What can be done to prevent this from happening to the AUR?
The AUR is kind of a trap. It can be useful but it has the warnings it has for a reason. Maintainers are not vetted so you depend on them both to be benevolent and competent and neither are reliable.
No one should really use it without taking the time to understand pkgbuild but you have people recommending AUR helpers like yay and tying AUR updates to regular system updates which is a terrible idea
What do you mean by “tying AUR updates to system updates” ?
As in updating the AUR when you update your system packages, which come from known sources.
And just to be very explicit why this is an issue: each time the package is upgraded through an automated update, the PKGBUILD may change (e.g. to adapt to different dependencies, file structure, etc introduced with new app version).
That also means an AUR maintainer can smuggle in malware with any of those updates, even if you checked the original PKGBUiLD when you installed. And, anyone can request taking over maintenance for unmaintained packages, so it can even happen if the original maintainer was benevolent.
Always check PKGBUILD files on upgrade, even if just a glance. If I remember correctly yay had a function to always show you PKGBUILD diffs before updates, not sure if that was automatically enabled.
Yeah, it’s never sat very well with me. I’ve gone through cycles where I’ll use a good bit of AUR, to none at all. I had been using a handful of things, but realized that almost all of it was Python stuff that I could more safely install with pip or uv, so I’ve migrated all of that. The one thing left is Manuskript, and it hardly gets updates anyway.
The way to prevent it is to get more stuff into the official repos so people aren’t forced to rely on AUR in the first place.
It depends. There are trusted well known packages and those can be trusted in my opinion. But I wouldn’t install any random package someone made.
And how would moving the packages into official repo solve anything? The reason it’s in the AUR is because the arch maintainers don’t have time to maintain packages.
But the orphaned packages in the official repo can’t be adopted by just about anyone
The AUR is unsafe by design. It’s not intended to be something you just install from willy-nilly. It’s intended to be a helpful way for arch users who know what they’re doing to exchange a convenient way to install arbitrary packages. But you should always be just as wary of it as copy/pasting shell code from a random person on the internet.
Installing a hook-package for checking as soon as it’s in the AUR.
Trying to escape surveillance capitalism while installing aur packages willy-nilly.
Are you one of the malicious actors? Thats some shit I’d expect to hear from the people doing this, trying to justify the attack by blaming the users for “capitalism”.
I am quite confused by your assumptions. I am just making a joke about people trying to avoid surveillance capitalism tools on one side and gleefully installing aur packages from random people on the other side, potentially making their surveillance exposure worse. I’m part of them some time because it’s too hard to verify everything everytime.
I tend to be a little antsy around anti-capitalists. Too many bad run-ins with Tankies.
That’s probably simply a more skeptical take of my own newbie perspective: the automated update systems on Linux are feeling increasingly scary since their maintainers can get hacked… I’m on Mint and I wish that the Update Manager would show changelogs per update, at least (even if those, too, can be fabricated)…
Users can check if they’re already compromised withEDIT: No, sorry, alvr was just one of countless affected packages. Also, several is an understatement since a huge number of packages are affected.pacman -Q | grep alvrI think maybe?Post with more information here: https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/
Oh my, I’m new to Linux and I use CachyOS for my gaming rig at home. Most of the time I have no idea what I’m doing, but shit runs well and I’m happy about it. But how the hell do I check my noob ass if it’s compromised?!
I’m not real clear on if this is the case but you could try:
-
Have you installed or updated from the AUR before, such as with Yay? Specifically after June 5th? If so, check this list or the post above for a list of compromised packages. https://gr.ht/aur_pkg_list.txt
-
Maybe
pacman -Q | grep atomic-lockfilebecause that appears to be what the threat actor is installing but I’m not really sure if that’s how it works…?
EDIT: If you really want to play it safe then you could try
yay -R $(pacman -Qmq)to remove every aur package and wait out the storm, just be careful to backup important files.-
yikes, I’m glad I decided to switch to debian stable recently, not that it’s a foolproof system either
Yeah, it seems like these sort of problems aren’t necesarily due to an insecure system like the AUR but moreso because of the target’s publicity and popularity which is definitely the case with the rise of CachyOS.
This reminds me to remove the Fluxer AUR package I have
Why anyone is using Arch at this point is beyond me.
Every update is a potential failure waiting to happen. And on top of that, their user repos are infected with malware.
Yeah, I’m going to stick with Debian.
Of course the secondary opt-in user repo with unvetted package maintainers is infected with malware, it’d be a miracle if it weren’t! They warn as much in the docs. Use at your own risk, or package and maintain it yourself, because you’re likely not finding it packaged more reliably elsewhere.
And I love Debian, but if you think the Debian repos with 30,000+ packages and 1000+ community maintainers aren’t also infected with malware…
There hasn’t been a single reported incident so far. So, as far as we know… No. They aren’t infected.
And I trust the community of elders that take care of the Debian distro. They have been reliable and solid. They don’t just throw anything at the users on Stable. Even Testing is considered safer than most distributions.
Being critical towards operating system: Great
Actual argument: fair
Solution: oof
Debian is by all means great, for many things, but for a main pc? Shivers
Why shivers ?
It’s stable, it has a HUGE software repo (one of the largest ones if I’m not mistaken), third party software and drivers are almost always available as a Debian package, the community behind it is actually serious about making it safe and problem free. So what if some of the software is not bleeding edge? At least I can rest easy when I’m updating my system. I’ll almost never have any bad surprises like you get in Arch.
Arch just takes whatever the latest software is and throws it in the repos for the users to figure out if it breaks. Half the solutions you find in the wiki are half-baked solutions just to make things work, but are often not standard or even secure, leaving your system with security holes.
@webghost0101 @ZombieCyborgFromOuterSpace You are weird.
I wouldn’t want to be perceived in any other way.
