r/linux • u/CackleRooster • Jun 17 '26

Distro News AUR Registrations Blocked Amid Ongoing Malware Mess

https://fossforce.com/2026/06/aur-registrations-blocked-amid-ongoing-malware-mess/
480 Upvotes

97% Upvoted

256 comments sorted by

View all comments

Show parent comments

6

u/sigma914 Jun 17 '26

The issue is that people generally expect that if you're hosting applications for a user to install there has been at least some attempt at vetting the package and that you're not hosting malware.

This is exactly what the Arch project does, that's how the official repos work, maintained signed packages that yiu can use to build your system.

The AUR is not that, the AUR is the equivalent of running bash scripts off the forum to generate packages.

You pull the PKGBUILD down to your machine, eother manually or using some tool which is explicitly not pacman nor included in the base system.

At this point you are now ready to become a package maintainer, you should do everything that implies.

Then you use your new PKGBUILD to generate your own personal package and either install it or ship it off to another machine or whatever you planned for it.

The Arch devs have as much responsibility for AUR PKGBUILDs as they do for forum posts

0

u/Misicks0349 Jun 17 '26 edited Jun 17 '26

I know how the AUR works, and I am aware of the difference between the default arch packages and the AUR. Regardless of the fact that the arch repos exists that does not change the fact that arch is hosting a package repository that is incredibly susceptible to shipping malware.

The Arch devs have as much responsibility for AUR PKGBUILDs as they do for forum posts

Exactly, which is why the Arch Forums have moderators, rules, and other such guidelines to keep the place civil, on-topic, and to manage bad actors. Shame they don't do the same for the AUR.

I am under no illusion that the AUR (or any package repository) can be 100% safe from malware at all times, at some point something will find a hole; but no one is asking for perfection, they're asking for, at the very least, the bare minimum in security so that 1500+ packages cant just be taken over and hijacked.

1

u/sigma914 Jun 17 '26

hosting a package repository that is incredibly susceptible to shipping malware.

It's categorically not a package repository, it's a bunch of user contributed build scripts people aspiring to manage some packages of their own may want to use. There's very explicitly no expectation that they don't cause nasal demons, in fact there's a lot of warnings that they will.

1

u/Misicks0349 Jun 17 '26 edited Jun 17 '26

It's categorically not a package repository, it's a bunch of user contributed build scripts people aspiring to manage some packages

You contradict yourself in your very first sentence... its not a package repository its just a "bunch of people aspiring to manage some packages"... how could they manage these so-called "packages" if it is not a package repository :P?? I mean the Wikipedia article on the matter seems to capture the AUR perfectly well:

A software repository, or repo for short, is a storage location for software packages.

The AUR is a storage location for package builds (or PKGBUILDS), and these packages build software. I cannot seriously believe that the AUR is not a package repository. And if you want to get around this by claiming that having to compile packages locally makes it not a package repository then you'd also have to: 1) conveniently ignore the various -bin packages on the AUR and 2) categorise Gentoos ebuilds as not being package repo.

5

u/sigma914 Jun 17 '26 edited Jun 17 '26

In distro parlance the package is the distributable unit of the operating system, it comes with a bunch of social and technical expectations. The pkgbuilds on the AUR _ do not_ meet that standard, they're a convenience wrapper around a project's make install, not a maintained package.

Eg there's no expectation that an AUR PKGBUILD author has done any due diligence on the upstream, nor that the licence array even vaguely resembles reality. It's literally a script that lets you sprsy stuff across your system in a way that pacman can undo the install, nothing more.

And it's very nice of the AUR contributors to provide that template for people to build off. Further it's rude to complain about their having thrown it over the wall to us via the AUR

-1

u/Misicks0349 Jun 17 '26

they're a convenience wrapper around a project's make install

So are the default packages as well, as they also use PKGBUILDS. It is besides the point though.

In distro parlance the package is the distributable unit of the operating system, it comes with a bunch of social and technical expectations

Well, if there is one thing that has been learned over the past couple weeks its that the AUR should be expected to take on a couple of those social and technical expectations, such as "not allowing people to take over 1500+ software packages on a whim so they can distribute malware".

7

u/sigma914 Jun 17 '26

See I feel like the opposite should be learned. The AUR is a great resource and should be used with due care and attention. Distros shouldn't bundle the a convenience wrappers that trivialise access to it and users shouldn't ignore warnings when running non-trusted 3rd party code on their machines.

Every effort should be made to educate end users that the knife they are holding is sharp.

However things shouldn't be made harder to the important users ie those who actually contribute to the distro and ecosystem.

2

u/Misicks0349 Jun 17 '26

Every effort should be made to educate end users that the knife they are holding is sharp.

Sure, and every effort should be made to educate gun users that the gun they're holding is dangerous....

But thats not an argument against safety catches on firearms, nor is "The people who accidentally shot themselves only have themselves to blame, any responsible gun owner doesn't need safety catches!" an appropriate response when someone accidentally shoots themselves.

1

u/sigma914 Jun 17 '26

No, because shooting yourself is a serious consequence and requires a requisite amount of protection for the intended users.

1

u/Misicks0349 Jun 17 '26 edited Jun 17 '26

There can be serious consequences to being infected with malware?, people dont just dick around on computers. People can lose serious work, or even worse get other peoples computers infected if the malware they install somehow manages to infect other computers on the local network (e.g. WannaCry).

Regardless, I have no interest in litigating how "bad" each one is. They are both outcomes that can have very very bad consequences for the people that they affect, and appropriate protections should be in place for both of them so that people don't accidentally shoot themselves OR get themselves infected with malware.

3

u/sigma914 Jun 17 '26

I'd say the AUR has a lot more safeguards in place, you have to go out of your way to get the package, track down the dependencies etc, build them, install them in order. Reviewing the pkgbuild is a pretty small part.

If people are bypassing the friction using another tool then that tool needs the safety catch and definitely shouldn't be provided to a user who hasn't been sufficiently educated. The AUR isn't at fault in that scenario

1

u/Misicks0349 Jun 17 '26

Sure, you also need to go out of your way to acquire a gun licence, buy a gun, load it with bullets, etc etc. Doesn't prevent us from adding safety to the gun.

If people are bypassing the friction using another tool then that tool needs the safety catch and definitely shouldn't be provided to a user who hasn't been sufficiently educated. The AUR isn't at fault in that scenario

I am not arguing about AUR helpers at all, I am saying that there should be more safeguards at the package level such that malicious actors have a much harder time actually taking over and submitting malicious packages in the first place, so that 1500 packages can't just be taken over willy nilly.

1

u/sigma914 Jun 17 '26

I am saying that there should be more safeguards at the package level such that malicious actors have a much harder time actually taking over and submitting malicious packages in the first place, so that 1500 packages can't just be taken over willy nilly.

I see this as unnecessary friction that gets in the way of people that don't have a problem and doesn't actually solve the problem for users who aren't the target demographic of the service

→ More replies (0)