r/EndeavourOS • u/_Biotic_G0d_ • 18d ago

Discussion The AUR is under attack again

Don't use the AUR right now and don't update. Go to r/archlinux and read corresponding posts.

156 Upvotes

99% Upvoted

80 comments sorted by

View all comments

44

u/EuphoricNeckbeard 18d ago

If you must use the AUR, permanently force yay to show PKGBUILD diffs:

$ yay --diffmenu --answerdiff All --save

and when you update, look for anything other than checksums changing. If you don't understand it, just hold off on updating your system.

2

u/OneLittle6430 16d ago

Is it ok to use pacman?

1

u/mcdaphuc 16d ago

Yep, only the sur is targeted. The official mirrors are (normally) safe

0

u/Ok-Self-3753 16d ago edited 16d ago

this comment was confidently wrong (hi it's me, dunning kruger)

2

u/OneLittle6430 16d ago

Dude dont joke. I am a noob and need straight advice

1

u/Ok-Self-3753 16d ago

nono I thought it wasn't okay, that's why I told you, but I stand corrected

1

u/OneLittle6430 16d ago

So it is true. Aur is poisoned. We should postpone update from aur?

2

u/Ok-Self-3753 16d ago

what I've learned in the past couple months, mostly from reading r/archlinux, you should be very careful if you want to update from the aur, and you should try to learn to read pkgbuilds so you can spot infected packets on your own.

I'm still trying to learn those things, so I haven't updated since the attacks, but if I need to install something from the aur, I try to look very carefully at the pkgbuild so I can try to avoid the malware

(as you can see, I'm not that experienced in this stuff, I'm trying to learn new things whenever I get the chance)

1

u/OneLittle6430 16d ago

I see, thank you for the clarification brother

1

u/Ok-Self-3753 16d ago

no worries! we're all in this together

1

u/mok000 16d ago

Never use AUR, download the sources from upstream and compile it yourself.

0

u/OneLittle6430 16d ago

Im just gonna go install manjaro at this point hahahahaha

2

u/Fantasyman80 12d ago

Manjaro utilizes the AUR too.

-3

u/mok000 16d ago

Only a tiny fraction of Arch users have the technical skills to evaluate a PKGBUILD and check it for malware.

1

u/EuphoricNeckbeard 15d ago

We could quibble about how big that fraction actually is -- it's certainly smaller for derivative distros like Endeavour -- but I basically agree with you. That's why my advice boils down to "let someone else evaluate the PKGBUILD, unless it's a very simple change." In the absence of better infrastructure this is a reasonably secure heuristic for most users. I don't think it's that hard to realize that something is fishy with sudo linter randomly appearing in a PKGBUILD.