I use malware, BTW.
I have 1825 packages installed, 15 of which are from the AUR, and I use for very specific stuff, like VR. I personally know the mantainer of two of them. The AUR is cool, but should always be used with the same care as manual downloads.
Just be aware that the AUR is not vetted. Its like downloading random stuff of the internet and then install said stuff. Always check your sources.
The article mentions the potential need for human review. I have no idea how that could be feasible for something as massive as the AUR. Maybe it could work like Nix, where every package goes through a PR/MR process, and then after it gets approved, the submitter is added to the list of contributors. It’s definitely not a perfect process, but it’s better than the zero-review process that the AUR has.
No, the entire point of AUR is to be a repository of unreviewed publicly submitted scripts. Malware has always been an expectation. If you don’t want that risk, don’t use AUR.
I’d love to know what’s going on with this. Arch has its haters but someone’s putting a lot of effort into this
Maybe this is a good time to try and get the top 10% of aur into official repos or 3rd party repos
Top 10%? Why not just top 10 most used? Or top 25? Maybe top 25 accounts for 80% of AUR traffic
As I understand it, the attack vector went after orphaned packages primarily. Several of the affected packages would only run the malicious code if it was a fresh install not an update only. So it would have had to be a clean install of an affected package or a newly installed dependency called to invoke this during the approximately 2 day window.
Yes, this is bad, but it’s clearly testing for weaknesses in the chain through AUR.
Yes, I know it’s contributed code by the community and a random actor can cause havoc. Yes, I know how to manually build packages and check for changes. Yes, I am guilty of using helpers. No, I wouldn’t catch everything on my own.
I do limit what I do use from the AUR, because those installs and updates require more scrutiny.
I am reassessing my own threat model as there’s a couple of packages where I’m dependent on the AUR - most notably displaylink drivers.
I do wish communication was better around the event. I found out first through being subscribed to the mailing list. An announcement on the main page would have gone a long way.
People wanting to use AUR helper, you’re better off using
aurutilsonaurtothanyayorparu. Aurto, even with auto update already remove packages when the maintainer changes because aurto trust models was always to check the maintainer first and not the package itselfWhat about Aura https://aur.archlinux.org/packages/aura
Edit: Sorry I realize my rambling didn’t answer your question. My suggestion is to not use aura. I do not see anywhere on their repo about their trust model or if they just do it like yay/paru. This is also why I recommend aurto and not aurutils. People would just skip the diff with aurutils.
The thing is,
aurtois not the helper. The helper isaurutils.aurtois just the local repo manager that adds timer to auto-update and some QoL features. But to add packages to that local repo, you need to add the maintainer to the trust list. That means the current attack of adopting orphaned / unmaintaned packages is moot. The maintainer change means the package are kicked out and not tracked anymore byaurto. You can still re-add them after you’ve confirmed that they’re safe.That being said,
aurtodo have issue. They trust the PKGBUILD of the author/maintainer so if the maintainer got hacked or gone rogue, it will not protect you. Same as with every other package manager in that case.
deleted by creator
Do you have any tips on how to set up a python environment using nix?
I also use NixOS (btw) but have so far sidestepped this by the expedient of giving up on any project not in nixpkgs whose install process is a pypi script.
deleted by creator
ok, time to completely stop using AUR.
I’ll only manually git clone packages
I think the AUR isn’t possible to keep using as-is so hopefully they come up with some sort of vetting process. Invite system like a private torrent tracker? Idk really.
I try not to use AUR. A few exceptions being the actual program developer maintaining the AUR repo and recommending that method for Arch users on their github page or whatever.
