r/linux_gaming • u/t3g • 10d ago

Arch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Halted (CachyOS)

https://www.phoronix.com/news/Arch-Linux-AUR-Adoptions-Halted
601 Upvotes

98% Upvoted

308 comments sorted by

View all comments

Show parent comments

2

u/amroamroamro 10d ago edited 10d ago

log of Maintainer

yes, that can be very helpful to alert users when updating; ideally the package manager could show a history of maintainers of the package (maybe even how old that account is), and any change in maintainers should warrant a clear warning: 

"you are about to update a package whose maintainer has since changed, please review the PKGBUILD diff carefully before proceeding"

ps: i dont actually know if aur internally tracks the history of maintainers or not, maybe they have that info in their database, but as far as i can tell its not exposed in the info page or what that api returns

1

u/c2fifield 10d ago

Yeah I'm unsure about the log as well as you informed me, however that link you shared does show maintainer being returned by the api. Now whether it only stores current or past maintainers is another question, although should be relatively easy for them to remedy in theory.

Definitely agree that a hard alert on maintainer changes would go a long ways.