How to use archlinuxcn for only one application?

Matix · 2020-04-12 16:51:11

I added archlinuxcn to /etc/pacman.conf in order to install chromium-vaapi (aur package would be compiling a few hours).
But now when i run pacman -Syu it also updates aur programs like for example spotify or visual-studio-code-bin. I want to updated it using aur repositories via yay.
Is it possible to add archlinuxcn only for chromium-vaapi with the possibility of updating?

mpan · 2020-04-12 17:02:50

Is there any particular reason you want to avoid using the archlinuxcn repo for packages conflicting with the ones you have built yourself? Security can’t be a concern in this case, because there is no difference between trusting a repository for one package and many of them.⁽¹⁾ And you are saving yourself time and effort by not having to track changes and build packages.

You may instruct pacman to ignore packages you have built yourself by using the IgnorePkg option (see man pacman.conf).

____
⁽¹⁾ To be precise: there may be a minor difference if you are trusting only specific package signers. But that’s a tedious task and I assume a person, who would have such a setup in place, would not start this thread.

Last edited by mpan (2020-04-12 17:08:25)

Matix · 2020-04-12 17:13:07

There are 3 reasons:
1) When source code is visible for everyone viruses are more likely to be found.
2) I'm not sure, but I suppose that some programs are built differently depending on platform and dependencies. And when program is compiled on my machine it should always fit.
3) Some programs may have delays in updates.

OK, I can ignore every aur program, but it is frustrating and I can forget about something. Isn't there any way to instead of making blacklist make whitelist?

Last edited by Matix (2020-04-12 17:14:22)

sevendogs · 2020-04-12 17:44:22

This is absolutely NOT true.

When source code is visible for everyone viruses are more likely to be found.

What do you think the term "open source" means? Go ask Microsoft how it's going with respect to vulnerabilities and code visibility. Code visibility has zero to do with vulnerabilities or viruses.

Trilby · 2020-04-12 17:50:03

~~Quoting for emphasis. Read this over and over until it sinks in, and ask for further information if it doesn't.~~

sevendogs wrote:

This is absolutely NOT true.
When source code is visible for everyone viruses are more likely to be found.

That said, to answer your initial question, you can just download the package from a mirror and install it with `pacman -U <package>`

EDIT: OOPS! I misinterpreted the OPs point (and I suspect sevendogs may have too). Sorry. Yes, when the source code is visible, it can be more likely that any issue would indeed be detected. Using a built package prevents this access. Of course the only actors who could maliciously put something in the binary packages distributed on archlinuxcn could (and if they existed, most likely would) similarly manipulate chromium-vaapi. So either you trust them, or you don't. So here, really my main answer above seems most fit: just download the chromium-vaapi package from the repo and install it with pacman -U.

Last edited by Trilby (2020-04-12 20:41:46)

shulamy · 2020-04-12 19:52:30

But now when i run pacman -Syu it also updates aur programs

that look's strange to me

ezik

loqs · 2020-04-12 20:05:38

shulamy wrote:

But now when i run pacman -Syu it also updates aur programs
that look's strange to me

archlinuxcn contains spotify and visual-studio-code-bin so they are updated but it is not using AUR to update the packages.

mpan · 2020-04-12 21:29:03

shulamy wrote:

But now when i run pacman -Syu it also updates aur programs
that look's strange to me

OP has built and installed (using pacman -U) packages based on PKGBUILDs from AUR. But since archlinuxcn contains packges with identical names, when OP does pacman -Syu the packages are updated from archlinuxcn. Instead, OP wants to manually build them and install every time using pacman -U.

Last edited by mpan (2020-04-12 21:30:08)

Matix · 2020-04-13 00:41:47

archlinuxcn contains spotify and visual-studio-code-bin so they are updated but it is not using AUR to update the packages.

Exactly like loqs said I need archlinuxcn just to have chromium-vaapi up to date. pacman -Syu updates also packages using archlinuxcn which I want to update via aur.
So far using ignore in pacman.conf seems to be the best option, but I will have to remember to add there every new aur package which I will install.

Last edited by Matix (2020-04-13 00:42:20)

sevendogs · 2020-04-13 01:01:32

Trilby wrote:

~~Quoting for emphasis. Read this over and over until it sinks in, and ask for further information if it doesn't.~~
sevendogs wrote:
This is absolutely NOT true.
When source code is visible for everyone viruses are more likely to be found.
That said, to answer your initial question, you can just download the package from a mirror and install it with `pacman -U <package>`
EDIT: OOPS! I misinterpreted the OPs point (and I suspect sevendogs may have too). Sorry. Yes, when the source code is visible, it can be more likely that any issue would indeed be detected. Using a built package prevents this access. Of course the only actors who could maliciously put something in the binary packages distributed on archlinuxcn could (and if they existed, most likely would) similarly manipulate chromium-vaapi. So either you trust them, or you don't. So here, really my main answer above seems most fit: just download the chromium-vaapi package from the repo and install it with pacman -U.

I absolutely did not misinterpret that. Source code visibility has zero to do with vulnerabilities, period. For example, all cryptographic algorithms are open for review and MUST be reviewed by as many eyes as possible. Obfuscation does nothing but hurt code security.

Trilby · 2020-04-13 01:12:58

sevendogs wrote:

Source code visibility has zero to do with vulnerabilities, period. For example, all cryptographic algorithms are open for review and MUST be reviewed by as many eyes as possible. Obfuscation does nothing but hurt code security.

Your contradicting yourself here. Does obfuscation hurt security, or have zero to do with it? Do more eyes reviewing help, or have zero to do with vulnerabilities?

sevendogs · 2020-04-13 01:14:59

Sorry, what I mean to say is the fact code is open helps security. That is what I was trying to illustrate. Obfuscating code does not provide security. That’s the point I was trying to make.

Trilby · 2020-04-13 01:21:28

And why are you trying to make it here? The OP prefers to build from source rather than trusting a precompiled binary because when the source code is available it is more likely that issues will be caught. You quoted this statement and empasized that it is NOT true, only to go on and state effectively the same thing.

sevendogs · 2020-04-13 01:27:17

Sigh. I have apparently completely misread OPs original statement. My apologies.

Trilby · 2020-04-13 01:31:56

No worries. So did I ... the first time. Told you so

mpan · 2020-04-13 01:34:55

Matix
I just got another idea: name your own packages so they do not conflict with those in archlinuxcn. This should work well, unless you are using AUR helpers.

Last edited by mpan (2020-04-13 01:35:29)

sevendogs · 2020-04-13 01:40:11

Trilby wrote:

No worries. So did I ... the first time. Told you so

Whew, I am not alone, I just took too long getting the point

Last edited by sevendogs (2020-04-13 01:40:29)

eschwartz · 2020-04-13 22:22:06

Matix wrote:

There are 3 reasons:
1) When source code is visible for everyone viruses are more likely to be found.

The source code for archlinuxcn packages *is* visible, they provide PKGBUILDs and they even use a special bot which is configured for many packages to cp the PKGBUILD from the AUR, so you're using the exact same PKGBUILD to boot.

The only thing which is less secure about using archlinuxcn vs. compiling from the AUR yourself is... if you don't trust archlinuxcn because you think they might be maliciously adding their own code to chromium-vaapi after they got the AUR PKGBUILD.

You're not concerned about that for chromium-vaapi, you're happy to consider them to be trustworthy repository maintainers... but for spotify and visual-studio-code-bin you now start distrusting archlinuxcn?

Anything archlinuxcn could have done to spotify or visual-studio-code-bin, they could do to chromium-vaapi too.

Matix wrote:

2) I'm not sure, but I suppose that some programs are built differently depending on platform and dependencies. And when program is compiled on my machine it should always fit.

Not if they're using the exact same PKGBUILD...

Matix wrote:

3) Some programs may have delays in updates.

Since archlinuxcn relies heavily on bots to help them synchronize with the AUR and auto-build packages, I doubt they will tend to be behind on updates.

svito · 2020-04-13 23:08:24

You can switch from yay to aurutils and put your AUR packages local repository above archlinuxcn in pacman.conf.

Last edited by svito (2020-04-13 23:09:18)

Matix · 2020-04-13 23:51:01

So finally I decided to remove archlinuxcn from pacman.conf.
I created script which downloads latest chromium-vaapi and installs it.

#!/bin/bash
url=https://repo.archlinuxcn.org/x86_64/
pack=`curl -s $url | grep -Po chromium-vaapi.*\.zst'(?=")' | sort -r | head -n 1`
currentVersion=`pacman -Qi chromium-vaapi | grep -Po '^Version.*: \K.*$'`
newVersion=`echo $pack | grep -Po 'chromium-vaapi-\K.*(?=-x86_64.pkg.tar.zst)'`
if [[ $currentVersion == $newVersion ]]
then
	echo "chromium-vaapi is up to date"
	exit 0
fi
filepath=`mktemp /tmp/chromium-vaapiXXXXX`
echo "Installing from: $url$pack"
wget -qO $filepath --show-progress $url$pack
sudo pacman -U $filepath

Last edited by Matix (2020-04-14 00:58:35)

eschwartz · 2020-04-13 23:53:24

sudo pacman -U "$url$pack"

It will use pacman's internal downloader and save the package in /var/cache/pacman/pkg for backup.

Last edited by eschwartz (2020-04-13 23:54:05)

Matix · 2020-04-14 01:21:21

eschwartz wrote:

sudo pacman -U "$url$pack"
It will use pacman's internal downloader and save the package in /var/cache/pacman/pkg for backup.

Seriously... I thought I had to provide path on my disk xd
At least I've learned something writing that.

However pacman -U "$url$pack throws package missing required signature, because I uninstalled archlinuxcn-keyring and my solution doesn't have this problem.

Last edited by Matix (2020-04-14 01:22:13)

eschwartz · 2020-04-14 01:28:54

Wouldn't you want to check the signature to make sure no one e.g. tampers with your internet connection and serves you malware instead of the original archlinuxcn package?

Trilby · 2020-04-14 01:55:57

No reason to scrape the web page and sort multiple packages, just get the current one from their sync database:

repo=https://repo.archlinuxcn.org/x86_64/
pkg=$(curl -s ${repo}archlinuxcn.db | zgrep -ax 'chromium-vaapi-.*')
pacman -U ${repo}${pkg}

Or potentially even better, just have a secondary pacman config that you use just for this repo/package:

pacman --config /etc/pacman.d/archlinuxcn.conf -Sy chromium-vaapi

Then let pacman do all the work it was designed to do.

The archlinuxcn.conf would be just the following:

[options]
Architecture = auto
SigLevel    = Required DatabaseOptional

[archlinuxcn]
Server = https://repo.archlinuxcn.org/x86_64/

Note that the other repos should *not* be included in this config file so you don't sync the other repositories without a full upgrade.

Or to have it all self contained in a single script, this particularly odd beast will do it well:

cat <<EOF | pacman -Sy chromium-vaapi --config /dev/stdin
[options]
Architecture = auto
SigLevel    = Required DatabaseOptional

[archlinuxcn]
Server = https://repo.archlinuxcn.org/x86_64/
EOF

(I'm not sure why I could just put the config in a heredoc, that was my first attempt, but cating the heredoc and using /dev/stdin works).

Last edited by Trilby (2020-04-14 02:05:19)

eschwartz · 2020-04-14 04:00:58

I guess the heredoc works because pacman opens the tty to read replies to things. You should also be able to use the special bash feature

pacman ... --config <(cat <<EOF
...........
EOF
)

to pass the config file in as a file descriptor using process substitution.

...

In the spirit of inventiveness which this thread has ended up in, I'll propose yet another solution, add the archlinuxcn repo to the main conf file but with "Usage = Sync Search" and packages will never be installed from there unless you do "pacman -S archlinuxcn/chromium-vaapi" with the "archlinuxcn/" prefix to the package name.

Arch Linux

#1 2020-04-12 16:51:11

How to use archlinuxcn for only one application?

#2 2020-04-12 17:02:50

Re: How to use archlinuxcn for only one application?

#3 2020-04-12 17:13:07

Re: How to use archlinuxcn for only one application?

#4 2020-04-12 17:44:22

Re: How to use archlinuxcn for only one application?

#5 2020-04-12 17:50:03

Re: How to use archlinuxcn for only one application?

#6 2020-04-12 19:52:30

Re: How to use archlinuxcn for only one application?

#7 2020-04-12 20:05:38

Re: How to use archlinuxcn for only one application?

#8 2020-04-12 21:29:03

Re: How to use archlinuxcn for only one application?

#9 2020-04-13 00:41:47

Re: How to use archlinuxcn for only one application?

#10 2020-04-13 01:01:32

Re: How to use archlinuxcn for only one application?

#11 2020-04-13 01:12:58

Re: How to use archlinuxcn for only one application?

#12 2020-04-13 01:14:59

Re: How to use archlinuxcn for only one application?

#13 2020-04-13 01:21:28

Re: How to use archlinuxcn for only one application?

#14 2020-04-13 01:27:17

Re: How to use archlinuxcn for only one application?

#15 2020-04-13 01:31:56

Re: How to use archlinuxcn for only one application?

#16 2020-04-13 01:34:55

Re: How to use archlinuxcn for only one application?

#17 2020-04-13 01:40:11

Re: How to use archlinuxcn for only one application?

#18 2020-04-13 22:22:06

Re: How to use archlinuxcn for only one application?

#19 2020-04-13 23:08:24

Re: How to use archlinuxcn for only one application?

#20 2020-04-13 23:51:01

Re: How to use archlinuxcn for only one application?

#21 2020-04-13 23:53:24

Re: How to use archlinuxcn for only one application?

#22 2020-04-14 01:21:21

Re: How to use archlinuxcn for only one application?

#23 2020-04-14 01:28:54

Re: How to use archlinuxcn for only one application?

#24 2020-04-14 01:55:57

Re: How to use archlinuxcn for only one application?

#25 2020-04-14 04:00:58

Re: How to use archlinuxcn for only one application?

Board footer