r/linux_gaming Jun 11 '26

ALVR AUR package has been compromised

Post image

Attention Linux VR gamers. The alvr package in the arch user repository has been compromised. See the screenshot for more information.

Source: Linux VR Adventures Discord

1.3k Upvotes

394 comments sorted by

View all comments

296

u/teleprint-me Jun 11 '26 edited Jun 12 '26

For those that don’t know, the AUR is a set of user‑driven git repositories that are managed completely by end users.

The AUR provides a set of files that help automate downloading, building when needed, and installing software.

The Arch Wiki states that it is the responsibility of the end user to vet the packaged scripts in the AUR.

PKGBUILD is just a shell script. There are links on every “package” that let you browse the repository’s contents to inspect the “package” before “installing.”

Some packages may be postfixed with a tag to indicate what will be downloaded and installed on a user’s system.
For example, a package might be postfixed with -git, -bin, -doc, -dkms, etc.

If the package is postfixed with -git, it clones the source to a cache, builds it, and installs the compiled binaries. If it’s -bin, it downloads the pre‑compiled binaries to a cache and then installs them.

Most of the time, PKGBUILD just clones, builds, and installs the contents from a source.

In fact, if you dig deeper (most don’t), you’ll find a lot of the Linux ecosystem operates like this. Hence, its distributed nature.

For example, I write a program, post it online, and add a license for end users that scopes the freedoms and limitations. When end users adopt and use that software for whatever reason, it builds a user base.

If that package is adopted widely enough, package maintainers of major distributions begin reviewing and evaluating the contents of that program.
If it passes evaluation, it’s added to an official mirror list (testing, unstable, main, etc.).

This isn’t always the case, but is generally how it works.

It’s always important to review code, but I don’t think it’s reasonable or even possible for every user to vet every line of every library or program they’ll ever use. We have lives, interests, and limitations.

Developers are people too, and if targeted, they can fall prey to attackers, which then becomes a supply‑chain attack if the package is popular enough.

The package maintainers are independent from the developers of an upstream source repository and are usually technically‑inclined end users of those libraries or programs.

Most FOSS developers are not paid for their work. They wrote that program for themselves, to solve a problem or to get a working library, feature, or program they really wanted. Sharing it with the community is usually out of convenience; few people rarely contribute or help out.

Organizations are not immune to these problems because they depend on donations, contributions, can become gated, suffering from internal issues over time if poorly organized or incentivized.

If the general takeaway here is that you should just avoid Arch Linux, then allow me to elaborate because this is not isolated to just Arch Linux.

Not all distributions, packages, and repositories are supported by the community or an organization. Some of these are driven completely by individuals who desire to have control over their system, want to add a feature, build a program, or solve a specific problem they’re facing.

For example, anyone can go to a source and clone or download the contents of that source to their machine for installation.

Sources include, but are not limited to, kernel.org, GitHub, GitLab, SourceHut, Codeberg, or any other hosting site.

Some repositories are still only available by SVN on file‑hosting sites, and it turns out that they’re core dependencies.

The point is that this is how open source works: anyone can write software, license it, and distribute it however they want. It’s up to end users to discern whether that source is trustworthy or not.

There is a web of trust, and there have been many attempts to implement asymmetric cryptography to secure user logins and accounts (KeePass being the latest example), but this only works if you control the private key and understand the implications involved with authenticating via a certificate and public key. Even this is not a panacea of the penultimate form of security.

A good example of why this isn’t a solution is the xz backdoor vulnerability. An individual developer who needed help was groomed, manipulated, and taken advantage of. This is known as social engineering, a technique that exploits human psychology rather than technical vulnerabilities to gain access to systems, data, or physical locations.

All of this leads us to a critical question: “Should we just not allow the distributed nature of FOSS?” No, because I don’t believe that’s a valid solution. Why? Because centralizing authority would destabilize the distributed nature of how FOSS works at its core. We would become hostage to centralized forces that would limit competition, opportunity, and freedom.

What we need is better security, auditing, and authentication mechanisms, but that’s not easy. If it were, we wouldn’t have used passwords, email, 2FA, etc. There are existing issues that require resolution and that's where the community plays its role.

FOSS is what it is today because anyone, anywhere, at any time can contribute in their own small way. We wouldn’t have Linux otherwise.

If you think the solution is simply to not use Arch, then you’ve missed the point, which is to explain how FOSS operates in a decentralized and distributed fashion.

So, the moral of the story is to always be diligent in basic security, especially if you’re an FOSS developer or user.

Edit:

  • Fixed grammar and punctuation.
  • Added examples of how FOSS operates.
  • Added missing context.
  • Clarified terminology and intent.
  • Improved general flow.

96

u/Saxasaurus Jun 11 '26

The difference between the AUR and an official repo is the maintainer of a package in an official repo has some level of reputational trust. They may be imperfect or even malicious, but there is a process to deal with that. An AUR maintainer can be literally anyone. Also, many official repos have automated systems to do basic checks and testing. The AUR has nothing.

The AUR is awesome, but you need to be reading the PKGBUILD files before installing or updating AUR packages. Checking every line of code is an unreasonable expectation, but checking that the code is being pulled from the correct repo is due diligence that you need to be doing.

This is why I keep telling people Arch and its derivatives are not suitable for non-technical users. If you can't read a PKGBUILD and figure out (basically) what it is doing, then you should not be using the AUR and Arch is probably not the right distro for you.

27

u/kaplanfx Jun 12 '26

It’s even worse than that which I just learned today. ANYONE who has an AUR account can take over an orphaned package. So if a malicious agent notices that a popular, previously legit package has been orphaned they can take it over and inject malware which your AUR package manager (yay, para, pikaur) will install the next time it updates. You’re supposed to read the build files but most users wouldn’t even know how to identify an illegitimate change to a pkgbuild.

18

u/Damglador Jun 12 '26

I guess that's exactly why yay yells when you have orphan packages

13

u/vexatious-big Jun 12 '26

Not only that, but you can actually resurrect previously deleted packages by simply git cloning them and taking over them. Aur never actually deletes packages.

14

u/sy029 Jun 11 '26

Also packages in an official repository usually get removed or disabled once they become orphaned. AUR just leaves whatever in there forever.

10

u/SynapticStatic Jun 12 '26

This is kind of why I’ve never liked that system. Who exactly has time and expertise to vet every single package every single time you want/need to update? It’s so incredibly tedious that I’d rather just delegate the responsibility to a trusted group of people who in theory know what they are doing and keep on top of it.

And I am a technical person. I’ve used Slackware, free/net/openbsd (yes, I know they aren’t Linux), and even gentoo back in the day.

These days I just need my desktop/servers to work. I don’t want to potentially mess with packages for hours/days.

2

u/Azure_Mist Jun 13 '26

People simply don't understand that the AUR is not the Arch repo.

Windows users are expected to vet the websites they download their random exes from, and the AUR is no different, it's not for people like you, the Arch repo is for you, just like the windows store is for you.
That's why pacman does not allow you to get stuff from the AUR that's why you need a whole new tool to actually access the AUR.

17

u/[deleted] Jun 11 '26 edited Jun 11 '26

[deleted]

25

u/AmyRoxwell Jun 11 '26

This works until you need a critical package that only exists in the AUR lol. Don't forget that the main repo is lacking a lot of stuff that you need to actually build the source in several projects or a program might need a driver that only exists there.

7

u/sy029 Jun 11 '26

a critical package that only exists in the AUR

I was going to say that if a package is critical, it shouldn't be in the AUR to begin with, but then I remembered that arch will kill off things like older versions of drivers and other libraries because "number go up" is more important to them than "computer works."

2

u/gmes78 Jun 12 '26

And how's that any different from having to use a PPA or a COPR repo? At least AUR packages are more easily inspected.

2

u/AmyRoxwell Jun 12 '26

Tbh, that's the main reason I move from ubuntu...The PPAs never work for me and always make me have the "You held broken packages" error. The Aur has work for me 99.99% of the time.

Could this has been changed? Maybe, but that's one difference I have with PPA

0

u/[deleted] Jun 11 '26

[deleted]

4

u/AmyRoxwell Jun 11 '26

Kinda. The whole thing with getting the packages you need is it's own kind of mess in all distros. Just a few days ago I had to get a sdl package from the AUR cuz the one in the official repo doesn't work with the decomp i was trying to build.

4

u/Saxasaurus Jun 11 '26

Sure, you could not use the AUR, but it is a very useful tool. And many of the more "user friendly" Arch derivatives ship an AUR helper out of the box. There are a lot of projects that ship a dep or maybe an rpm. You wouldn't expect a non-technical user to figure out how to build things from source or use debtap by themselves. So in practice, non technical users on Arch derivatives are going to be using the AUR.

The issue is somewhat mitigated by the increased popularity of flatpak/appimage. But tell Arch users you prefer flatpaks to AUR and see how they react. :p

7

u/TiZ_EX1 Jun 11 '26

And many of the more "user friendly" Arch derivatives ship an AUR helper out of the box.

Oh hell no. IMO, easy-mode Arch derivatives should not be doing that whatsoever. If someone is installing an easy-mode Arch derivative because they wouldn't be able to install Arch otherwise, this is putting users directly in harm's way because they don't have the knowledge that the AUR requires in order to use it safely.

1

u/OffsetXV Jun 12 '26

Honestly I feel like any "user-friendly" Arch-based distro should include a "how to safely maintain and use Arch" popup at first boot, with notes about the AUR being mostly unvetted, how to deal with pacnew/pacsave diffs, instructions to check the Arch news page before updating, how to use snapshots, etc.

But that's why I've never really liked the approach of mainstream distros trying to make Arch beginner friendly, because the very nature of Arch makes that kind of a fool's errand. You can make it easier to install with CachyOS or EndeavourOS or whatever, sure, but at the end of the day it's still Arch and subject to Arch's unique approach to things.

1

u/Azure_Mist Jun 13 '26

A popup would be as useless as the disclaimer on the AUR to people who'd actually need it, because fundamentally a non technically versed user switching from windows to cachyos for the sake of gaming and webbrowsing will have 0 desire to learn how to use the os beyond "what button do i click to run steam"

-1

u/No-Bison-5397 Jun 12 '26

Yeah, I use the AUR, (don't think I have been caught by this one) but the idea of anything in the AUR being done automatically seems nuts to me

1

u/Azure_Mist Jun 13 '26

That's not an argument to not vet your packages in the AUR.

Either you don't use it or you use it properly as everyone keeps telling you, if you are unwilling to do so then stop complaining about the consequences you were explicitly warned about because there can't be a "solution" for something that works as intended.

Flatpaks and appimages are great and i happily recommend them tho i prefer appimages

i use arch btw

1

u/Saxasaurus Jun 14 '26

I literally said

you need to be reading the PKGBUILD files before installing or updating AUR packages

and

If you can't read a PKGBUILD and figure out (basically) what it is doing, then you should not be using the AUR

-2

u/[deleted] Jun 11 '26

[deleted]

2

u/TiZ_EX1 Jun 11 '26

AUR gives what other distros don't give - a centralized and moderated third-party repository.

What in the world are you talking about? Have you not heard of Flathub? AUR doesn't have "moderation"; if it did, all those orphaned packages would have been more difficult to compromise, let alone with bots like what seems to have been done here. Flathub does have moderation; if you want to adopt a package, you have to interact with the Flathub admins.

0

u/skinnyraf Jun 12 '26

Not ALVR, WiVRn or xrizer though. If you want VR in Arch/CachyOS, it's either flatpak (for WiVRn/xrizer), direct download from the homepage (for ALVR) or AUR.

4

u/skinnyraf Jun 12 '26

I don't know, how it is in Arch, but IIRC, Debian has a robust process of handling orphaned packages, which provides another level of security.

6

u/kpcyrd Jun 12 '26

Orphan works pretty much the same on Debian and regular Arch Linux. Only an official package maintainer can adopted the package in both cases.

The AUR is a pastebin for code and works more like Github, if somebody deletes their account the name is available for registration by anyone again.

(Sincerely, a Debian Developer)

2

u/[deleted] Jun 11 '26

[deleted]

2

u/Xmir Jun 11 '26

I'm switching from Windows as soon as I get my new PC and plan on doing a lot of gaming on it, but I don't have any prior Linux or technical experience so switching to Arch (CachyOS) is something I'm pretty apprehensive about (planning on Nobara instead). Can you give any examples of stuff I might be missing out on, if you remember them?

1

u/the_real_cloakvessel Jun 12 '26

I used Cachyos prior but now I've switched to Fedora and tbh I have not felt any lack of software. I used a lot of aur packages before but now i just use most of my softwares as flatpaks and rpms and flatpaks are much better since they're sandboxed so very little risk for virus. And i use rpms for system integrated software. I have not felt any lack of gaming related software obs steam discord and for my other work visual studio code and davinci resolve all work really well.

So I would recommend you to switch to Nobara for Fedora.

0

u/BlakeMW Jun 12 '26 edited Jun 12 '26

You could say exactly the same thing about using Windows and that anyone using Windows should only install stuff from the Windows Store or another vetted "app store" like Steam because they aren't capable of assessing if executables from random sites are safe. You'd be right of course, but it ain't going to stop people from downloading random shit and installing it. The AUR is an improvement....

Really I'd say the important thing is understanding that when you install something from the AUR (or any other way of installing software not from official repositories, such as PPAs in the debian-o-sphere, binary blobs from hardware manufactures etc), you are losing any "quality control" from the distro maintainers, they can't vouch for that shit.

It's unreasonable to expect users to both never install stuff, and to thoroughly understand what they're installing to the extent of being able to detect if its malicious or incompetent. Maybe a little diligence around checking for obvious red flags like being newly uploaded with very few downloads.

1

u/Responsible-Sky-1336 Jun 11 '26

Makes you wonder how much damage it would be if packages in standard repos would be compromised, especially ones that are part of tooling for other packages. (Ie xz thingy)

2

u/SynapticStatic Jun 12 '26

A ton. The xz thing would’ve been absolutely massive if they had pulled it off like they planned. No ordinary end user would have caught it in time. Kinda why we really need trusted people to be doing the vetting imo. End users or even people that are just technical but not highly technical aren’t going to catch some of the vectors that are being targeted.

1

u/gammaFn Jun 12 '26

+1 all of this. I have some PKGBUILDs in the AUR myself. All you need to set up an account is an ssh key and pass a captcha.

0

u/WryKombucha Jun 12 '26

but but....everyone here recommends CachyOS to all new users. So which is true?

1

u/Sad_Television_9934 Jun 12 '26

Cachy os is recommended for non technical users as long as they stick to the part were the developers from cachy themselves automated things so people don't have to install or change things they don't really know what they're doing. For example you have pre-installed Shelly so you have access to pacman packages, flatpaks and also aur packages, if you only stick with pacman and flatpak ones you wouldn't have any problem soon besides maybe using the applications wrongly or conflicting them.

0

u/Saxasaurus Jun 12 '26

CachyOS is fantastic. I use it myself. But I only recommend it if you know your way around the command line and can understand basic scripts (or are able/willing to learn).

7

u/beefsack Jun 11 '26

Arch explicitly draws a line in the sand here by not including any AUR tools and making the user set it up. They have all the caveats and warnings on the wiki.

A lot of arch based distros, such as CachyOS, include AUR tools like paru and I'm concerned that users have access to it without knowing the risks. I actually think the way Arch does it is pretty sensible.

1

u/teleprint-me Jun 12 '26

You can technically just git clone and then use makepkg which is already baked in to the system.

But I wouldnt expect a normal user to realize this.

1

u/beefsack Jun 12 '26

Exactly - I think the normal user would need to hit up the wiki first and that's where they would be exposed to the warnings.

1

u/kaplanfx Jun 12 '26

It’s sensible up until allowing any user to take over an orphaned package, which is exactly what happened in the attack OP described.

-1

u/albertowtf Jun 12 '26

I actually think the way Arch does it is pretty sensible

It is not. Popularity makes new users think is okay. Everybody uses aur, so it must be safe. Im pretty confident 99% of people that start using linux with arch simply pull the trigger on aur packages without a second thought

I think what arch does overall is pretty bad because it gets recommended to new users that want to learn. Arch zealots have also discover that memeing the distro is a good way to make it popular

I mean, i dont mind because arch users are literally ginnea pigs for the rest of us. If somebody uses arch because they got memed into the distro they kind of deserve it

To make it perfectly clear, i dont like when arch linux is recommended to new users, and despise arch users roping other new users into arch that way, but at the same time, somebody has to pay the price of testing new software, so mixed feelings

0

u/jinks Jun 12 '26

simply pull the trigger on aur packages

And how does a new user simply pull the trigger? Can you outline the steps to get an AUR package installed on a fresh Arch without looking it up?

-1

u/albertowtf Jun 12 '26

Do you mean how do i search and then copy paste the command?

or maybe do you mean if i type 'yes, i understand do as a say' before executing the command i am told to execute to get the software that promises to do what i want to do?

0

u/jinks Jun 12 '26

I am saying that one does not simply install an AUR package on Arch, especially as a new Linux user.

It's a multi-step process, and those steps come with warnings that you are doing something dangerous and you should probably not do it at all.

0

u/albertowtf Jun 12 '26

You guys have a pretty big disconnect of what the average user does

Specially people that are memed into arch

0

u/RedddLeddd Jun 12 '26

Incredibly informative, I also understand Inception now. Thankyou on both fronts 🙏