Active
Inline images AURA Ecosystem, Qubuhub gravatar.com/167559384web4application On Fri, 12 Jun 2026 at 9:07 AM <[email protected]> wrote: > Send Aur-dev mailing list submissions to > [email protected] > > To subscribe or unsubscribe via email, send a message with subject or > body 'help' to > [email protected] > > You can reach the person managing the list at > [email protected] > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Aur-dev digest..."Today's Topics: > > 1. Fwd: AUR Ownership Notification for android-support-repository > (Sasha Moak) > 2. Re: Fwd: AUR Ownership Notification for android-support-repository > (Jonathan Grotelüschen) > > > > ---------- Forwarded message ---------- > From: Sasha Moak <[email protected]> > To: [email protected] > Cc: > Bcc: > Date: Thu, 11 Jun 2026 12:53:15 -0700 > Subject: Fwd: AUR Ownership Notification for android-support-repository > Hello! I am (or was) the owner of this package ( > https://aur.archlinux.org/pkgbase/android-support-repository/). > > However, it might have gotten taken over and it's unclear what the new > owner is trying to do here... > > > https://aur.archlinux.org/cgit/aur.git/tree/android-support-repository-deps.install?h=android-support-repository&id=3bd1a2091b16e6e75d7a0a9a6fd19a07f578a4dc > > It's definitely suspect as this should not need to install anything from > npm. And the new user was recently registered ( 2026-06-11 (UTC)) and is > making the same changes to other aur packages: > > 1. > https://aur.archlinux.org/cgit/aur.git/commit/?h=blinkenlib&id=3a4465e6677b1531161dc36fc3c2e64207ba02dd > 2. > https://aur.archlinux.org/cgit/aur.git/commit/?h=monochrome&id=ac99c178127f5adad5fd62d44d72d0b545ca23e7 > > Definitely looking strange to me... > > Not sure how the new user took over my package though? I thought I'd at > least have the ability to approve/deny? > > Just wanted to drop the message here to see if there's a way to either > delete the package entirely or remove the user? And to look into whatever > it is they're doing? > > Best, > > Sasha Moak > > ---------- Forwarded message --------- > From: <[email protected]> > Date: Thu, Jun 11, 2026 at 10:13 AM > Subject: AUR Ownership Notification for android-support-repository > To: <[email protected]> > > > The package android-support-repository [1] was adopted by huldaschurch > [2]. > > [1] https://aur.archlinux.org/pkgbase/android-support-repository/ > [2] https://aur.archlinux.org/account/huldaschurch/ > > > > ---------- Forwarded message ---------- > From: "Jonathan Grotelüschen" <[email protected]> > To: [email protected], [email protected] > Cc: > Bcc: > Date: Thu, 11 Jun 2026 23:54:35 +0200 > Subject: Re: Fwd: AUR Ownership Notification for android-support-repository > On 2026-06-11 21:53, Sasha Moak wrote: > > Hello! I am (or was) the owner of this package (https:// > > aur.archlinux.org/pkgbase/android-support-repository/ <https:// > > aur.archlinux.org/pkgbase/android-support-repository/>). > > > > Hi Sasha! > > > However, it might have gotten taken over and it's unclear what the new > > owner is trying to do here... > > > > https://aur.archlinux.org/cgit/aur.git/tree/android-support-repository- > > deps.install?h=android-support- > > repository&id=3bd1a2091b16e6e75d7a0a9a6fd19a07f578a4dc <https:// > > aur.archlinux.org/cgit/aur.git/tree/android-support-repository- > > deps.install?h=android-support- > > repository&id=3bd1a2091b16e6e75d7a0a9a6fd19a07f578a4dc> > > I already deleted the malicious commit and banned the account, and now > also disowned the package so you can adopt it again. > > > > > It's definitely suspect as this should not need to install anything from > > npm. And the new user was recently registered ( 2026-06-11 (UTC)) and is > > making the same changes to other aur packages: > > > > 1. https://aur.archlinux.org/cgit/aur.git/commit/? > > h=blinkenlib&id=3a4465e6677b1531161dc36fc3c2e64207ba02dd <https:// > > aur.archlinux.org/cgit/aur.git/commit/? > > h=blinkenlib&id=3a4465e6677b1531161dc36fc3c2e64207ba02dd> > > 2. https://aur.archlinux.org/cgit/aur.git/commit/? > > h=monochrome&id=ac99c178127f5adad5fd62d44d72d0b545ca23e7 <https:// > > aur.archlinux.org/cgit/aur.git/commit/? > > h=monochrome&id=ac99c178127f5adad5fd62d44d72d0b545ca23e7> > > > > Definitely looking strange to me... > > > > Not sure how the new user took over my package though? I thought I'd at > > least have the ability to approve/deny? > > > > My guess is that you disowned the package when declaring the package as > deprecated. That would match the notification email. > > > Just wanted to drop the message here to see if there's a way to either > > delete the package entirely or remove the user? And to look into > > whatever it is they're doing? > > > > Best, > > > > Sasha Moak > > Best, > Jonathan > _______________________________________________ > Aur-dev mailing list -- [email protected] > To unsubscribe send an email to [email protected] >
