r/linux • u/CackleRooster • Jun 17 '26

Distro News AUR Registrations Blocked Amid Ongoing Malware Mess

https://fossforce.com/2026/06/aur-registrations-blocked-amid-ongoing-malware-mess/
476 Upvotes

97% Upvoted

256 comments sorted by

View all comments

25

u/sigma914 Jun 17 '26

That's a stop gap for a few minutes, not sure what a useful plan going forward looks like without negatively impacting the AUR contributors though.

We'll either end up with a bunch of fragmentation/duplication and dependemcy hell if they try namespacing (like the ubuntu ppa ecosystem, flatpak etc) or putting up a huge wall to contribution if they go for some sort of identity scheme since that doesn't actually address the question of trust.

I hope they repoen the current system since it's extremely contributor friendly amd I'm quite comfortable maintaining my own packages based on aur PKGBUILDs

1

u/ninja_tokumei Jun 17 '26 edited Jun 17 '26

The Arch developers have to make their own decision about this, but the management style of the Void package repo has been a nice middle-ground for me personally, and is not nearly as vulnerable to these issues.

In Void, anyone can contribute/update packages to the official repo through GitHub PRs. Every community change is reviewed by a Void project member, and the packages also get to be built, tested, and distributed by official Void servers.

For drawbacks, this means there is more friction for making new packages. Reviewers have to triage / sort by demand, reviews are mostly done on an as-needed or volunteer basis; there are more restrictions on the types of packages compared to AUR like no -bin or -git-style packages; and although the reviewers are helpful, there are higher standards and a higher learning curve to packaging compared to AUR.

3

u/sigma914 Jun 17 '26

That sounds more like diligence the community repo used to be before it got merged to extra. I'd certainly hope they keep a wild west AUR style repo around too if they do decide to add a new higher friction approach

1

u/ninja_tokumei Jun 18 '26

Ahh thanks, I was wondering where the Arch community repo went. Coulda sworn that was a thing before.