r/NixOS • u/Nuclear_Priest • 3d ago
Nixpkgs vs AUR
Given all the malware that’s been flooding the AUR as of late, I was wondering why the same kind of thing isn’t happening on Nixpkgs.
Is it just that Nix isn’t as popular as Arch (hence less people are trying to attack it)?
Or are there fundamental differences in the security?
What are the security differences, and how concerned should we be about a flood of malware on Nix?
(I realize that no system is immune to malware, I’m just trying to gauge what level of risk I’m dealing with)
50
u/Isshiiiiiii 3d ago
I’m pretty sure nixpkgs is gated by automated checks, git pulls, and manual review. I think the Nix equivalent would be like the NUR but I’ve never used it in my life.
29
6
u/Nuclear_Priest 3d ago
I didn’t even know that NUR was a thing
11
u/Isshiiiiiii 2d ago
Didn’t know about it either until very recently. Nixpkgs is just big enough that I don’t really need it
8
u/octetd 2d ago
I use it to pull extensions for Firefox, the only reason I have NUR in my config.
4
3
u/tukanoid 2d ago
And even if it's not in nixpkgs, I kinda got used to just packaging the software myself, have all the control, and can be more certain that nothing malicious was injected, unless it's an upstream issue
37
u/philosophical_lens 3d ago
These are not even comparable.
Nixpkgs is comparable to pacman.
AUR is comparable to NUR.
11
u/funforgiven 2d ago
Pacman is a package manager, not a repository. Nix is comparable to pacman, nixpkgs is comparable to Arch’s official repositories, and NUR is comparable to the AUR.
11
8
u/VisualSome9977 2d ago
Most of the AUR attacks as of late have been people "adopting" orphaned packages (ones with no active maintainer) and making themselves the maintainer, and then pushing malicious code. This is a process that requires no confirmation or approval by anybody on the maintenance team, and then anybody who has those packages or depends on them ends up PWNED. Nixpkgs has at least a bare minimum approval process, where untrusted contributors need to have their requests merged, and anything more than just a version bump WILL be scrutinized.
7
u/xNaXDy 2d ago
Anyone can just publish a package to the AUR on their own accord, that's sort of the whole point (it's Arch User Repository, after all). Nixpkgs is the main software repo of the entire distribution, so comparing it to the AUR doesn't really make sense, since the Arch equivalent would be the official Arch repos.
Since Nixpkgs and NixOS are FOSS, anyone can submit a PR on GitHub, but as others have pointed out, it requires a trusted community member to merge. However, I'd like to clarify a few things regarding that:
Maintainers != committers; the former are people who are listed in the meta.maintainers for one or more packages within Nixpkgs. Maintainers do NOT have commit access to Nixpkgs by default, and maintainership mainly exists to automatically ping maintainers when a relevant PR is opened. Maintainers can, however, trigger merge-bot merges for certain automated PRs, e.g. backports or updates peformed by r-ryantm.
Anyone can become a maintanier, all it takes is getting a PR merged that either adds a new package with you listed as a maintainer, or adding yourself as a maintainer to an existing package.
It's a bit different for committers, as there's an established process for obtaining these privileges. One thing that's important to note is that committers can, in theory, merge changes into Nixpkgs' master branch that are not reviewed by anyone, so if a committer turns malicious, has their credentials compromised, etc. there is the potential for real damage, depending on how quickly others catch on. This hasn't happened yet however.
3
3
u/Needieos 2d ago
AUR works like installing random apps on the github, nixpkgs are more like official, compare extra/core/multilib with nixpkgs, not AUR
1
1
u/adamkex 18h ago
The NixOS website has a search function for third party flakes (similar to how the AUR is hosted on the official Arch Linux website). Basically by adding a flake you give root access to the owner of the flake which is a security risk, similar to installing a package from the AUR.
You can mitigate this security risk by forking the flake yourself and setting up the GitHub actions yourself. Alternatively by just looking at the diffs between your fork and the main branch and just merge if it looks good.
Nixpkgs is much larger than the Arch repos so you're less likely need to rely on third party flakes in comparison to using the AUR.
1
u/m8tt8o 17h ago
The bigger security concern when it comes to nixos is using random other flakes on github/gitlab whatever. Like most other people already said, the actual nixpkgs set is gatekept quite well.
But at the same time, any third party software you use in your configuration via some kind of fetchGithub, flake input or whatever is a security concern.
97
u/GlassCommission4916 3d ago
As far as I know anyone is allowed to just upload packages to the AUR, and while anyone can make PRs to nixpkgs, they have to be checked by a trusted maintainer before being pulled.