The certificate for manjaro.org was renewed only a few hours ago. Given Manjaros track record, they probably let the cert expire (again) and fixed it since the original screenshot was taken.
The screenshot seems to be taken at 1:50 utc, and the new certificate was valid from 00:18 utc. It is possible though that they just.enrolled the cert too late.
some iconic duos in the Linux community: Arch and AUR malware, Ubuntu and bad updates, NixOS and community/team members leaving, Manjaro and failing to renew its cert.
WeaponsManufacturerOS is Nix, obviously (they’ve since dropped Anduril as a sponsor but we’re never going to let them live it down), MalwareOS I’m guessing is Arch, but what’s BenevolentDictatorOS?
Recently, the nvidia-dkms driver updates wouldn’t build for 5.x series kernels, so if you hadn’t cleaned up old kernels, the update bombed out before updating the initrd filesystem, the system couldn’t boot without intervention. Thankfully, I noticed before trying to reboot my work desktop, and the solution was “apt autoremove && apt upgrade”.
But the install media for my desktop at home was 18.04, and it’s running 26.04 now. It has an AMD GPU, so it hasn’t had update problems.
Its intended behavior from Debian team. because they ships a version of the software at the time and only backport security patches. So if the version they ship has bugs then those bugs stay for years. This generates quite a bit of noise for upstream projects but it is what it is.
Most web server have ACME support built-in nowadays, setup is a matter of minutes, no scripting required. This has been a solved problem for years, any sysadmin who can’t handle this basic task has no business running public-facing servers.
Well, Manjaro popped up when a lot of people cannot install Arch on their own. Same thing with Ubuntu and Debian. Once a userbase formed, people follow suit I guess.
I mean they have their own repos and take a position of “hardened updates” that are two weeks older than the bleeding edge ones of Arch. I used it briefly out of curiosity a couple years ago. It seemed generally fine, although I seem to remember having issues with some AUR stuff. That’s kinda to be expected and could even just be general fuckery on the part of the package maintainers, not manjaro. It could also be on manjaro’s fault lol.
I’ve just stuck to Arch since then. Garuda and endeavour OS are both cool but I don’t feel like I’m gaining much by using either. And Garuda includes a bunch of packages that I don’t even want.
I’m more interested in what manjaro can do in the mobile phone sphere. If they can build something viable yet fun to tinker with in the next few years that has a rolling release schedule, it could make for a cool Linux phone. Ubuntu touch is probably the more stable choice tbh, but that’s the beauty of Linux.
Manjaro was more unstable than Arch ever was, for me.
My experience was:
They would mess with Arch packages and muck things up.
It relied on AUR some, which also messed things up.
3rd party repos or AUR didn’t work, as its not in sync with upstream arch.
…Holding back packages didn’t fix anything anyway. It just delayed fixes. I found myself trying to install upstream Arch packages.
It turns out Arch Linux is more tested and “held back” than people give it credit for. There’s little to gain from forking like that, instead of just contributing to upstream arch testing.
Not to mention the cert thing. Manjaro really did let certs expire many times. When I was new to linux, that took me forever to figure out.
I found myself trying to install upstream Arch packages.
You realize that’s how you broke, right? It’s like installing Debian packages on Ubuntu.
It relied on AUR some, which also messed things up.
How does it rely on AUR?
3rd party repos or AUR didn’t work, as its not in sync with upstream arch.
What 3rd party repos?
AUR works perfectly fine… when it works. AUR is a mess of its own. It’s chock full of malware as we speak and it’s not accepted as a reference on Arch or any other Arch-based distro. Saying an Arch distro “doesn’t work with AUR” is completely irrelevant at the best of times.
Not to mention the cert thing. Manjaro really did let certs expire many times. When I was new to linux, that took me forever to figure out.
Did you spend a lot of time reading the webpage, or?.. Because that’s the only cert that expires, the mirros and the forums never did. What exactly were you figuring out?
This was many years ago, when I didnt know much about linux, and yes many lessons were learned. Though I distinctly remember instances where I couldnt update Manjaro packages because of expired certs.
To clarify some points:
On packages/AUR, I was desperate, because upstream Arch had some critical fixes that werent shipped to Manjaro yet. Clearly this didnt work out well.
AUR specifically breaks with Manjaro because AUR targets upstream arch as a base. When a dependant Arch package updates, the AUR package immediately updates to that new dependecy if its being maintained. But since Manjaro delays the upstream updates, this AUR package will break if its updated.
AUR specifically breaks with Manjaro because AUR targets upstream arch as a base. When a dependant Arch package updates, the AUR package immediately updates to that new dependecy if its being maintained. But since Manjaro delays the upstream updates, this AUR package will break if its updated.
Again, using the AUR as the standard for evaluating any Arch-based distro is really not cool.
Leaving that aside, the exact thing you’ve mentioned can happen on vanilla Arch, if the AUR package you are trying to install is based on Arch packages that you haven’t received yet. So you’d have to upgrade your system every time you’re trying to update or install an AUR package to be sure.
since Manjaro delays the upstream updates, this AUR package will break if its updated.
It won’t break, it will either succeed compiling or not with the older packages. If it succeeds, no harm done. If it doesn’t, you still have the previous version.
The unlikely corner case is that the new AUR package version relies on new API/features that only exist in newly released Arch packages and you absolutely must have the latest version right now. But then you’re using the wrong distro for that.
I was desperate, because upstream Arch had some critical fixes that werent shipped to Manjaro yet.
Manjaro ships critical updates out of band, without waiting for regular batch updates.
It was a selling point for Manjaro at some point but people really shouldn’t use AUR with it. That’s just an invitation to a disaster. I think Manjaro is stable if you don’t mix it with AUR. Used it for 6 years and the worst I remember was their Nvidia cataclysm, mostly it was fine.
Not sure if I would want to use cutting edge on mobile though. I tried PostmarketOS and Ubuntu Touch a couple years ago and Ubuntu Touch was actually daily drivable-ish. Really loved SXMO too, it’s a way different mobile experience.
Honestly, I installed it on my 2nd laptop and workstation because I really wanted the AUR, but got tired of Arch unstable update process 15 years ago and left Linux for personal use for MacOS. It still has everything I want on my main laptop, home brew and a terminal with tmux.
It just works and I just couldn’t be arsed reinstalling, but yeah, if I would, I would just use Arch again now.
I’m also in the club of having a couple of Manjaro installs that now date back a few years to when it was still cool.
Honestly as a distro it works pretty well and my complaints are few. If I had to reinstall I’d take a closer look at CachyOS, EndeavourOS, or even just Arch, but I can’t really be bothered to replace something that’s working just fine so I’ll stick with it for now.
The website cert is the one that expires. It doesn’t impact anything else about the distro. The package mirrors are on different hosts (and certs). It’s a good distro, wish they’d sort out the kerfuffle with the founder (who’s the one holding them back).
Like, when you… “get” the certificate… Doesn’t it say… “on it” exactly which date it expires? So maybe set a thing in your calendar or an alarm on your phone or some shit? How hard can this be?
LetsEncrypt also gives you a month to update certificate, you don’t even have to do it yourself, just run a script once a week in cron. That’s such a level of incompetence I wonder why anyone will trust them with a distro when they can’t even do such a simple task.
You could proactively take care of it with a reminder on the calendar. Or alternatively, just let the community inform you when you need to renew it. Both are effective methods.
Because manjaro.org is controlled personally by Phil, the CEO of the company, who’s paranoid about letting anybody else handle it. And also can’t figure out how to renew automatically, apparently. People have to remind him on Discord. 🤦
Everything else *.manjaro.org (forums, mirrors etc.) is handled by different people and have never expired afaik.
It’s literally just the main webpage that has this problem, everything else about the distro is never impacted.
Tl;dr one of the founders is holding up the infra not allowing any change. According to someone who worked on Manjaro, it was trivially easy to get this fixed, but that single person simply wouldn’t approve it. Last I checked they sent the founder an ultimatum: either hand over the project or see the staff walk. I suppose the staff walked.
I think you’re refering to this. The community appears to be in the process of setting up their own association and eventually the infrastructure and assets will be transferred to them. We’ll see how that shakes out.
Look, I don’t want to call you a liar… so let’s say maybe you meant to say pamac or got things wrong.
Because:
That’s not how pacman works. If it hits a mirror with expired certs it just outputs a warning and uses another mirror.
On a fresh install Manjaro will compile an optical subset of mirrors for you based on location and response time. Those mirrors are spread around the world on different domains. It’s very unlikely that your list would include ONLY mirrors.manjaro.org and mirrors2.manjaro.org.
But even if it did, and let’s say for the sake of argument there is a bug in pacman AND you got those mirrors… those two hosts are on a different certificate from manjaro.org (the website), are CNAME’d to .rsc.cdn77.org hosts, get renewed automatically separately from the website cert, and have never been allowed to lapse afaik.
Maybe it wasn’t due to certs, but it still happened. That was enough for me to switch distros. I was much less experienced with Linux back then, so I wasn’t able to figure out how to get it working again.
So far I’ve daily-driven EndeavorOS, Mint, PopOS, and Kubuntu. None of them have broken themselves with an apt or pacman upgrade.
Are you sure? The screenshot shows a certificate expiring yesterday at 8:50 CDT, which is 23 Aug 13:50 GMT, and their current certificate has a validity “Not Before Mon, 24 Aug 2026 01:18:47 GMT”, so there’s a gap of around 11 hours.
Not sure why you’re getting downvoted, the browser used for the screenshot is sufficiently on topic for a meme sub, especially a FOSS browser for Linux on a Linux meme sub. Floorp is a pretty ridiculous name though.
oh my god AGAIN?!
They gotta be trolling the entire linux userbase at this point.
[deleted]
The certificate for manjaro.org was renewed only a few hours ago. Given Manjaros track record, they probably let the cert expire (again) and fixed it since the original screenshot was taken.
The screenshot seems to be taken at 1:50 utc, and the new certificate was valid from 00:18 utc. It is possible though that they just.enrolled the cert too late.
I like a distro with problems that I can relate to.
Bad memory/routines? We have to be related. Since that feels like me.
HOW THE FUCK DID THEY MANAGE IT AGAIN
They managed this again by not actually managing it… again.
They have embraced the meme
Why set a reminder when an expiration will do the same job
some iconic duos in the Linux community: Arch and AUR malware, Ubuntu and bad updates, NixOS and community/team members leaving, Manjaro and failing to renew its cert.
Welcome to Linux, do you want the BenevolentDictatorOS, WeaponsManifaturerOS, MalwareOS or Debian?
WeaponsManufacturerOS is Nix, obviously (they’ve since dropped Anduril as a sponsor but we’re never going to let them live it down), MalwareOS I’m guessing is Arch, but what’s BenevolentDictatorOS?
This is the only drama in your list I’m not familiar with already. What/when did they last break?
Recently, the nvidia-dkms driver updates wouldn’t build for 5.x series kernels, so if you hadn’t cleaned up old kernels, the update bombed out before updating the initrd filesystem, the system couldn’t boot without intervention. Thankfully, I noticed before trying to reboot my work desktop, and the solution was “apt autoremove && apt upgrade”.
But the install media for my desktop at home was 18.04, and it’s running 26.04 now. It has an AMD GPU, so it hasn’t had update problems.
If your playbooks don’t include an autoremove, you’re doing it wrong!
Or rather, lessons learned from when the default /boot partition was only like 100 MB.
you forgot the oldest of them all, Debian and the its museum, their repos
Debian and shipping broken packages
Bruh what? I went to debian for server because of stability. It only updates like once a decade and still ships broken packages?
Its intended behavior from Debian team. because they ships a version of the software at the time and only backport security patches. So if the version they ship has bugs then those bugs stay for years. This generates quite a bit of noise for upstream projects but it is what it is.
it may be broken… but at least it’s stable
Really, something like this ever happened lol?
I’m sure it has. The idea that it’s frequent is unhinged.
And @rotten@lemmy.today
Wait…please tell me y’all heard of that crazy drama recently where there was tons of AUR packages getting infostealer malware added in.
They got a lot more cautious after that incident but… I’m less keen on the AUR now…
Edit: archlinux.org/…/active-aur-malicious-packages-inc…
[deleted]
The funniest thing about this is that it needs a single Bash script and a cronjob to solve (unless they got a REALLY bad hoster).
That bash script probably exists a bazillion times already… so even an LLM could spit it out for them.
Their organisational structure must be abhorrent for nobody to feel even remotely responsible for this.
Most web server have ACME support built-in nowadays, setup is a matter of minutes, no scripting required. This has been a solved problem for years, any sysadmin who can’t handle this basic task has no business running public-facing servers.
Yeah, caddy automatically renews certs by default, as does traefik as far as i can tell, and certbot installs a timer for this.
Nginx as well
And my friends wonder why I recommend against Manjaro…
Manjaro once again demonstrating they’re not a serious distro/project, hahaha
At this point, it’s a tradition!
lmao, what’re they up to now, 8 times?
[deleted]
Again??? Again???
BINGO!
In fact I got a full 5x5 card of bingo because I wrote “Manjaro doesn’t renew its cert” in all of the boxes.
I’m shocked it even has any users tbh.
Well, Manjaro popped up when a lot of people cannot install Arch on their own. Same thing with Ubuntu and Debian. Once a userbase formed, people follow suit I guess.
I mean they have their own repos and take a position of “hardened updates” that are two weeks older than the bleeding edge ones of Arch. I used it briefly out of curiosity a couple years ago. It seemed generally fine, although I seem to remember having issues with some AUR stuff. That’s kinda to be expected and could even just be general fuckery on the part of the package maintainers, not manjaro. It could also be on manjaro’s fault lol.
I’ve just stuck to Arch since then. Garuda and endeavour OS are both cool but I don’t feel like I’m gaining much by using either. And Garuda includes a bunch of packages that I don’t even want.
I’m more interested in what manjaro can do in the mobile phone sphere. If they can build something viable yet fun to tinker with in the next few years that has a rolling release schedule, it could make for a cool Linux phone. Ubuntu touch is probably the more stable choice tbh, but that’s the beauty of Linux.
Manjaro was more unstable than Arch ever was, for me.
My experience was:
They would mess with Arch packages and muck things up.
It relied on AUR some, which also messed things up.
3rd party repos or AUR didn’t work, as its not in sync with upstream arch.
…Holding back packages didn’t fix anything anyway. It just delayed fixes. I found myself trying to install upstream Arch packages.
It turns out Arch Linux is more tested and “held back” than people give it credit for. There’s little to gain from forking like that, instead of just contributing to upstream arch testing.
Not to mention the cert thing. Manjaro really did let certs expire many times. When I was new to linux, that took me forever to figure out.
You realize that’s how you broke, right? It’s like installing Debian packages on Ubuntu.
How does it rely on AUR?
What 3rd party repos?
AUR works perfectly fine… when it works. AUR is a mess of its own. It’s chock full of malware as we speak and it’s not accepted as a reference on Arch or any other Arch-based distro. Saying an Arch distro “doesn’t work with AUR” is completely irrelevant at the best of times.
Did you spend a lot of time reading the webpage, or?.. Because that’s the only cert that expires, the mirros and the forums never did. What exactly were you figuring out?
Whoa nellie.
This was many years ago, when I didnt know much about linux, and yes many lessons were learned. Though I distinctly remember instances where I couldnt update Manjaro packages because of expired certs.
To clarify some points:
On packages/AUR, I was desperate, because upstream Arch had some critical fixes that werent shipped to Manjaro yet. Clearly this didnt work out well.
AUR specifically breaks with Manjaro because AUR targets upstream arch as a base. When a dependant Arch package updates, the AUR package immediately updates to that new dependecy if its being maintained. But since Manjaro delays the upstream updates, this AUR package will break if its updated.
Yes, I know AUR is filled with malware now.
Again, using the AUR as the standard for evaluating any Arch-based distro is really not cool.
Leaving that aside, the exact thing you’ve mentioned can happen on vanilla Arch, if the AUR package you are trying to install is based on Arch packages that you haven’t received yet. So you’d have to upgrade your system every time you’re trying to update or install an AUR package to be sure.
It won’t break, it will either succeed compiling or not with the older packages. If it succeeds, no harm done. If it doesn’t, you still have the previous version.
The unlikely corner case is that the new AUR package version relies on new API/features that only exist in newly released Arch packages and you absolutely must have the latest version right now. But then you’re using the wrong distro for that.
Manjaro ships critical updates out of band, without waiting for regular batch updates.
It was a selling point for Manjaro at some point but people really shouldn’t use AUR with it. That’s just an invitation to a disaster. I think Manjaro is stable if you don’t mix it with AUR. Used it for 6 years and the worst I remember was their Nvidia cataclysm, mostly it was fine.
Not sure if I would want to use cutting edge on mobile though. I tried PostmarketOS and Ubuntu Touch a couple years ago and Ubuntu Touch was actually daily drivable-ish. Really loved SXMO too, it’s a way different mobile experience.
It was part of my linux journey long ago, and TBH I bet many still run into in from historical recommendations and popularity.
But I think CachyOS is taking over their “preconfigured arch with the most SEO” spot.
Honestly, I installed it on my 2nd laptop and workstation because I really wanted the AUR, but got tired of Arch unstable update process 15 years ago and left Linux for personal use for MacOS. It still has everything I want on my main laptop, home brew and a terminal with tmux.
It just works and I just couldn’t be arsed reinstalling, but yeah, if I would, I would just use Arch again now.
I use EndeavourOS (from Manjaro a lifetime ago) no complaints.
I’m also in the club of having a couple of Manjaro installs that now date back a few years to when it was still cool.
Honestly as a distro it works pretty well and my complaints are few. If I had to reinstall I’d take a closer look at CachyOS, EndeavourOS, or even just Arch, but I can’t really be bothered to replace something that’s working just fine so I’ll stick with it for now.
The website cert is the one that expires. It doesn’t impact anything else about the distro. The package mirrors are on different hosts (and certs). It’s a good distro, wish they’d sort out the kerfuffle with the founder (who’s the one holding them back).
we know and no it is no good distro. fucking leechers
A little stability and consistency in the world, manjaro always delivers when it comes to this.
Like, when you… “get” the certificate… Doesn’t it say… “on it” exactly which date it expires? So maybe set a thing in your calendar or an alarm on your phone or some shit? How hard can this be?
LetsEncrypt also gives you a month to update certificate, you don’t even have to do it yourself, just run a script once a week in cron. That’s such a level of incompetence I wonder why anyone will trust them with a distro when they can’t even do such a simple task.
yes, but the people who want to implement that are held back and sabotaged by the guy who owns the shit. this is not about incompetence.
Dunno… Lack of collaboration skills in a Linux distro seems a lot like incompetence to me…
They still in this gripe? Didn’t see how their uprising ended, any updates?
Incompetent managers are worse than incompetent devs
I feel like the end result is the same and the distinction is irrelevant.
You could proactively take care of it with a reminder on the calendar. Or alternatively, just let the community inform you when you need to renew it. Both are effective methods.
They use LetsEncrypt. There is literally a bot you can install to automate the renewal process daily on a cron schedule and notify you if it fails.
They’re just fucking morons managing the infra for their domain.
Yes there is an easy fix that will make the problem go away. At this point you know it’s deliberate.
I personally think it’s hilarious.
The second alternative is a bit of a gamble with trust though eh 😅
Since I have never used the distro but have seen threads like these popping up every time the cert expires, I don’t think it takes much trust.
Also it’s pretty fucking hilarious.
It really is starting to become pretty laughable.
Why isn’t this an automated processs for them?
Because
manjaro.orgis controlled personally by Phil, the CEO of the company, who’s paranoid about letting anybody else handle it. And also can’t figure out how to renew automatically, apparently. People have to remind him on Discord. 🤦Everything else
*.manjaro.org(forums, mirrors etc.) is handled by different people and have never expired afaik.It’s literally just the main webpage that has this problem, everything else about the distro is never impacted.
Why isn’t it for everyone? How often I see this with, I mean, major actors is head shakingly baffling.
I work in tech for telco and the amount of people around me who have zero clue about x509/TLS/certificates in general is absolutely baffling
I work in a telco and I have no clue what you just said to me.
But in tech?
Yes but with engines.
Well then you probably don’t encrypt a lot of network traffic…
You’d be shocked!
I wonder if they are still on an old cert system.
This came up last time the cert expired iirc.
Tl;dr one of the founders is holding up the infra not allowing any change. According to someone who worked on Manjaro, it was trivially easy to get this fixed, but that single person simply wouldn’t approve it. Last I checked they sent the founder an ultimatum: either hand over the project or see the staff walk. I suppose the staff walked.
I think you’re refering to this. The community appears to be in the process of setting up their own association and eventually the infrastructure and assets will be transferred to them. We’ll see how that shakes out.
Sad. With FOSS you have to be able to let go.
This is literally why I stopped using Manjaro.
I’ve botched 2 Manjaro installs just doing a
pacman -Syuwhile their certs were expired and I ended up with an incomplete upgrade.Never once had this issue with EndeavorOS.
Doesn’t happen with Antergos either.
I mean, I’ve gotten a NXDomain error ever since they shut down, but at least it’s not a certificate expiry!
Look, I don’t want to call you a liar… so let’s say maybe you meant to say
pamacor got things wrong.Because:
pacmanworks. If it hits a mirror with expired certs it just outputs a warning and uses another mirror.mirrors.manjaro.organdmirrors2.manjaro.org..rsc.cdn77.orghosts, get renewed automatically separately from the website cert, and have never been allowed to lapse afaik.Maybe it wasn’t due to certs, but it still happened. That was enough for me to switch distros. I was much less experienced with Linux back then, so I wasn’t able to figure out how to get it working again.
So far I’ve daily-driven EndeavorOS, Mint, PopOS, and Kubuntu. None of them have broken themselves with an apt or pacman upgrade.
Seems fine for me now. In fact it looks like they switched to Let’s Encrypt for certification so maybe they learned something from last time.
Perhaps the looming prospect of having to do it every 47 days was enough.
Wait, again?
Holy shit this is so stupid I can’t defend them anymore 😂😂
Yep… Validation of my decision to cachyos after my last drive needed surgery.
just install certbot + a daily cron
I think the Manjaro devs can’t read. Could you mime it?
Is there a running tally somehwere? I need something like the credible defense guys’ “0 days since airplane dropped in oceans”
I mean, it happens every 3 months when the LE cert expires…
My first distro & my never again distro. Rest in piss, manjaro
Same here. I mean, Pop OS was technically my first, but I only used that for like 2 weeks and then switched to Manjaro.
Just set your device clock to a day before 8/23, problem solved.
1/1/1970
Floorp sounds like an alien or galaxy from Rick and Morty
We’re gonna sse the year of the linux desktop long before we see the year of default ACME lmao
I thought the devs were supposed to be taking back the project. I’m guessing that didn’t happen.
It was a whole forum thing and deadline before they would fork it - have not kept up with any updates personally
The new e.V. formed in late June, but as far as I understand, they don’t actually have control over any of the infrastructure.
Well, it’s always been Manjaro either way.
This is a PR stunt? There no such thing as bad publicity?
At this point, I’m totally convinced this is all deliberate. Why? I have no fucking clue.
again?? 🤣
Do they not have autorenew
I thought this was an anniversary of a funny event that happened one time type of meme. But no. It has happened NINE TIMES, including today.
At this point… Why aren’t Linux users tracking the certificate and notify them?
They actually do… He never does it, for some reason…
You might as well be asking why people found porn in bushes in the 80s.
Or what ball lightning is.
Or what is zen.
Manjaro is the worst of the most popular distros.
I jumped ship after 2 times. Such a shame because I loved the OS but this is the opposite of what I expect a distro to do.
“floorp”, really? lol thats the name?
The name of the web browser being used there, yes.
lol that’s my favorite web browser
bugzilla.mozilla.org/show_bug.cgi?id=647959
Give me your money take me seriously without my own investment. floorp today.
@remindme@mstdn.social 2026-11-22T01:18:46
HAHAHAHAHA
[deleted]
[deleted]
The date shown in the error message is yesterday.
Are you sure? The screenshot shows a certificate expiring yesterday at 8:50 CDT, which is 23 Aug 13:50 GMT, and their current certificate has a validity “Not Before Mon, 24 Aug 2026 01:18:47 GMT”, so there’s a gap of around 11 hours.
I was wrong, and I deleted my posts, because they were misleading.
AI slop coming for ya, amirite folks?
Replaced ff with floorp several months ago, pretty happy with it so far
Not sure why you’re getting downvoted, the browser used for the screenshot is sufficiently on topic for a meme sub, especially a FOSS browser for Linux on a Linux meme sub. Floorp is a pretty ridiculous name though.
I have no idea either