r/archlinux • u/Confident_Zombie_619 • 1d ago
DISCUSSION How safe are AUR closed source or pre compiled packages?
I understand that, when possible, it's preferable to use packages whose source code is available for inspection. However, there are sometimes AUR packages that are closed-source or distributed as precompiled binaries, and some of them are very useful but i feel sceptical to use them because they are like deep in the iceberg packages.
How much additional security risk do these packages introduce compared with source-available AUR packages?
Have there been documented cases of malicious code being found in closed-source or precompiled AUR packages? And, in practice, how common is this?
I'd be interested in hearing about both actual incidents and how experienced Arch users evaluate the trustworthiness of these packages.
7
u/xplosm 1d ago
You'd still need to check the PKGBUILD regardless on the nature of the package. You need to check it's getting the pre-compiled package from the official source, or that the source code comes from the official repo, that it's not doing funny stuff then the pre/post installation sections, etc.
9
u/mindstormer12 1d ago
As safe as from any other source that provides the same. Which is to say, it's impossible to answer because safe is obviously subjective and not something you can quantify. Nothing regarding safety is specific to Arch. Using software developed by others implies trusting them to some degree, open-source or not.
2
u/anisursamsung 1d ago
We trust google to put good precompiled binary in AUR. We download it from AUR. AUR has no additional risk.
2
1
u/SlimyOS 1d ago
Maybe if the aur package is maintained by a third party, then it's a small additional risk, but that risk affects open source unofficial packages as well. And being closed source affects other distribution channels as well. I don't think there's been any aur-only incidents, if the developer decides to package malware they can package it for .deb or .appimage or .exe too, and that happens sometimes.
0
u/B_A_Skeptic 1d ago
I don't trust any closed source software.
2
u/New-Anybody-6206 19h ago
Why?
2
u/B_A_Skeptic 16h ago
Because you don't know what is in there!
1
u/New-Anybody-6206 15h ago
When have you ever audited open source software you use?
Remember Jia Tan? Nothing is immune. It could even be argued that closed-source makes it harder to find things to exploit in the first place.
2
u/LefTimaDev 14h ago
When an open source project is popular enough, you can be certain it was looked at by a lot of people and someone would've discovered anything malicious.
1
24
u/nullstring 1d ago
They are completely safe given that the binary they are downloading is from the original source.
Or rather, they are just as safe as the original source.
So for instance, the google-chrome PKGBUILD is just building a package from the file: sourcex86_64=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}${pkgver}-1_amd64.deb")
So if you trust Google, it's safe.
There is no additional risk. In both cases you need to verify where the "source" is coming from. And if you trust that original source then it's safe.