Who contributed to Arch Linux on July 27, 2026?

3 developers shipped this update, including Caleb Maclennan, Antonio Rojas, and Leonidas Spyropoulos.

What were the notable Arch Linux updates?

fix: canonicalize dot/plus-address variants when checking email uniqueness, chore(release): prepare version 6.4.2, and remove riff from extra-x86_64.

Jul 27, 2026

$ the-wire · showcase

AURWEB PLUGS EMAIL VALIDATION LOOPHOLE AS PACKAGE REPO TRIMS CRUFT

By RepoJournal · Filed 06:57 UTC on July 27, 2026 · About Arch Linux · Composed from the cited sources · methodology

3 people shipped this

Leonidas Spyropoulos @inglor 3 cited

Caleb Maclennan @alerque 1 cited

Antonio Rojas @antonio-rojas 1 cited

The AUR web backend just closed a registration flaw that could let attackers bypass email uniqueness checks using Gmail dot-notation tricks, while the main repository purges two stalled packages.

AUR web 6.4.2 shipped with a critical fix: email canonicalization now normalizes dot and plus-address variants before checking uniqueness [1] [2]. Without it, someone could register user+tag@gmail.com after admin@gmail.com claimed the address, since the system compared exact strings instead of normalized forms. The fix adds a static rule table per provider (dot-stripping, plus-tag folding, alias-domain mapping) inspired by industry patterns but avoiding the DoS risk of live MX lookups [1]. Infrastructure bumped aurweb to 6.4.2 immediately [8], so the fix is live. On the repo side, maintainers removed riff from extra-x86_64 and haskell-brick from staging [3] [4], cutting dead weight. Python packages python-jellyfin-apiclient and python-aioesphomeapi graduated from testing repos to stable [5] [6], and amule bumped to 1:3.0.1-2 [7]. Across all three desks, 53 commits touched the stack.

Action items

→ Verify aurweb 6.4.2 is running in production and monitor AUR registration for abuse archlinux/aurweb [immediate]
→ Review any pending email registrations that might have used dot/plus variants before the fix deployed archlinux/aurweb [plan]
→ Pull the latest infrastructure code with 6.4.2 pinned to your deployments archlinux/infrastructure [plan]

References

[1] fix: canonicalize dot/plus-address variants when checking email uniqueness ↗ archlinux/aurweb
[2] chore(release): prepare version 6.4.2 ↗ archlinux/aurweb
[3] remove riff from extra-x86_64 archlinux/state ↗
[4] remove haskell-brick from extra-staging-x86_64 archlinux/state ↗
[5] move python-jellyfin-apiclient from extra-testing-any to extra-any archlinux/state ↗
[6] move python-aioesphomeapi from extra-testing-x86_64 to extra-x86_64 archlinux/state ↗
[7] update amule to 1:3.0.1-2 in extra-x86_64 archlinux/state ↗
[8] aurweb: bump to 6.4.2 ↗ archlinux/infrastructure