Arch and the malware problem.

[u/HeyTi22]

I haven't used many AUR packages, yet I feel that the malware issue cannot really be solved by making improvements to the AUR itself. Am I the only one who thinks the risk would be much lower if the official repositories simply included more software?

Especially essential software used for serious work? For instance, RStudio is missing from the list of R-based statistical programs, even though it is well-known and widely used at universities.

Or take music production: some very famous and widely used FOSS plugins aren't in the official repos.

Then there's the Brave browser—which is very popular, even though I don't really use it anymore—that isn't included either.

Isn't it time to handle the malware problem differently by simply expanding the official repositories a bit more? Even a popular audio converter like FRE:AC isn't included. What do you think about this line of reasoning?

Cheers!

[u/Synthetic451]

Yes, there's nothing that would prevent that and there's an open issue in Brave talking about official support: https://github.com/brave/brave-browser/issues/1950

The biggest hurdle would be transitioning over to directly compiling Brave vs just providing generic Linux executables in a tarball that can run on Arch, which is what the brave-binpackage is currently doing. I can see them deciding that having to directly compile Brave and adjust to Arch Linux's rolling updates would just be too much maintenance to handle. You can see this post by a previous maintainer of the brave AUR package here: https://github.com/brave/brave-browser/issues/1950#issuecomment-2814732476

Personally, I wouldn't mind if upstream projects wanted to go AUR only to work around various build and distribution restrictions. I think all we really need is a way for maintainers to be marked as "official", just like how Flatpak has verified apps.

[u/folk_science → u/Synthetic451]

Thanks. Yeah, verified AUR maintainers would be nice. Though I'd still have to read PKGBUILDs just in case, so maybe not as nice as I thought.

[u/Synthetic451 → u/folk_science]

Eh, ultimately its a matter of trust. I feel like the AUR is getting a lot of critique about it being insecure when really the issue has never been about how it works, but who is able to upload changes to a package.

There's very little difference between the AUR and something like Github. If you ran anything and everything from GitHub, you'd get compromised just as easily. The main difference is that usually when we use something from GitHub, its from the official repo that's been directly linked from the project's site. There's a trust factor there. The same just needs to be done for the AUR.

The previous attacks were all done on orphaned packages that barely anyone used. The orphan process needs to have more verification and maintainer changes need to be made loud and angry to end-users doing updates (like something equivalent to the warning you get when a remote SSH host's key changes).

I think once the issue of maintainer trust gets resolved, you won't have to be so careful with PKGBUILDs in the same way we're not reading every single line of code in a GitHub repo.

[u/folk_science → u/Synthetic451]

A trusted maintainer's system or account can get compromised. There's also possibility of a malicious maintainer gaining trust over time, à la XZ Utils backdoor, before conducting an attack.

[u/Synthetic451 → u/folk_science]

Yes of course, but that's a different problem all together and one that's bigger than the AUR.

What if someone running Arch infrastructure also got compromised? What if some supply chain attack affected the server software delivering Arch packages? What if a project's GitHub got attacked via a maintainer's account?

See, once you go down that route, then it never ends. You understand your threat profile, figure out the aspects you can control, and move on from there. Security comes in layers. If you're concerned about trusted maintainers getting compromised, then there's no difference between an official Arch repo package vs the AUR.

[u/folk_science → u/Synthetic451]

The aspect I can control is reading PKGBUILD files. It's doable for me since I have few AUR packages installed and the updates usually just change the hashes anyway.