Neither the email nor the account handle seems to exist. You should be able to register the same handle/email when registrations open up again.
A cleanup script for accounts that never verified their email has been added, but I don't think that's what happened here as that should send you a warning email first and it's not even been committed longer than the warning period is. https://gitlab.archlinux.org/archlinux/aurweb/-/commit/9f7003077b2041ca6a34cc328b2d6b8c1e927fd0 Martin On Tue, Aug 11, 2026 at 2:49 AM Alexander Berg <[email protected]> wrote: > > Hello, > > I am trying to recover access to an AUR account and the password reset form > gives me no way to tell what is wrong, so I am following the pointer on that > page to ask here. > > The username is Wehrwolfmann and the e-mail address is > [email protected]. Entering either of them into the password reset form > returns "Invalid e-mail." I am fairly sure I have used this account before, > which is why I am asking rather than just registering again. > > The reason I cannot narrow it down myself is that the handler returns the > same message for every case -- in aurweb/routers/accounts.py the lookup is > > criteria = or_(models.User.Username == user, models.User.Email == user) > db_user = db.query(models.User, and_(criteria, models.User.Suspended == > 0)).first() > if db_user is None: > context["errors"] = ["Invalid e-mail."] > > Because the query filters on Suspended == 0, a suspended account, an account > under a different address, and an account that never existed all produce > exactly the same response. From the outside they are indistinguishable. > > I am raising it here partly because of the "Active AUR malicious packages > incident" notice of 2026-06-12, which lists account creation and package > operations as things that may not work while the cleanup is underway. If > accounts were suspended in bulk as part of that, an ordinary user in my > position has no way to find out that this is what happened -- the site simply > tells them they do not exist. > > So, two questions: > > 1. Could someone with database access tell me whether an account exists under > that name or that address, and if so, whether it is suspended? > > 2. If it was caught up in the incident cleanup, what is the right way to ask > for a review? > > I would rather not register a second account while this is unresolved, since > that would look like working around a suspension. If it turns out no such > account ever existed, I will register normally once account creation is > working again. > > As a separate and much smaller point: it might be worth distinguishing the > suspended case in that handler, or at least wording the message so it does > not assert that the address is invalid. It is a small change in the same > function, and it would save the next person in this situation from guessing. > I am happy to open an issue for that if it is wanted. > > Thanks, > Wehrwolfmann
