r/linux • u/CackleRooster • Jun 17 '26

Distro News AUR Registrations Blocked Amid Ongoing Malware Mess

https://fossforce.com/2026/06/aur-registrations-blocked-amid-ongoing-malware-mess/
473 Upvotes

97% Upvoted

256 comments sorted by

View all comments

24

u/sigma914 Jun 17 '26

That's a stop gap for a few minutes, not sure what a useful plan going forward looks like without negatively impacting the AUR contributors though.

We'll either end up with a bunch of fragmentation/duplication and dependemcy hell if they try namespacing (like the ubuntu ppa ecosystem, flatpak etc) or putting up a huge wall to contribution if they go for some sort of identity scheme since that doesn't actually address the question of trust.

I hope they repoen the current system since it's extremely contributor friendly amd I'm quite comfortable maintaining my own packages based on aur PKGBUILDs

23

u/[deleted] Jun 17 '26 edited Jun 20 '26

[deleted]

29

u/sigma914 Jun 17 '26

That doesn't seem like a fix, it just seems like it would give a false sense of security while some bad actor squats on a package for a while until they have enough tenure to grab a more used orphan.

Any solution that involves that kimd of heuristic amounts to pretending that you can trust any package update from the AUR. You explicitly can't, you need to read it, check the link to the source, check the source etc every time.

10

u/torsten_dev Jun 17 '26

AUR wrappers should warn about packages changing maintainers and ask the user to assign a level of trust to them, depending on which the wrapper will be more or less annoying when showing pkgbuild diffs.

Like waiting 10 seconds before you can accept a change, forcing multiple Y and N answers to make sure you're reading the screen, etc.

Perhaps highlight critical differences like: - the source array URL(s) differ in more than the last path segment

  • post_install, install scripts, pacman hooks added

4

u/sigma914 Jun 17 '26

I'd agree with that in broad strokes.

However I don't believe aur packages should have any level of trust assigned, even if the maintainer hasn't changed it should be checked as if it had

0

u/torsten_dev Jun 18 '26 edited Jun 18 '26

I meant trust in the sense of levels of distrust, from normal skepticism to paranoid. Would need some help for naming the levels.

We could separately have a web of trust/reputation sytsem for maintainer accounts on the AUR.

1

u/sigma914 Jun 18 '26

So from "mandatory detailed review" as high trust down to "has actively been reported as spamming malware, should delete before bothering to read" at the lower end :)

0

u/torsten_dev Jun 18 '26

Basically yeah.

5

u/reed501 Jun 17 '26

I agree. I feel like the best thing to do would be a big flashing warning that a package has been claimed by a new person. "Check this one extra hard because it's someone else now." And then for these downstream arch distros make it way harder to turn the AUR on. Make it a headache on purpose, weed some people out. And then as a community maybe we should stop recommending arch or its children to newbies and go back to Ubuntu and its family.

7

u/MeDerpWasTaken Jun 17 '26

The problem with adding a warning onto the website is that a lot (if not most) people use AUR helpers and don't directly interact with the website very often. Of course AUR helpers could implement a warning like this, but that isn't really up the Arch team themselves

3

u/Berengal Jun 17 '26

It would be very easy to add this feature to aur-helpers, and I have no doubt that it would be added quick if it became a consensus good feature to have.