Subject: Arch-announce Digest, Vol 23, Issue 1

From: [email-masked]
Date: Mon, 25 Aug 2025 08:09:57 +0000

Send Arch-announce mailing list submissions to
	[email-masked]

To subscribe or unsubscribe via email, send a message with subject or
body 'help' to
	[email-masked]

You can reach the person managing the list at
	[email-masked]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Arch-announce digest..."

Today's Topics:

   1. [arch-announce] Recent services outages
      (Arch Linux: Recent news updates: Christian Heusel)
   2. Recent service outages  (gromit)

----------------------------------------------------------------------

Message: 1
Date: Thu, 21 Aug 2025 22:01:13 -0000
From: "Arch Linux: Recent news updates: Christian Heusel"
	<[email-masked]>
Subject: [arch-announce] Recent services outages
To: [email-masked]
Message-ID: <175581367373.537.1851645288196278709@archlinux>
Content-Type: text/plain; charset="utf-8"

We want to provide an update on the recent [service outages][0] affecting our infrastructure. The Arch Linux Project is currently experiencing an ongoing denial of service attack that primarily impacts our main webpage, the Arch User Repository (AUR), and the Forums.

We are aware of the problems that this creates for our end users and will continue to actively work with our hosting provider to mitigate the attack. We are also evaluating DDoS protection providers while carefully considering factors including cost, security, and ethical standards.

To improve the communication around this issue we will provide regular updates on our [service status page](https://status.archlinux.org) going forward.

As a volunteer-driven project, we appreciate the community&#x27;s patience as our DevOps team works to resolve these issues. Please bear with us and thank you for all the support you have shown so far.

## Workarounds during service disruption

- In the case of downtime for archlinux.org:
    - **Mirrors**: The mirror list endpoint used in tools like `reflector` is hosted on this site. Please default to the mirrors listed in the `pacman-mirrorlist` package during an outage.
    - **ISO**: Our installation image is available on a lot of the mirrors, for example the DevOps administered [geomirrors][1]. Please always verify its integrity as [described on the wiki][2] and confirm it is signed by `0x54449A5C` (or other trusted keys that may be used in the future).
- In the case of downtime for aur.archlinux.org:
    - **Packages**: We maintain a [mirror of AUR packages][3] on GitHub. You can retrieve a package using:
      `$ git clone --branch &lt;package_name&gt; --single-branch https://github.com/archlinux/aur.git &lt;package_name&gt;`

## Additional remarks

- Our services may send an initial connection reset due to the TCP SYN authentication performed by our hosting provider, but subsequent requests should work as expected.

- We are keeping technical details about the attack, its origin and our mitigation tactics internal while the attack is still ongoing.

[0]: https://lists.archlinux.org/archives/list/[email-masked]/thread/EU4NXRX6DDJAACOWIRZNU4S5KVXEUI72/
[1]: https://geo.mirror.pkgbuild.com/iso/
[2]: https://wiki.archlinux.org/title/Installation_guide#Verify_signature
[3]: https://github.com/archlinux/aur

URL: https://archlinux.org/news/recent-services-outages/

------------------------------

Message: 2
Date: Fri, 22 Aug 2025 10:31:03 +0200
From: gromit <[email-masked]>
Subject: Recent service outages
To: [email-masked]
Message-ID: <[email-masked]>
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="2m4pnzglqih45ts5"

We want to provide an update on the recent [service outages][0] affecting our infrastructure. The Arch Linux Project is currently experiencing an ongoing denial of service attack that primarily impacts our main webpage, the Arch User Repository (AUR), and the Forums.

We are aware of the problems that this creates for our end users and will continue to actively work with our hosting provider to mitigate the attack. We are also evaluating DDoS protection providers while carefully considering factors including cost, security, and ethical standards.

To improve the communication around this issue we will provide regular updates on our [service status page](https://status.archlinux.org) going forward.

As a volunteer-driven project, we appreciate the community's patience as our DevOps team works to resolve these issues. Please bear with us and thank you for all the support you have shown so far.

## Workarounds during service disruption

- In the case of downtime for archlinux.org:
    - **Mirrors**: The mirror list endpoint used in tools like `reflector` is hosted on this site. Please default to the mirrors listed in the `pacman-mirrorlist` package during an outage.
    - **ISO**: Our installation image is available on a lot of the mirrors, for example the DevOps administered [geomirrors][1]. Please always verify its integrity as [described on the wiki][2] and confirm it is signed by `0x54449A5C` (or other trusted keys that may be used in the future).
- In the case of downtime for aur.archlinux.org:
    - **Packages**: We maintain a [mirror of AUR packages][3] on GitHub. You can retrieve a package using:
      `$ git clone --branch <package_name> --single-branch https://github.com/archlinux/aur.git <package_name>`

## Additional remarks

- Our services may send an initial connection reset due to the TCP SYN authentication performed by our hosting provider, but subsequent requests should work as expected.

- We are keeping technical details about the attack, its origin and our mitigation tactics internal while the attack is still ongoing.

[0]: https://lists.archlinux.org/archives/list/[email-masked]/thread/EU4NXRX6DDJAACOWIRZNU4S5KVXEUI72/
[1]: https://geo.mirror.pkgbuild.com/iso/
[2]: https://wiki.archlinux.org/title/Installation_guide#Verify_signature
[3]: https://github.com/archlinux/aur
-------------- next part --------------
A message part incompatible with plain text digests has been removed ...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available

------------------------------

Subject: Digest Footer

_______________________________________________
Arch-announce mailing list -- [email-masked]
To unsubscribe send an email to [email-masked]

------------------------------

End of Arch-announce Digest, Vol 23, Issue 1
********************************************