Updates — 2026-07-02

Ran scripts/check_for_updates_maintained.sh (output saved to STATES.txt). 2 packages flagged UPD. Additionally, STATES.stderr (nvchecker output for pacman-static’s and libarchive-static’s bundled third-party dependencies, which the OK/UPD/? table doesn’t cover) flagged 3 outdated bundled deps in pacman-static.

maintained/libarchive-static: 3.8.7-3 -> 3.8.8-1

• Bumped pkgver to 3.8.8 (pkgrel reset to 1), regenerated sha512sums with updpkgsums (only the libarchive git-tag source hash changed — bundled deps attr/acl/openssl/zlib/xz/bzip2/zstd are unchanged versions), regenerated .SRCINFO.
• Test-built successfully for all buildable architectures: x86_64, i686, pentium4, i486.
• Notes for next time saved to memory/libarchive-static.md.

maintained/pacman-static: bundled deps updated (pkgrel 12 -> 13)

• STATES.stderr showed curl, gpgme, and libarchive (bundled static deps, tracked via nvchecker-deps.toml against current Arch package versions) were behind: curl 8.20.0->8.21.0, gpgme 2.1.0->2.1.2, libarchive 3.8.7->3.8.8. pkgver itself (pacman’s own version) is unaffected — bumped pkgrel 12 -> 13, refreshed sha512sums with updpkgsums and .SRCINFO.
• Test-built successfully for x86_64, i686, pentium4, i486.
• Synced nvchecker-new.txt -> nvchecker-old.txt so the next run doesn’t re-report these as new.
• Notes for next time saved to memory/pacman-static.md.

maintained/linux-lts515: 5.15.209 -> 5.15.210 — SKIPPED

• nvchecker reports 5.15.210 available (git tag exists on kernel.org’s linux-5.15.y branch), but the corresponding release tarball (linux-5.15.210.tar.xz) has not been published on cdn.kernel.org yet (confirmed via makepkg -do, real 404, not a sandboxing artifact). Reverted the pkgver bump; left the package at 5.15.209. Retry later.
• Retried same day: reran check_for_updates_maintained.sh (fresh STATES.txt/STATES.stderr), still only linux-lts515 flagged UPD. Bumped pkgver to 5.15.210 again and re-checked with makepkg -do --skippgpcheck (unsandboxed) — still a 404, tarball still not published. Reverted pkgver back to 5.15.209, no diff left behind.
• Notes saved to memory/linux-lts515.md.

Other findings

• Fixed an unrelated encoding regression: editing libarchive-static’s PKGBUILD caused a pre-existing invalid-UTF-8 byte sequence in a maintainer comment (# Tomáš Mráz) to get further corrupted into U+FFFD replacement characters by the edit tooling. Restored the original bytes to match the last git revision exactly; see memory/TOOLING_NOTES.md.

Updates — 2026-07-04

Fetched+fast-forwarded all maintained/ submodules (230 of them; none were behind their remote tip). Ran scripts/check_for_updates_maintained.sh. Only linux-lts515 flagged UPD.

maintained/linux-lts515: 5.15.210 -> 5.15.211 — SKIPPED

• Same pattern as 2026-07-02/03: nvchecker’s git-tag tracking reported 5.15.211, but the release tarball isn’t published on cdn.kernel.org yet (confirmed genuine 404 via update.sh, which uses makepkg -do internally per [[feedback-network-debugging]]). Script auto-reverted the pkgver bump; package stays at 5.15.210. Retry later.
• Fixed a small gap in update.sh: its 404 early-exit path cleaned up the downloaded tarball but left an empty src/ dir behind — now removes it too.
• Notes updated in memory/linux-lts515.md.

Private-repo build-all-packages pass — 2026-07-07/08

Ran scripts/update_cycle.sh first (208/230 maintained/ submodules fast-forwarded; 22 hit transient SSH resets from the AUR host, harmless; 0 dirty/diverged). Only qtkeychain-qt5 needed a version bump (0.16.0 -> 0.17.0), done and published as the pipeline smoke test.

Then built, signed, and published every package under arch/ (maintained/private/adapted/owned, excluding attic/) to the private archlinuxaba repo on euroweb.lan, restricted to x86_64 for now, per explicit scope decisions (see memory/private_repo_publish_scope.md in auto-memory).

Results

• 250 packages attempted (0 skipped — every package’s arch=() either included x86_64 or was any/empty).
• 155 published successfully (138 on the first full pass, plus 17 more recovered via manual retries after fixing the bugs described below: c2t-git, diskm8-git, dos33fsprogs-git, dsk2nib-git, arduino-builder, libarchive-static, pacman-static, pgfuse, sqlitexx, vattery, xdialog, z80ex, xawtv, xxdiff-git, x86_64-elf-binutils, vhd2vl-git, e1000e-dkms-lts515).
• 4 fixed but not yet rebuilt/republished: libcurlpp-git, llvm-mos-git, pcmanfm-gtk3, prodos-utilities-git (same trivial missing-git-in-makedepends bug as the ones above, already corrected in their PKGBUILDs + .SRCINFO, just not queued through a build yet).
• ~91 still failing, one memory/<package>.md note per package with the specific cause. Rough breakdown (some packages fall into more than one bucket transitively):
  • ~14 are intra-tree forward-reference ordering — depend on another package from this same tree that hadn’t been built+published yet at the point this single top-to-bottom alphabetical pass reached them (now available; should resolve on a future retry pass without any code change). E.g. kplotting5, kunitconversion5, plasma-framework5, prison5, fvwm, gcc-ia16, hq, i686-elf-pcc-git, pcc-git, python-pyqt5-chart, python-pyqt5-purchasing, qgpgme1-qt5.
  • ~15 depend on a real package that isn’t tracked anywhere in this arch/ tree at all (not official-Arch-anymore, or genuinely AUR-only, e.g. qt4, cc65, gcc14, gtk-sharp-2, python2’s own openssl-1.1 chain, qt5-webengine, qt5-webkit, Perl/Apache modules for thruk) — out of scope for a build+publish pass per the user’s guidance; just recorded for a future decision.
  • The rest are genuine, distinct build/source defects — real compiler errors (old code vs modern GCC strictness, e.g. leafpad, modest, newsboat-og, xfractint, gsoap287, notion3, optdb5.3), missing/stale local patch files (gcc47, linux-lts510), a stale source checksum (trojita, pce-git), missing GPG keys (pcmciautils), a CMake-version-policy incompatibility (kdiagram5), a circular cross-toolchain bootstrap dependency (riscv32-elf-gcc <-> riscv32-elf-newlib), and a few transient network blips (gpgme-1, elasticsearch6, wildfly22, vattery before its retry). See each package’s own memory/<name>.md for specifics.

Script/tooling fixes made along the way

• repo_publish.sh: added repo-remove before repo-add and archiving of superseded package files to a new ${REPOSITORY_REMOTE_PATH}/archive/ dir (append-only — see memory/ARCHIVE_APPEND_ONLY.md); fixed a pre-existing _repo_add typo bug in the arch=any symlink fan-out.
• repo_lib.sh: ssh -n on every remote call, and REPO_LIB_DIR resolved to an absolute path — both fix real bugs (ssh silently draining a driver loop’s stdin after one package; a relative path breaking once repo_build.sh cds into a package directory).
• repo_build.sh: build-byproduct cleanup rewritten to be git status-driven instead of a fixed glob list (catches arbitrary VCS-cloned source dirs); added REPO_BUILD_ONLY_ARCH and a _build_cmd per-arch dispatcher.
• New scripts/archlinuxaba-archbuild (+ archlinuxaba-x86_64-build symlink): a copy of the system archbuild that adds this project’s own private repo into the chroot’s pacman.conf (arch/config/pacman.conf.d/archlinuxaba.conf), so a package already published earlier in a run resolves as a dependency for one built later in the same run. Wired into repo_build.sh for x86_64 only.
• repo_release.sh: now collects every valid package extension (.gz/.bz2/.xz/.zst/.lz), not just .zst (libarchive-static/ pacman-static build .xz); post-publish, removes the local *.pkg.tar.*/.sig so a released package directory doesn’t stay dirty. Also fixed a real oksh bug along the way: a set -A array with zero elements ever assigned makes oksh treat any later reference to it as unset under set -u — replaced with a plain space-separated string (see memory/oksh_coding_style.md in auto-memory and memory/TOOLING_NOTES.md).
• Two trivial PKGBUILD fixes applied to several -git packages that were missing git in makedepends (adtpro-git, c2t-git, diskm8-git, dos33fsprogs-git, dsk2nib-git, libcurlpp-git, llvm-mos-git, pcmanfm-gtk3, prodos-utilities-git) — pkgrel bumped, not pkgver (see memory/PKGREL_VS_PKGVER.md).

Not done in this pass

• A second retry pass specifically for the ~14 forward-reference packages (task tracked, not run yet).
• Rebuilding the 4 fixed-but-not-rebuilt packages listed above.
• Any of the ~15 out-of-tree-dependency or ~60 genuine-defect packages — each needs its own investigation/decision, recorded per-package in memory/.
• i686/pentium4/i486 builds — this pass was x86_64-only per explicit scope.

Update check + changed-only publish cycle — 2026-07-09

Ran scripts/update_cycle.sh (cleanup + fetch/fast-forward + version check). Fresh STATES.txt/STATES.stderr: 0 packages flagged UPD (nothing needs a version bump this cycle), 112 OK, 79 ? (no .nvchecker.toml — see below).

NVCHECKER.md

Per request, investigated all 79 ?-flagged packages and wrote /home/build/aurupdater/NVCHECKER.md: a planning doc (no .nvchecker.toml files created) grouping them by upstream-hosting pattern — KDE Frameworks5/PIM/Plasma5 families (21 packages, share a gitlab+host=invent.kde.org pattern), plain GitHub/GitLab tag packages, a Launchpad group, a SourceForge group (nvchecker has no native sourceforge source — documented the RSS-regex workaround, verified live), a “Laborejo Software Suite” family (5 packages, one shared directory, verified live), and 13 packages judged genuinely dead/frozen with no viable automatic check (autoconf2.13, python2, boost-65-compat, etc.). Ends with a prioritized quick-wins list.

Changed-only build/publish (per explicit instruction: don’t rebuild

the full tree, only what actually changed)

Wrote two new scripts:

• scripts/repo_diff_local_remote.sh — compares every local package’s real version (makepkg --printsrcinfo, so split packages/ epochs/array pkgnames are handled correctly) against what’s actually published on the repo host, and reports NEW/CHANGED/SAME. Remote packages with no local counterpart (other AUR packages published by hand, outside this tree) are silently ignored, per instruction. VCS (-git) packages get a -VCS-suffixed verdict instead of a plain one, since their static pkgver only reflects whatever a previous build’s pkgver() last computed (and cleanup_all.sh’s git-checkout reset can revert that between sessions without touching what’s already published) — not a live “did upstream move” signal.
• scripts/repo_release_changed.sh — runs repo_diff_local_remote.sh and builds/signs/publishes only the plain NEW/CHANGED (non-VCS) results, same PASS/FAIL/per-package-logfile discipline as repo_release_all.sh.

Diff found 82 NEW + 1 CHANGED non-VCS packages (plus 10 NEW-VCS / 11 CHANGED-VCS -git packages, intentionally left out of the automated build — see script header) against 142 already-published/unchanged. Collapsing split-package name duplicates, that’s 79 package directories run through repo_release_changed.sh.

Results

• Initial pass: 26 PASS / 53 FAIL.
• +7 more via targeted retries — a chunk of the 53 failures were purely this run’s own build-order artifact: packages that depend on a sibling also in this batch, but alphabetically later, so the dependency wasn’t published yet when pacman went looking for it inside the chroot. Retried in dependency order once their deps were confirmed published: kpimtextedit5 (needed ktextaddons5), kirigami-addons5 (needed kitemmodels5), cervisia (needed kdesu5), kcontacts5 (transient checksum error, succeeded on retry), akonadi-contacts5 (needed libakonadi5/kcontacts5/prison5), kidentitymanagement5 (needed kpimtextedit5, itself just-fixed) — all now published.
• 2 more fixed via a real (if trivial) PKGBUILD bug: maintained/woz2dsk and maintained/wozzle both declared makedepends=() despite using a git+ VCS source, so the chroot had no git to clone with (Cannot find the git package needed to handle git sources) — same class of bug as the 2026-07-07/08 pass. Added makedepends=('git'), bumped pkgrel (not pkgver, per memory/feedback_pkgrel_vs_pkgver.md). wozzle rebuilt and published clean (makepkg’s own pkgver() picked up a newer upstream commit in the process, resetting pkgrel back to 1, as expected). woz2dsk still fails, now for an unrelated reason (see below) — fix confirmed correct, just not sufficient on its own.
• Net: 35 published this cycle, 44 still failing.

Remaining 44 failures — categorized, not individually fixed

This is well beyond the scope of a “publish what changed” pass — each needs its own investigation. Grouped by cause so it’s triageable later:

• Missing/unavailable dependency, not in official repos or this repo (17): p2c (gcc14), bless (gtk-sharp-2), boost-65-compat (python312), dbmodel-qt4 (qt4>=4.0), kchmviewer/qmc2/qt5-webview (qt5-webengine), kcm-fcitx (fcitx-qt5), libkolabxml (libxsd), lxappearance-obconf-gtk3 (lxappearance-gtk3), mp3splt-gtk (libaudclient>=3), ogmrip (gconf), passport (exomizer), pdfalto (libpng14), perl-cookie-baker (perl-test-time), python-postfix-policyd-spf (python-pyspf), python-pyqt5-3d (qt5-3d), python-pyqt5-datavisualization (qt5-datavis3d), qt5-webglplugin (qt5-websockets), thruk (mod_fcgid), woz2dsk (perl-digest-crc/perl-file-slurp — the git fix above got it past its original failure, this is a new, separate one), yabause-qt5 (cmake3). Each of these needs a decision: build the dependency into this tree too, or accept the package can’t be built here.
• Cascading from another failed package in this same batch (3): obexftp/qgpgme1-qt5 (need openobex/gpgme-1, both themselves failing for real reasons below), kjots (needs akonadi-notes, real C++ error below).
• Circular cross-toolchain bootstrap dependency (2): riscv32-elf-gcc <-> riscv32-elf-newlib — each needs the other; needs a proper staged-bootstrap build order, not a simple retry.
• Genuine compiler/source errors (16): cyrus-imapd2 (clang misconfigured as the C compiler in the chroot — “C compiler cannot create executables”), gcc47/linux-lts510 (a local patch file referenced in source=() is missing from the package dir), openssl-1.1 (enable-ktls no longer a supported Configure option), corral (Pony compiler: “match is exhaustive, else clause unreachable” — Pony version mismatch), cppcms (pacman dependency-resolution prompt blocking non-interactively), akonadi-notes (KMime::Message::subject (bool) — API mismatch against the currently-built kmime5), kdiagram5, newsboat-og (-Werror=unused-but-set-variable), xfractint (too many arguments to function 'this->change'), gsoap287 (X509_EXTENSION incomplete type — OpenSSL ABI break), notion3/optdb5.3 (incompatible function-pointer types — modern GCC strictness vs old C code), openobex, trojita (“Could not download sources”).
• Dead/unreachable upstream (2): pcmciautils (“Could not download sources”, matches NVCHECKER.md’s dead-projects list), archlinux32-keyring (“Could not download sources”).
• Transient network (2, likely fine on a plain retry later): gpgme-1 (dev.gnupg.org returned HTTP 429 — rate-limited), elasticsearch6 (curl 404 on the download URL — may be genuinely moved, not just transient; worth a quick check first).

None of the above 44 were modified — flagged for a future, deliberately scoped pass per package rather than guessed at in bulk.