstream and will see no more releases. Unfortunately, this step was premature. Our pipewire audio packages (pipewire-alsa, pipewire-jack and pipewire-pulse) ship configuration that prompt media-session to activate PipeWire's audio features. When these packages are not installed and the configuration is missing, PipeWire can be used for screen recording without interfering with ALSA or PulseAudio. WirePlumber disregards this mechanism and always configures PipeWire to grab audio devices, meaning users of PulseAudio or bare ALSA experience broken audio. The replacement has been reverted while we attempt to look for a better solution switching to WirePlumber. If you are currently not using PipeWire for audio and wireplumber got installed on your system, please reinstall pipewire-media-session and reboot to restore audio functionality. pacman -Syu pipewire-media-session

QEMU >= 7.0.0 changes split package setup


With the update to qemu 7.0.0 the package has been turned into a more fine grained split package utilizing meta packages.
  • The qemu package is now virtually provided by the meta packages qemu-base, qemu-desktop and qemu-full.
  • The functionality of qemu prior to 7.0.0 is replaced by qemu-desktop
  • The functionality of qemu-headless is replaced by qemu-base
  • The functionality of qemu-arch-extra and qemu-headless-arch-extra is replaced by qemu-emulators-full
  • The meta package qemu-full provides all QEMU related packages (excluding qemu-guest-agent)

How hard upgrading a Rust JWT library could be?


Recently one of my clients requested me to maintain their Rust project. It is a web server that is built with Rocket + Diesel and running stable for a couple of years now. Like any other Rust developer would do, the first thing that I checked was the outdated dependencies via cargo-outdated. The result was close to what I expected: most of the dependencies were out-of-date. However, among all those crates, rust-jwt caught my eye. It was 12 minor versions behind!

Rewriting sysctl(8) in Rust: systeroid


sysctl is a simple and great tool for modifying the kernel parameters. It does its job very well by providing an easy-to-use interface for /proc/sys. It is maintained as a part of procps toolkit for years and it can easily be considered a legacy tool today. So why not push it to its limits and turn it into a more user-friendly and even more useful tool with the power of Rust?

Monitoring the Transparency Log for a year


Lets prefix this with: I really love Transparency Logs! It’s a fairly simple concept: If you hash elements together in a binary tree, you can validate and verify if elements are present on a tree by hashing a couple of elements. This is what is commonly known as a Merkle tree. I forget the math, but if you have a tree with a million items, you would only really need less than 10 hashes (I think) to figure out what the hash of the top node would be.

Packaging for Arch Linux


In Arch, a recap I elaborated a bit on my reasons for getting involved with Arch Linux. In this post I would like to highlight a few technical details and give a "behind the scenes" when it comes to packaging on and for Arch Linux. This post is written from the viewpoint of a distribution packager, but it is likely to contain information also useful to people packaging on different distributions or for private purposes. Read more… (21 min remaining to read)

Go 1.18 debug/buildinfo features


Hello and welcome to another blog article. Today, I would like to discuss one feature of Go 1.18, that I am interested in. No, this will not be another article about generics. The feature I would like to write about is something that might be under the radar for most people, but it still might be useful. If you ever wrote a CLI app in Go you are very familiar with injecting information during the build process into global variables.

Streaming the Steam Deck to OBS


Valve was kind enough to send Steam Deck devkits to Arch Linux maintainers and developers which gave us an opportunity to mess around with the device. Personally I find it a bit fun to mess around with video streaming, thus one of the first things I wanted to try figure out was how I could stream the gamemode on the Steam Deck. Installing the OBS flatpak and adding it to the menu doesn’t actually work so we sadly have to be a bit more clever.

Keycloak 17.0.1-2 update requires manual reconfiguration


The keycloak package prior to version 17.0.1-2 was running with WildFly server. Since upstream officially moved to Quarkus distribution, Arch Linux follows this approach. This means some manual intervention is required for the upgrade. The configuration needs to be adjusted from the old .xml format to the new /etc/keycloak/keycloak.conf. Prior to the upgrade, stop the keycloak service, upgrade the package and migrate the configuration before starting: systemctl stop keycloak.service pacman -Syu keycloak # migrate configuration /etc/keycloak/keycloak.conf systemctl start keycloak.service See Keycloak migration docs and Keycloak Quarkus server docs

Arch Linux Leader Election Results


This month we held our leader election, and our current leader Levente Polyák ran unopposed. As per our election rules he is re-elected for a new term. Congratulations to Levente Polyak on a new term!

Debug packages and debuginfod


We are very happy to announce that debug packages are now available in Arch Linux. Debug symbols and source listing are provided through our debuginfod instance which can be utilized by debuggers such as gdb and delve. A couple of sponsored mirrors are providing the debug repositories while we figure out and communicate the new mirror requirements. Not all packages provide debug packages as enabling it for all packages is an ongoing effort. For more information, please visit the Debuginfod wiki article, and also our newly renovated Debugging/Getting traces article.

Arch, a recap


One of the things, that has kept me (increasingly) busy over the past few years is my involvement with the Linux distribution Arch Linux. While I have been using Linux for probably about 14 years it is frankly hard to pinpoint when exactly I went down the rabbit hole that this operating system/ ecosystem/ community is (relevant XKCD). However, I can elaborate on my motivation and where that got me. Read more… (6 min remaining to read)

linux-firmware 20220119.0c6a7b3-2 requires kernel >=5.3 and package splitting


The linux-firmware package 20220119.0c6a7b3-2 implements kernel firmware compression. Linux kernel from 5.3 on support loading from xz compressed firmware. CONFIG_FW_LOADER_COMPRESS kernel option must be enabled. All official Arch Linux kernel support this for a long time. [1] The linux-firmware package has been split into smaller packages to further reduce required disk space. Some big firmware files of rarely used hardware have been split into separate packages. This affects firmware for Mellanox Spectrum switches, Marvell devices, Qualcomm SoCs, Cavium LiquidIO server adapters, QLogic devices, Broadcom NetXtreme II 10Gb ethernet adapters. Make sure to install additional firmware packages if needed. [2] [1] FS#72899 [2] FS#72559 + svn commit

Reproducible Builds: Debian and the case of the missing version string


If you’ve been following my twitter recently you probably noticed there’s now a rebuilderd based Debian rebuilder run by the Purdue Trustworthy Software Ecosystems Lab. The rebuilder backend - the code that’s actually re-creating the build environment and running the build - is, written by Frédéric Pierret from the QubesOS project. The setup as a whole automatically monitors packages in Debian unstable, then downloads the source code, build-dependencies and attempts to compile a bit-for-bit identical binary package. If this succeeds, the package is marked as “reproducible”. The 62.89% reproducible number is currently significantly lower than the 94.6% …