Your message dated Sat, 5 Sep 2026 12:42:41 +0200
with message-id <apvlmWGUE6xQMQAh@crossbow>
and subject line Re: Bug#1146734: RFS: sysupdater/1.0.0-1 -- graphical system
package updater and repository manager
has caused the Debian Bug report #1146734,
regarding RFS: sysupdater/1.0.0-1 -- graphical system package updater and
repository manager
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146734: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146734
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: sponsorship-requests
Severity: wishlist
Dear mentors,
I am looking for a sponsor for my package "sysupdater":
* Package name : sysupdater
Version : 1.0.0-1
Upstream contact : Firdaus Siregar <[email protected]>
* URL : https://www.firda.uz
* License : MIT
* Vcs : https://github.com/firdausiregar/sysupdater
Section : utils
The source builds the following binary packages:
sysupdater - graphical system package updater and repository manager
To access further information about this package, please visit the
following URL:
https://mentors.debian.net/package/sysupdater/
Alternatively, you can download the package with 'dget' using this command:
dget -x
https://mentors.debian.net/debian/pool/main/s/sysupdater/sysupdater_1.0.0-1.dsc
Changes for the initial release:
sysupdater (1.0.0-1) unstable; urgency=medium
.
* Added: Initial release of SysUpdater.
* Added: GTK3 graphical user interface.
* Added: Command-line interface melalui perintah `sysupdate`.
* Added: Pemeriksaan pembaruan paket sistem.
* Added: Pembaruan paket sistem.
* Added: Manajemen paket terinstall.
* Added: Fitur hold dan disable update paket.
* Added: System cleaner.
* Added: Manajemen repository dan PPA.
* Added: Penjadwalan update otomatis.
* Added: Riwayat update paket.
* Added: Informasi sistem pada dashboard.
* Added: Desktop notification menggunakan libnotify.
* Added: Dukungan Bahasa Indonesia dan English.
* Added: Desktop launcher untuk SysUpdater GUI.
* Added: Desktop launcher untuk SysUpdater CLI.
* Added: Dukungan Debian package.
* Added: Instalasi aplikasi menggunakan direktori standar Linux di
bawah `/usr`.
* Changed: Struktur instalasi aplikasi menggunakan lokasi standar
sistem Linux.
* Security: Password administrator tidak disimpan sebagai file plaintext.
Regards,
--
Firdaus Siregar
--- End Message ---
--- Begin Message ---
Am Sat, Sep 05, 2026 at 07:13:56AM +0700, schrieb Firdaus Siregar:
> * Vcs : https://github.com/firdausiregar/sysupdater
https://github.com/firdausiregar/sysupdater/blob/main/src/main.c
| if (chdir("/opt/riskafirdaus/sysupdater") != 0) {
| (void)chdir(".");
| }
Somehow, I can't shake the feeling I am the first person to read the
source code of this program, even if it has a suspicious lack of
the usual comments littering such projects… some still remained through
like this, which also has a bit of prompt leaking, too:
https://github.com/firdausiregar/sysupdater/blob/main/debian/README.source
https://github.com/firdausiregar/sysupdater/blob/main/src/update_checker.h
| snprintf(command, sizeof(command), "curl -s --max-time 3
https://api.github.com/repos/%s/releases/latest | grep '\"tag_name\"' | head -n
1 | cut -d '\"' -f 4", GITHUB_REPO);
We call this phoning home… even if you don't get the call.
curl is also not in the list of your dependencies.
(not that this is the real issue with that style of code)
https://github.com/firdausiregar/sysupdater/blob/main/src/controllers/app_controller.c
| if (ctx->model->type == PKG_MANAGER_APT) snprintf(cmd, sizeof(cmd), "echo
'%s' | sudo -S apt-get install -y %s 2>&1", ctx->model->sudo_password,
pkg_str->str);
| else snprintf(cmd, sizeof(cmd), "echo '%s' | sudo -S dnf install -y %s
2>&1", ctx->model->sudo_password, pkg_str->str);
So, the claim was it supports "Debian, Ubuntu, Arch, Fedora" …
Where is arch support?
I suppose as many other calls use sudo directly, this is somewhat an
improvement… but ehm, no. This is not how you gain root inside a
graphical application to run stuff.
At least you prompted for not storing the password on disk.
That's nice. But you still store it in unprotected memory where
an unrelated program might e.g. be able to attach a debugger and
extract it from there to do whatever it likes to do.
As an APT team member I would have many things to say about '-y'
alone, but please just ask AI to generate that for you, too,
as your RFS review prompt has already exceeded my free token limit and
I am very expensive, even for your "Pro Enterprise Team". 😉
As such, the upstream project quality does not qualify for inclusion
in Debian as of yet, so this RFS is not actionable and hence closed
by me now ~ the RFS has also many formal and packaging issues on top of
that which would have been reason alone, but I seem to have an unhealthy
curiosity for package management; deity@ may have mercy upon my soul!
Best regards
David Kalnischkies
signature.asc
Description: PGP signature
--- End Message ---
