Arch Linux

regulator

Member

Registered: 2020-01-15

Posts: 26

RESOLVED suspicious AUR Package udf-http-range-proxy

Hi all,

when i try to run yay -Syu I get asked

```
:: Searching AUR for updates...
:: There are 2 providers available for udf-http-range-proxy<2.0:
:: Repository AUR
    1) udf-http-range-proxy 2) udf-http-range-proxy

Enter a number (default=1):
```

why doesnt yay tell me which package requires this first?

tried a few things and I cant see which pkig needs it..  and when i look on AUR/Git its a new package with only one maintainer, 0 issues, forks etc
https://github.com/RubenKelevra/udf-http-range-proxy

can someone please weigh in?

and how do you do a code block now? no mention of post formatting on the forum rules page and first ddg search failed me

Last edited by regulator (Today 09:44:07)

loqs

Member

Registered: 2014-03-06

Posts: 19,048

Re: RESOLVED suspicious AUR Package udf-http-range-proxy

Did you look at https://aur.archlinux.org/packages/udf-http-range-proxy which lists all the AUR packages depending on it?

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 77,739

Re: RESOLVED suspicious AUR Package udf-http-range-proxy

The (only) consumers PKGBUILD  also explains what it does and why. Also see https://en.wikipedia.org/wiki/Universal_Disk_Format

and how do you do a code block now? no mention of post formatting

https://bbs.archlinux.org/help.php#bbcode is linked under the text form

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

regulator

Member

Registered: 2020-01-15

Posts: 26

Re: RESOLVED suspicious AUR Package udf-http-range-proxy

Thanks both

Did you look at https://aur.archlinux.org/packages/udf-http-range-proxy which lists all the AUR packages depending on it?

Yes I did look at the AUR page and thought why do fonts need a http proxy?

The pkgbuild doesn't tell me anything useful or gain trust in any way, and that Wiki doesn't reference the package? Anyone could make something in the AUR and say its used for disk formatting, then link it to fonts

I've been using arch for 6 years so wonder how new users would approach this

loqs

Member

Registered: 2014-03-06

Posts: 19,048

Re: RESOLVED suspicious AUR Package udf-http-range-proxy

The pkgbuild doesn't tell me anything useful or gain trust in any way

https://aur.archlinux.org/cgit/aur.git/ … win10-auto lines 15 to 25 provide the explanation;

# This PKGBUILD retrieves only the required data from the Windows 10 Enterprise evaluation
# ISO. udf-http-range-proxy parses the ISO's UDF metadata via HTTP range requests and
# exposes sources/install.wim as a virtual range-capable file. rclone mounts
# that localhost endpoint through FUSE so 7-Zip can seek directly to the WIM resources
# containing the fonts, without downloading the full ISO or creating loop devices.
#
# If the range-based path is unavailable, the build falls back to downloading the complete
# ISO. That fallback requires roughly 8 GiB of temporary free disk space.
#
# The rclone mount and helper process are cleaned up automatically on both success and
# failure. Extracted fonts and the Microsoft license are verified in prepare().

lines 422 to 784 are the implementation of the above.

Wiki doesn't reference the package? Anyone could make something in the AUR and say its used for disk formatting, then link it to fonts

How did you come to have the package installed instead of ttf-ms-win10 which installs from locally provided files?

regulator

Member

Registered: 2020-01-15

Posts: 26

Re: RESOLVED suspicious AUR Package udf-http-range-proxy

that description makes more sense, when you click the view PKGBUILD on AUR package page it takes you here:
https://aur.archlinux.org/cgit/aur.git/ … ange-proxy

I have microsoft fonts for wine etc, some guide would have told me to install them probably 6 years ago, ill try that package ^ thanks again

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 77,739

Re: RESOLVED suspicious AUR Package udf-http-range-proxy

The (only) consumers PKGBUILD  also explains what it does and why

Why would you expect some package explaining what other packages use it for?

Please always remember to mark resolved threads by editing your initial posts subject - so others will know that there's no task left, but maybe a solution to find.
Thanks.

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

regulator

Member

Registered: 2020-01-15

Posts: 26

Re: RESOLVED suspicious AUR Package udf-http-range-proxy

I see! on the ms-ttf-fonts PKGBUILD they explain why http proxy is required, thanks

 This PKGBUILD retrieves only the required data from the Windows 10 Enterprise evaluation ISO. udf-http-range-proxy parses the ISO's UDF metadata via HTTP range requests