Question about AUR helper and pkgbuid[Solved]

nurali · 2022-11-15 14:04:05

How to skip intigrity check when Installing an AUR package that requires source code from Github?
I want to edit makepkg.conf for disable intigrity check,but I don't know how,I tried commenting INTIGRITY_CHECK=(sha256) in makepkg.conf,but it did not work.

#-- File integrity checks to use. Valid: md5, sha1, sha224, sha256, sha384, sha512, b2
INTEGRITY_CHECK=(sha256)

Last edited by nurali (2022-11-16 02:40:06)

Trilby · 2022-11-15 14:45:21

https://wiki.archlinux.org/title/VCS_pa … Guidelines

mpan · 2022-11-15 14:46:03

Use SKIP in the *sums array for the corresponding source in the PKGBUILD.

nurali · 2022-11-15 14:53:30

I wan to do something to disable intigrity check for all AUR packages that requires sha256sum check for good....I thought about editing PKGBUILD too,but it is not the most effective solution.....

mpan wrote:

Use SKIP in the *sums array for the corresponding source in the PKGBUILD.

seth · 2022-11-15 14:55:47

I want to do something to disable intigrity check for all AUR packages that requires sha256sum check

No, you don't.
Why do you think you want?

Scimmia · 2022-11-15 14:56:23

And you expect people to help you do something dumb without explaining why you want to do it?

nurali · 2022-11-15 15:09:44

Here is the thing,this city,or I say this place I live,have a very unfriendly network environment,I can not reach to github direcly,so I used proxy,but download speed is too slow,anyway,it solved my AUR-installing problem,then someone told me about a new kind of proxy,I tried it,my download speed came to 30mb/s,but the proxy has a problem,It can change sha256sum of fetch file randomly,sometimes sha256 check passes,sometimes doesn't,if PKGBUID needs two files(for example:7z file and LICENSE),one of them can pass the check,one can not,so I want to disable intigrity check until developer fix that bug(bacause of local law,I can not use VPN)

seth wrote:

I want to do something to disable intigrity check for all AUR packages that requires sha256sum check
No, you don't.
Why do you think you want?

nurali · 2022-11-15 15:11:38

Of course I exactly clear about what am I doing,this is why:
Here is the thing,this city,or I say this place I live,have a very unfriendly network environment,I can not reach to github direcly,so I used proxy,but download speed is too slow,anyway,it solved my AUR-installing problem,then someone told me about a new kind of proxy,I tried it,my download speed came to 30mb/s,but the proxy has a problem,It can change sha256sum of fetch file randomly,sometimes sha256 check passes,sometimes doesn't,if PKGBUID needs two files(for example:7z file and LICENSE),one of them can pass the check,one can not,so I want to disable intigrity check until developer fix that bug(bacause of local law,I can not use VPN)

Scimmia wrote:

And you expect people to help you do something dumb without explaining why you want to do it?

d.ALT · 2022-11-15 15:13:35

nurali wrote:

the proxy has a problem,It can change sha256sum of fetch file randomly,sometimes sha256 check passes,sometimes doesn't

Is this a thing? I wouldn't trust it... Didn't know such things could happen with proxies...

seth · 2022-11-15 15:15:11

It can change sha256sum of fetch file randomly

You do understand the purpose of those checksums, do you?
It's precisely to prevent such shenanigans - if the checksum doesn't fit, somebody has tampered w/ the files. They compromised and under no circumstances should you trust them.
The most benign scenario is that the packages got corrupted by transmission noise, worst case is that you're being spied on.
Avoiding the integrity checks is not a good way to deal with this at all.

Edit: this is a thing if you live in a place where the local dicKtator thinks he needs to supervise your thoughts and privacy.

Last edited by seth (2022-11-15 15:16:31)

nurali · 2022-11-15 15:18:38

https://aya1.eu.org/https/github.com/netptop/siteproxy
You can try it.....I wrote an sh,and put it into the dlagent in the makepkg.conf,it can recognize the url,if url points at github,then use proxy and generate new url and give it to curl to fetch,something like that....

d.ALT wrote:

nurali wrote:
the proxy has a problem,It can change sha256sum of fetch file randomly,sometimes sha256 check passes,sometimes doesn't
Is this a thing? I wouldn't trust it... Didn't know such things could happen with proxies...

Head_on_a_Stick · 2022-11-15 15:18:53

This seems to work:

# cp /usr/{,local/}bin/makepkg
# sed -i 's/check_source_integrity/#&/' /usr/local/bin/makepkg

Really not a good idea though. Delete /usr/local/bin/makepkg to return to sanity.

nurali · 2022-11-15 15:24:47

Thank you for reminding,I think I have to reconsider my thoughts now.....
https://github.com/netptop/siteproxy
this is the sorce page of that proxy....

seth wrote:

It can change sha256sum of fetch file randomly
You do understand the purpose of those checksums, do you?
It's precisely to prevent such shenanigans - if the checksum doesn't fit, somebody has tampered w/ the files. They compromised and under no circumstances should you trust them.
The most benign scenario is that the packages got corrupted by transmission noise, worst case is that you're being spied on.
Avoiding the integrity checks is not a good way to deal with this at all.
Edit: this is a thing if you live in a place where the local dicKtator thinks he needs to supervise your thoughts and privacy.

seth · 2022-11-15 15:25:37

There's a makepkg.conf key that will allow you to skip the checks, but again: AB·SO·LUTE·LY wrong approach to deal w/ the situation.

seth · 2022-11-15 15:29:10

if url points at github,then use proxy and generate new url and give it to curl to fetch

Assuming that the proxy is benign, you maybe want to share that script.

nurali · 2022-11-15 15:32:35

Thank you again....Can I know what the key is?I am not prepare to use it,I have read makepkg.conf again and again,I wat to now what is the answer to my question

seth wrote:

There's a makepkg.conf key that will allow you to skip the checks, but again: AB·SO·LUTE·LY wrong approach to deal w/ the situation.

d.ALT · 2022-11-15 15:36:40

nurali wrote:

Can I know what the key is?

I think seth is referring to: https://wiki.archlinux.org/title/Makepk … e_checking

Head_on_a_Stick · 2022-11-15 15:36:50

I think it's

SKIPCHECKSUMS=1

EDIT: I really should have read check_source_integrity() before mauling it...

Last edited by Head_on_a_Stick (2022-11-15 15:40:59)

seth · 2022-11-15 15:41:14

https://man.archlinux.org/man/core/pacm … .conf.5.en look for BUILDENV

nurali · 2022-11-15 15:41:20

Of course,here is the script:

#!/bin/bash

DOMAIN=`echo $2 | cut -f3 -d'/'`;        
OTHERS=`echo $2 | cut -f3- -d'/'`;       

case "$DOMAIN" in
    "github.com")                      
    url="aya1.eu.org:443/https/"$OTHERS;
    /usr/bin/curl -gqb "" -fLC - --retry 3 --retry-delay 3 -o $1 $url;
    ;;

    "raw.githubusercontent.com")
    url="aya1.eu.org:443/https/"$OTHERS;
    /usr/bin/curl -gqb "" -fLC - --retry 3 --retry-delay 3 -o $1 $url;
    ;;

    *)                          
    url=$2;
    echo "正在龟速下载 $url";
    /usr/bin/curl -gqb "" -fLC - --retry 3 --retry-delay 3 -o $1 $url; 
    ;;

esac

seth wrote:

if url points at github,then use proxy and generate new url and give it to curl to fetch
Assuming that the proxy is benign, you maybe want to share that script.

nurali · 2022-11-15 15:44:33

Isn't it about PGP check?

d.ALT wrote:

nurali wrote:
Can I know what the key is?
I think seth is referring to: https://wiki.archlinux.org/title/Makepk … e_checking

nurali · 2022-11-15 15:48:29

I've tried editing it into

BUILDENV=(!distcc !color !ccache !check !sign)

It didn't work:D

seth wrote:

https://man.archlinux.org/man/core/pacm … .conf.5.en look for BUILDENV

nurali · 2022-11-15 15:50:16

Time to sleep,thanks man,goodnight

seth wrote:

https://man.archlinux.org/man/core/pacm … .conf.5.en look for BUILDENV

seth · 2022-11-15 16:02:53

-gqb "" -fLC -

Why is that there?

man curl wrote:

-f, --fail
(HTTP) Fail fast with no output at all on server errors. This is useful to enable
scripts and users to better deal with failed attempts. In normal cases when an HTTP
server fails to deliver a document, it returns an HTML document stating so (which
often also describes why and more). This flag will prevent curl from outputting
that and return error 22.
This method is not fail-safe and there are occasions where non-successful response
codes will slip through, especially when authentication is involved (response codes
401 and 407).

The check parameter is apparently strictly limited to the explicit check funtion, sorry.

Trilby · 2022-11-15 16:32:11

Nurali, you said this is specifically an issue in retrieving source code from github, right? But any -git PKGBUILD should already SKIP the checksum. So does this only apply to packages that download versioned tarballs from github? There certainly are a number of such packages, but they are small minority of AUR packages. How many of these are you working with? Why do you need a general solution (of disabling *all* checksums, which has lots of negative side-effects) to a problem that is specific to very few packages?

Last edited by Trilby (2022-11-15 16:59:20)

Arch Linux

#1 2022-11-15 14:04:05

Question about AUR helper and pkgbuid[Solved]

#2 2022-11-15 14:45:21

Re: Question about AUR helper and pkgbuid[Solved]

#3 2022-11-15 14:46:03

Re: Question about AUR helper and pkgbuid[Solved]

#4 2022-11-15 14:53:30

Re: Question about AUR helper and pkgbuid[Solved]

#5 2022-11-15 14:55:47

Re: Question about AUR helper and pkgbuid[Solved]

#6 2022-11-15 14:56:23

Re: Question about AUR helper and pkgbuid[Solved]

#7 2022-11-15 15:09:44

Re: Question about AUR helper and pkgbuid[Solved]

#8 2022-11-15 15:11:38

Re: Question about AUR helper and pkgbuid[Solved]

#9 2022-11-15 15:13:35

Re: Question about AUR helper and pkgbuid[Solved]

#10 2022-11-15 15:15:11

Re: Question about AUR helper and pkgbuid[Solved]

#11 2022-11-15 15:18:38

Re: Question about AUR helper and pkgbuid[Solved]

#12 2022-11-15 15:18:53

Re: Question about AUR helper and pkgbuid[Solved]

#13 2022-11-15 15:24:47

Re: Question about AUR helper and pkgbuid[Solved]

#14 2022-11-15 15:25:37

Re: Question about AUR helper and pkgbuid[Solved]

#15 2022-11-15 15:29:10

Re: Question about AUR helper and pkgbuid[Solved]

#16 2022-11-15 15:32:35

Re: Question about AUR helper and pkgbuid[Solved]

#17 2022-11-15 15:36:40

Re: Question about AUR helper and pkgbuid[Solved]

#18 2022-11-15 15:36:50

Re: Question about AUR helper and pkgbuid[Solved]

#19 2022-11-15 15:41:14

Re: Question about AUR helper and pkgbuid[Solved]

#20 2022-11-15 15:41:20

Re: Question about AUR helper and pkgbuid[Solved]

#21 2022-11-15 15:44:33

Re: Question about AUR helper and pkgbuid[Solved]

#22 2022-11-15 15:48:29

Re: Question about AUR helper and pkgbuid[Solved]

#23 2022-11-15 15:50:16

Re: Question about AUR helper and pkgbuid[Solved]

#24 2022-11-15 16:02:53

Re: Question about AUR helper and pkgbuid[Solved]

#25 2022-11-15 16:32:11

Re: Question about AUR helper and pkgbuid[Solved]

Board footer