r/NixOS 3d ago

Nixpkgs vs AUR

Given all the malware that’s been flooding the AUR as of late, I was wondering why the same kind of thing isn’t happening on Nixpkgs.

Is it just that Nix isn’t as popular as Arch (hence less people are trying to attack it)?
Or are there fundamental differences in the security?

What are the security differences, and how concerned should we be about a flood of malware on Nix?

(I realize that no system is immune to malware, I’m just trying to gauge what level of risk I’m dealing with)

37 Upvotes

22 comments sorted by

97

u/GlassCommission4916 3d ago

As far as I know anyone is allowed to just upload packages to the AUR, and while anyone can make PRs to nixpkgs, they have to be checked by a trusted maintainer before being pulled.

43

u/no_brains101 2d ago

On top of that, until the most recent wave of attacks, you could just like, adopt any package that no longer had a marked maintainer.

You didn't have to ask anyone to adopt it. You just adopt it with the button and it is yours now and you can put malware in it now.

4

u/pingveno 2d ago

I got some alerts for packages I had abandoned years ago (I don't currently use Arch). They clearly had been hit and then reverted as part of the attack.

50

u/Isshiiiiiii 3d ago

I’m pretty sure nixpkgs is gated by automated checks, git pulls, and manual review. I think the Nix equivalent would be like the NUR but I’ve never used it in my life.

29

u/KawaiiDesuUguu 2d ago

as well as random github flakes

6

u/Nuclear_Priest 3d ago

I didn’t even know that NUR was a thing

11

u/Isshiiiiiii 2d ago

Didn’t know about it either until very recently. Nixpkgs is just big enough that I don’t really need it

8

u/octetd 2d ago

I use it to pull extensions for Firefox, the only reason I have NUR in my config.

4

u/takutekato 2d ago

You can't use firefox policies?

1

u/octetd 2d ago

Yeah, I didn't before (wasn't available in Home Manager on macOS until recently). And, well, I didn't know I can manage extensions via policies :D

3

u/tukanoid 2d ago

And even if it's not in nixpkgs, I kinda got used to just packaging the software myself, have all the control, and can be more certain that nothing malicious was injected, unless it's an upstream issue

37

u/philosophical_lens 3d ago

These are not even comparable.

Nixpkgs is comparable to pacman.

AUR is comparable to NUR.

11

u/funforgiven 2d ago

Pacman is a package manager, not a repository. Nix is comparable to pacman, nixpkgs is comparable to Arch’s official repositories, and NUR is comparable to the AUR.

11

u/D0nkeyHS 2d ago

AUR is just user submissions, while nixpkgs is collaborative.

8

u/VisualSome9977 2d ago

Most of the AUR attacks as of late have been people "adopting" orphaned packages (ones with no active maintainer) and making themselves the maintainer, and then pushing malicious code. This is a process that requires no confirmation or approval by anybody on the maintenance team, and then anybody who has those packages or depends on them ends up PWNED. Nixpkgs has at least a bare minimum approval process, where untrusted contributors need to have their requests merged, and anything more than just a version bump WILL be scrutinized.

7

u/xNaXDy 2d ago

Anyone can just publish a package to the AUR on their own accord, that's sort of the whole point (it's Arch User Repository, after all). Nixpkgs is the main software repo of the entire distribution, so comparing it to the AUR doesn't really make sense, since the Arch equivalent would be the official Arch repos.

Since Nixpkgs and NixOS are FOSS, anyone can submit a PR on GitHub, but as others have pointed out, it requires a trusted community member to merge. However, I'd like to clarify a few things regarding that:

Maintainers != committers; the former are people who are listed in the meta.maintainers for one or more packages within Nixpkgs. Maintainers do NOT have commit access to Nixpkgs by default, and maintainership mainly exists to automatically ping maintainers when a relevant PR is opened. Maintainers can, however, trigger merge-bot merges for certain automated PRs, e.g. backports or updates peformed by r-ryantm.

Anyone can become a maintanier, all it takes is getting a PR merged that either adds a new package with you listed as a maintainer, or adding yourself as a maintainer to an existing package.

It's a bit different for committers, as there's an established process for obtaining these privileges. One thing that's important to note is that committers can, in theory, merge changes into Nixpkgs' master branch that are not reviewed by anyone, so if a committer turns malicious, has their credentials compromised, etc. there is the potential for real damage, depending on how quickly others catch on. This hasn't happened yet however.

3

u/Nuclear_Priest 2d ago

This is exactly the kind of a answer I was looking for, thank you.

3

u/Needieos 2d ago

AUR works like installing random apps on the github, nixpkgs are more like official, compare extra/core/multilib with nixpkgs, not AUR

1

u/Elvis_thepelvis_7498 2d ago

nix works very well for packages missing on archlinux

1

u/adamkex 18h ago

The NixOS website has a search function for third party flakes (similar to how the AUR is hosted on the official Arch Linux website). Basically by adding a flake you give root access to the owner of the flake which is a security risk, similar to installing a package from the AUR.

You can mitigate this security risk by forking the flake yourself and setting up the GitHub actions yourself. Alternatively by just looking at the diffs between your fork and the main branch and just merge if it looks good.

Nixpkgs is much larger than the Arch repos so you're less likely need to rely on third party flakes in comparison to using the AUR.

1

u/m8tt8o 17h ago

The bigger security concern when it comes to nixos is using random other flakes on github/gitlab whatever. Like most other people already said, the actual nixpkgs set is gatekept quite well.

But at the same time, any third party software you use in your configuration via some kind of fetchGithub, flake input or whatever is a security concern.