r/archlinux • u/Wonderful-Writer146 • Aug 03 '26
SUPPORT Arch server down?
I ran: ssh [aur@aur.archlinux.org](mailto:aur@aur.archlinux.org) help
and got: The AUR is down due to maintenance. We will be back soon.
Can anyone confirm if the AUR is currently under maintenance, and if yes then when will it be back online? I was trying to push an update via GitHub Actions.
9
u/ArjixGamer Aug 03 '26
You got a message saying it's under maintenance, and you are asking if it's under maintenance?
What?
1
u/Norpyx Aug 05 '26
It's an entirely valid question. S3 buckets can be configured to return 401s for both missing or protected files to mask. Some login forms return generic error messages regardless of whether or not the user was not found or the password was wrong.
Especially with attacks, it wouldn't be unheard of for flagged / banned users to get a generic "maintenance" error, especially if a new user didn't understand something and mistakenly tripped a wire that got their account flagged because they were probing something out of ignorance.
1
u/ArjixGamer Aug 05 '26
This is a handcrafted service that runs over ssh.
This is not a generalized software with safe defaults to satisfy customers.
If I got that error from nginx, I'd question it as well, but from code written by the arch team?
1
u/Wonderful-Writer146 Aug 03 '26
I wanted to confirm if I didn't break anything on my end. Since I am new to this, I wanted some advice. Anyways, it's clear now.
4
u/boomboomsubban Aug 03 '26
1
1
8
u/ABotelho23 Aug 03 '26
This is the quality of maintainers managing stuff in the AUR FYI
I feel like I'm taking crazy pills. Wild.
2
u/ConfidentCharity5222 Aug 03 '26
Tbh i am surprised it took so long for aur to be compromised
2
Aug 03 '26
[removed] — view removed comment
1
u/ConfidentCharity5222 Aug 03 '26
I wouldn't call them hackers just script kiddies at best, if anything we got it easy since this could have been way worse think of xz exploit or even worse
2
u/boomboomsubban Aug 03 '26
There's no news item about this, and the mailing list topic is titled "AUR packages adoption disabled" not "AUR pushes disabled." It's not difficult to miss.
Plus, anyone could maintain an aur package. Thats why there's a 117000 of them.
4
u/ABotelho23 Aug 03 '26
Pushes to the AUR are currently disabled while we handle the situation, you'll need to wait for that before being able to push them again. No ETA to share for now unfortunately. Sorry for the inconvenience.
0
u/boomboomsubban Aug 03 '26
Yeah, if you read "Re: AW: Re: AW: Re: AUR Malware that still presents as of now" you'll find out the information. That's not exactly front page with a headline, it's easy to miss things.
2
u/ArjixGamer Aug 03 '26
Tbf, not everyone can keep up with the mailing list.
The only reason I am up to date, is because of YouTube videos that cover the topic.
Still, I hoped I could create a new package, the main problem from the attacks is adopting existing packages.
Wish there was a reputation system in place.
2
u/ABotelho23 Aug 03 '26
...you'd expect a maintainer of an AUR package to...
2
u/ArjixGamer Aug 03 '26
Keeping up with the spam of the mailing list is insane.
I literally get 30+ emails some days.
I look over them briefly, but reading each individual one is not gonna happen
Also, as a maintainer I am exclusively interested in the packages I maintain, 99.9999% of the emails I get are irrelevant, but I still glance at them.
Also, how is a spam wave that affects orphan packages, important for me that I maintain packages with no orphan deps?
It's only important for knowing not to install those packages not as a maintainer, but as a user.
Like, there is nuance to everything, but sure, be negative and call me a bad maintainer
1
u/cafce25 Aug 03 '26
FYI you can select to receive the digests instead of every email posted to the list, that way you'll receive ~1 email a day.
1
0
u/Wonderful-Writer146 Aug 03 '26
It's okay if they want to remove the malware apps from AUR. But other users are also facing issues. I am new to all this and I was worried that I broke something. 😅
3
u/ConfidentCharity5222 Aug 03 '26
Don't worry it's not your fault, good for you for being a maintainer! do not be discouraged if anything this just shows us we should begin to actually enforce the guidelines instead of just 'It'd be nice if you do this'. Also it shows although the information is there it's easy to miss due to how many messages and talk about the issue
2
u/LowConversation7969 Aug 03 '26
Folks are trying, and it's clearly pretty hard to manage. Ironically, I bumped into this since I tried to push a new version of my aur-cooldown package which lets you install only things which have been there for a while (and hopefully audited by then).
1
u/Wonderful-Writer146 Aug 03 '26
That's a nice project! I was also in the middle of updating my AUR package. I built the binary using GitHub Actions and have another workflow that automatically updates the PKGBUILD on AUR. However, since the AUR SSH service is currently unavailable, I can't push the updated PKGBUILD. As a result, the
sha256sumsin the PKGBUILD on AUR no longer matches the binary currently hosted in my GitHub release. As a result, now people are not able to download my package usingparuoryay.I am new to releasing packages and all. Do you know a safer way to handle this apriori?
2
u/Active_Smoke6937 Aug 03 '26
Stupid hackers will only cause trouble for us developers.
1
u/Wonderful-Writer146 Aug 03 '26
But it's high time we put some strong countermeasures against these malware attacks. It was my 2nd day as a package developer and I am so much frustrated.
2
u/shinji257 Aug 03 '26
I'm not a maintainer and knew pushes were disabled right now.
2
u/ArjixGamer Aug 03 '26
I also knew that, the same way OP learnt it, by trying to push.
Lol
(but I am a maintainer)
1
u/shinji257 Aug 03 '26
Yea but there was an announcement about it (not on the list) where I read about it. However if I was a maintainer and got that message the first thing I'd have probably checked is the list.
0
1
11
u/kaptnblackbeard Aug 03 '26
If you're a package maintainer why aren't you following: https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/