[Warning] Pamac-aur-git update on January 6th, 2020

General system Applications
1

Hello.

Pamac-aur-git maintainer here :slight_smile:

I know a good bunch of EndeavourOS users are using pamac-aur-git as their pacman GUI.

On january 6th - and until next update - code will be grabbed from development branch in order to grab pamac 9.3.0beta. I’ve been using it on my main computer for two days without any big issues. But YMMV :smiling_imp:

Capture du 2020-01-06 14-27-16

So, if you want to stay on “stable” code, please use pamac-aur instead.

5 Likes
2

il y a un bug ou il plante

3

I just updated before i saw this. We don’t know when the next update comes?

4

Tu peux me décrire les conditions du plantage ?

5

When development code will be merged on main channel. Cant’ say. Sorry.

1 Like
6

7

Et ?

D’ailleurs, je vais faire une nouvelle mise à jour pour un bug de sécurité: https://gitlab.manjaro.org/applications/pamac/issues/719

2 Likes
8

Thank you for the heads up, @FredBezies! I might switch on my business laptop, but will continue with your release for the desktop.

1 Like
9

Yeah they like to tinker with pamac too much. Somewhere along the line they screwed the pooch.
From their forum:

The issue has been fixed

Security breach

Testing and Unstable branch - Pamac 9.3.0beta-1/9.3.0beta-2

Anyone can trick you into installing a package simply by offering it on their webpage pretending to be one thing but in reality it is malware and with this behavior of Pamac - hell is loose in your system.

Mime type

❯ cat /usr/share/mime/packages/x-alpm-package.xml
<?xml version="1.0"?>
 <mime-info xmlns='http://www.freedesktop.org/standards/shared-mime-info'>
   <mime-type type="application/x-alpm-package">
   <generic-icon name="package-x-generic"/>
   <comment>Alpm Package</comment>
   <glob pattern="*.pkg.tar.xz"/>
   <glob pattern="*.pkg.tar.gz"/>
   <glob pattern="*.pkg.tar.zst"/>
   <glob pattern="*.pkg.tar.bz2"/>
   <glob pattern="*.pkg.tar.lrz"/>
   <glob pattern="*.pkg.tar.lzo"/>
   <glob pattern="*.pkg.tar.z"/>
   <glob pattern="*.pkg.tar.lz4"/>
   <glob pattern="*.pkg.tar.lz"/>
   <glob pattern="*.pkg.tar"/>
  </mime-type>
 </mime-info>

Mime handler

❯ cat ~/.config/mimeapps.list| grep x-alpm-package
application/x-alpm-package=pamac-installer.desktop;

Pamac polkit policy
Pre-autorized to install

❯ cat /usr/share/polkit-1/actions/org.manjaro.pamac.policy
<policyconfig>
  <vendor>Manjaro</vendor>
  <vendor_url>http://manjaro.org/</vendor_url>
  <icon_name>package-x-generic</icon_name>
  <action id="org.manjaro.pamac.commit">
    <description gettext-domain="pamac">Install, update, or remove packages</description>
>--- snip
    <defaults>
      <allow_any>auth_admin_keep</allow_any>
      <allow_inactive>auth_admin_keep</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>
</policyconfig>

Recommended action
Remove Pamac from your system until the implementation is reverted.

1 Like
10

An updated version will be available on both testing and unstable channel. This version is not available for Mr and Mrs Everybody :smiley:

4 Likes
11

I think within a week, pamac-aur-git will be switched back to “main” channel.

2 Likes
12

Odd that Manjaro is uptight about pamac not asking for password, what about the KDE users who installed Discover in Manjaro ? I don’t remember Discover asking for password in years. Where is their fear for that ?

The pamac is working fine for me.

1 Like
13

Well, it works, thank you very much.
Yeah, I installed pamac yesterday… Rolled without any update notifier since install but pamac is just so handy.
Always installs via terminal but pamac is great as a combined search engine and notifier.

5 Likes
14

Just for the info: pamac 9.2.2.r18 = pamac 9.3.0rc

Switched back to master branch.

And the mandatory screenshot:

Capture du 2020-01-17 16-38-56

Closing thread now.

2 Likes