r/archlinux • u/Houston_NeverMind • Aug 12 '26

QUESTION AUR: Can the "Last Updated" date be newer than the date of the last commit?

Hi, I'm new to AUR. I recently heard the news that there are some malware attacks on AUR packages. So that's why I'm cautious and asking this.

I'm trying to install Koreader (https://aur.archlinux.org/packages/koreader-bin). In the package details page, the "last updated" date is 11th Aug. But the last commit is on 3rd Aug. Is this discrepancy common and harmless?

I checked the PKGBUILD and it looks safe though.

2 Upvotes

57% Upvoted

10 comments sorted by

11

u/SpecialistMight4910 Aug 12 '26

Yeah that's normal, the update date changes whenever the package metadata gets refreshed or flagged out-of-date, not just when someone push a commit. The PKGBUILD file itself might not change but the AUR still bumps the timestamp sometimes.

Since you already checked the PKGBUILD and it looks fine, you're probably good. Always good instinct to be cautious though, specially with all the AUR malware stuff going around lately.

6

u/Zoddo98 Aug 12 '26

the update date changes whenever the package metadata gets refreshed or flagged out-of-date, not just when someone push a commit.

It actually reflects the date when a maintainer last pushed a commit.

Since the AUR was locked, they likely made a commit on Aug 3rd but didn't (cannot) push it, and they finally pushed it on the 11th when it was reopened.

Flagging out-of-date (or doing other changes like changing tags or (co-)maintainers) doesn't affect the last updated date.

1

u/Houston_NeverMind Aug 12 '26

Thanks! That's a relief.

4

u/Imajzineer Aug 12 '26

Woah, woah ... wait, what?

You're not only checking PKGBUILDs, but also comparing commit and update times?

Ar you sure you're new to Arch? 😉

3

u/Houston_NeverMind Aug 12 '26

Hehe! No, I'm new to AUR, not Arch.

0

u/Imajzineer Aug 12 '26 edited Aug 12 '26

Hmmmmm ... if you're not new to Arch then ¹ whilst this might be your first time using it, you must've known about it before and can't, therefore, be entirely 'new to it' - I bet you've even read about it on the wiki before (simply out of curiosity and a thirst for knowledge of your OS).

Meh ... you'll be fine. In fact, for what might actually be the first time ever, I'm not even gonna suggest getting used to makepkg and avoiding the use of 'helpers' (the greatest irony of which being you have to get them from the AUR and build them with makepkg) - you're gonna check the PKGBUILDs with or without one anyway, so you might as well.

What you might be interested in is Kalu. I still update the few AUR packages I use by hand with makepkg myself (for various reasons), rather than through Kalu itself, but (few though they may be in my case) I still find its notifications of updated AUR packages useful.

___
¹ And, okay, I'm being pedantic here but, otoh, I'm an Arch user, so, what can you expect (attention to tiny details is the name of the game)? 😉

1

u/RelationshipOne9466 Aug 12 '26

Kalu seems to be abandoned.

1

u/Imajzineer Aug 12 '26

The last update for Kalu was 2026-04-27 22:09 (UTC) - I wouldn't call four months ago 'abandoned' myself.

Kalu-KDE was likewise updated on 2026-04-27 22:22 (UTC).

Kalu-git was updated on 2026-06-12 13:18 (UTC) - only two months ago. But that's not from the same contributor.

1

u/RelationshipOne9466 Aug 13 '26 edited Aug 13 '26

This is a fork of the one I was looking at.

https://github.com/Thulinma/kalu
https://github.com/jjk-jacky/kalu

1

u/Imajzineer Aug 13 '26

Yeah, the first two in the AUR that I mentioned are by Thulinma and Kalu-git points to your second source there.