RepoJournal
Arch Linux @archlinux
124 wires and counting
$ status: archived — this briefing has stopped; the archive stays readable. browse live briefings →

$ status

wire 2026-08-01
stories 54
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

AUR ADOPTION FLOW TIGHTENED AFTER ORPHAN PACKAGE BYPASS

By RepoJournal · Filed · About Arch Linux · Composed from the cited sources · methodology

George Rawlinson Leonidas Spyropoulos Jan Steffens Caleb Maclennan Rafael Epplée
5 people shipped this
George Rawlinson @grawlinson 3 cited Leonidas Spyropoulos @inglor 2 cited Jan Steffens @heftig 1 cited Caleb Maclennan @alerque 1 cited Rafael Epplée @raffomania 1 cited

Arch's package repository just closed a critical gap where pushing to an orphaned package made you its maintainer with zero oversight.

The AUR web interface was allowing contributors to claim orphan packages by direct push, circumventing the formal adoption request process entirely [6]. That same vulnerability also broke the adoption request flow itself: accepting a request would grant maintainership to the accepting Package Maintainer instead of the actual requester [7]. Both fixes are now live, restoring proper access controls and ensuring adoption requests route correctly. Across the repository stack this period, the team pushed 54 commits managing package updates and infrastructure cleanup [1] [2] [3] [4] [5]. On the build side, the demo data layer has been stripped from buildbtw now that the system can display real builds [8] [9], eliminating confusion during testing.

Action items

References

  1. [1] remove python-pkg_resources from extra-any archlinux/state ↗
  2. [2] update gnome-user-docs to 50.4-1 in extra-any archlinux/state ↗
  3. [3] update lux to 0.39.8-1 in extra-x86_64 archlinux/state ↗
  4. [4] update python-shtab to 1.9.2-1 in extra-any archlinux/state ↗
  5. [5] update forgejo to 16.0.2-1 in extra-x86_64 archlinux/state ↗
  6. [6] feat: reject pushes to orphan package bases ↗ archlinux/aurweb
  7. [7] fix: grant adoption requests to the requester ↗ archlinux/aurweb
  8. [8] Merge branch 'remove-bbtw-show-demo-data' into 'main' ↗ archlinux/buildbtw
  9. [9] Remove bbtw show demo data ↗ archlinux/buildbtw

$ ls archlinux/reviews/ # the step-back reads

the week in review Kernel v7.2.4-arch1 ships with userns sysctl the month in review August's Arch: AUR hardening, kernel churn, and steady package flow
Topics: Infrastructure Full archive → Weekly reviews →

Quick answers

What shipped in Arch Linux on August 1, 2026?
Arch's package repository just closed a critical gap where pushing to an orphaned package made you its maintainer with zero oversight. In total, 54 commits landed.
Who contributed to Arch Linux on August 1, 2026?
5 developers shipped this update, including George Rawlinson, Jan Steffens, Caleb Maclennan, Leonidas Spyropoulos, and Rafael Epplée.
What were the notable Arch Linux updates?
remove python-pkg_resources from extra-any, update gnome-user-docs to 50.4-1 in extra-any, and update lux to 0.39.8-1 in extra-x86_64.
♥

$ log @archlinux --recent

Felix Yan promotes the xmonad stack to extra, moor lands at 2.19.2 50 shipped Synapse 1.161.0 lands in infrastructure, anki promoted to extra 70 shipped Arch ships a CLONE_NEWUSER kill switch in v7.2.6-arch2 59 shipped mise and asusctl land in extra, tracexec hits 1.0 50 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.