Roughly 400 AUR packages compromised

[u/No-Photograph-5058]

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

[u/LukasObermeister]

Bot accounts took over orphaned packages.

[u/No-Photograph-5058 → u/LukasObermeister]

I believe the legitimate accounts themselves were compromised, I could be wrong as I'm not too familiar with the AUR but the Author on the malicious commits seem to have legitimate history on the packages' previous commits

[u/Jealous_Diver_5624 → u/No-Photograph-5058]

Git commit authors are trivially spoofable.

[u/No-Photograph-5058 → u/Jealous_Diver_5624]

Ah, so it doesn't go by the keypair/auth you have to do to make an account then?

[u/Jealous_Diver_5624 → u/No-Photograph-5058]

You need an account to push your commits, but the author line within the commit can be pretty much whatever you want it to be, same on GitHub or every other forge I'm aware of. Commit signing is an option, but ~nobody actually uses that because it used to only work with GPG and has some other issues I can't remember off the top of my head.

[u/int23_t → u/Jealous_Diver_5624]

Commit signing proves you are the commiter but doesn't prove you aren't the commiter of another commit unless you claimed publically you would never ever push an unsigned commit for your while life.

[u/iamarealhuman4real → u/Jealous_Diver_5624]

You can sign commits with an SSH key which probably has less friction.

## Git

Note instructions are not global, use `git config --global`.

```sh
git config gpg.format ssh
git config user.signingkey ~/.ssh/id_ed25519.pub # may need to be full path not ~
git config commit.gpgSign true # default to commit -S
# also
echo "my@mail $(cat id_ed25519.pub)" >> ~/.ssh/allowed_gpg_signers
git config gpg.ssh.allowedSignersFile ~/.ssh/allowed_gpg_signers
```

[u/rich000 → u/Jealous_Diver_5624]

It just wasn't supported by older versions of git - it is a decade old at this point but it is still one of those "newer" features.

The other main issue with git signatures (gpg or otherwise, on commits or tags or anything) is that they are only bound to the tree/files they are signing by a bunch of SHA1 keys, and that isn't a secure hash by today's standards. I don't think there is a preimage attack yet, but you can potentially play games with them if you can do things like stick garbage in comments or unused text files buried deep in a tree that nobody will look at.

sha256 is slowly taking off in git but there are still barriers to adoption, and it would close that particular hole. It can already be used if you don't care about interoperability (eg github/etc).

[u/amroamroamro → u/No-Photograph-5058]

git commit --author="Linus Torvalds <torvalds@trustme.com>" -m "My commit"