#1140438 luarocks: Luarocks looks on abandoned domain for packages

Package:
luarocks
Source:
luarocks
Submitter:
Jochen Topf
Date:
2026-06-20 13:17:02 UTC
Severity:
normal
#1140438#5
Date:
2026-06-20 12:38:10 UTC
From:
To:
Dear Maintainer,

"luarocks config rocks_servers" shows these default servers for LuaRocks packages:

{
   {
      "https://luarocks.org",
      "https://raw.githubusercontent.com/rocks-moonscript-org/moonrocks-mirror/master/",
      "https://luafr.org/luarocks/",
      "http://luarocks.logiceditor.com/rocks"
   }
}

Installed is version 3.8.0+dfsg1-1, the last version 3.8.0+dfsg1-2 has
the same. The source for this config is in the package itself
/usr/share/lua/5.*/luarocks/core/cfg.lua .

The problem is the server luafr.org. The domain has been discontinued
and belongs to a domain grabber now. Anybody can buy it and start
publishing Lua packages there now.

luafr.org was removed upstream here:
https://github.com/luarocks/luarocks/pull/1517

Also removed was luarocks.logiceditor.com, see
https://github.com/luarocks/luarocks/issues/1354

Those hosts should be remove in the Debian packages even for older
versions.