Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux disables AUR package adoption

lwn.net

Post reply on HN
Print view View original

51–60 of 134 posts

Re: Arch Linux disables AUR package adoption

#51

Post by ethin »

warkdarrior wrote: post #36
nvme0n1p1 wrote: post #21

Earlier quoted context omitted.

You really don't see the difference between a deterministic script installing a tarball pinned by its hash, and "sudo chatgpt install master branch of this repo"?

Yes, the second option gives me an easily inspectable list of results (as I can see all the tool calls the model made). The deterministic script is probably overly complex and hard to read, maybe supports ten billion platform combinations.

> The deterministic script is probably overly complex and hard to read, maybe supports ten billion platform combinations.

Uh sorry what? Can you point to a PKGBUILD that is indeed this complex?

Re: Arch Linux disables AUR package adoption

#52

Post by saghm »

tempfile wrote: post #16
charcircuit wrote: post #9

Earlier quoted context omitted.

Desktop Linux has always been a house of cards in regards to security. I agree it's amazing that it went on for so long, but this was inevitable.

I disagree. Maintainers for the major distributions take their roles very seriously, and do a very good job generally of filtering out malicious packages. The AUR is an outlier, being essentially an unmaintained wild west.

The AUR is also not really comparable to official distribution package repositories either. Yes, it's hosted by the same people as the official repos that are comparable to what you'd get by default on other Linux distros, but it's intentionally not something that works with official package management tooling. The equivalent would be if Debian or Ubuntu hosted a repo that anyone could upload of unbuilt debian packages while explicitly not offering any tooling other than the usual tools for building a .deb from source files that you manually downloaded from anywhere else or defined yourself.

It's definitely an outlier, but more in terms of being something that doesn't really exist anywhere else, so of course the security model for it will also be an outlier. That's not an excuse for any security issues, but it's not like Arch doesn't have official repos with maintainers who are just as diligent as any other distro. They just also happen to provide a public git server that people can publish packages to with a UI for seeing some of the package metadata; people could just as easily write toolling to automate package management where it looks for a GitHub repo instead of an AUR one to fetch the build files.

Re: Arch Linux disables AUR package adoption

#53

Post by sejje »

sp0rk wrote: post #11
WD-42 wrote: post #7

I’ve been using arch for nearly 2 decades at this point. It’s amazing that the AUR went this long without any serious attacks. It’s a different world now. I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux?

> I can’t help but feel there used to be honor among hackers. You didn’t go after your own. What kind of jerk would attack Arch Linux? This has absolutely not ever been the case.

yes, hackers are bigger targets imo, not smaller ones

Re: Arch Linux disables AUR package adoption

#54

Post by gustavus »

simonask wrote: post #44

The older I get, the more critical I become of the culture of anonymity in OSS. The obvious-but-hard solution to this, as well as certain other attacks like the xz incident, is a chain of trust. Every line of code in every package should be cryptographically attributable to an individual or an organization, ideally associated with a government-issued ID. Git commits without a real name and a cryptographic signature s…

I love how people blame anonymity for the current internet problems. Whereas when anonymith was the default we had almost none of the problems. Most of the problems seemed to have started once anonymity stopped being the order of the data, and things like Facebook and Twitter became big where everyone's real identities became tied to their online behavior.

Re: Arch Linux disables AUR package adoption

#55

Post by OJFord »

gchamonlive wrote: post #6
OJFord wrote: post #3

Earlier quoted context omitted.

I've used it (not for abuse). It's simply volunteering to maintain the package after previous maintainer(s) have explicitly disowned it, knowing they no longer have time for it or don't care because they stopped using it, etc.

Problem is that there is no KYC process before someone can adopt any orphaned package

Yeah, I don't disagree there should be more of a barrier, I remember being surprised I could just adopt things. Just explaining the intended use.

Re: Arch Linux disables AUR package adoption

#56

Post by davkan »

nvme0n1p1 wrote: post #23
zahlman wrote: post #18

Earlier quoted context omitted.

More so than, say, Windows? Really? And no, "people using one Linux distro can opt in to possibly getting pwned by each other by making use of a third-party software depot" does not reflect upon the entirety of the Linux world.

It's funny how these people say Linux security is bad because random people can upload arbitrary files to AUR, but won't say Windows security is bad because random people can upload arbitrary files to Microsoft GitHub.

I think the wrongful notion comes from the fact that the vast majority of Arch users use and speak about AUR as if it were a part of arch proper, only paying lip service to reviewing PKGBUILDS, etc. They wrap the default package manager in one that supports AUR and never touch it directly again. It feels closer to if all of GitHub was available in one click through the Microsoft store or windows update.

And unfortunately that’s how arch is mainly marketed by its users. “Arch has the latest everything, if it’s not in the repos it’s on AUR” is one of the standard selling points.

Of course that speaks to how people use linux insecurely not how Linux is insecure.

Re: Arch Linux disables AUR package adoption

#57

Post by Alive-in-2025 »

Matl wrote: post #35
charcircuit wrote: post #9

Earlier quoted context omitted.

Desktop Linux has always been a house of cards in regards to security. I agree it's amazing that it went on for so long, but this was inevitable.

With regards to sandboxing etc. maybe. With regards to packages? Official repos support signing and usually rely on maintainers with proven track records. AUR was a honor system and since some people are total basement losers, you can't rely on that.

We have locks on our doors for a reason. Any software that allows updates and relies on the honor system of "someone else must have checked this" will get hacked. Every day there's yet another certificate or secret stealing infection that is in some random upstream dependency in your dev tools or shell scripts or whatever.

Re: Arch Linux disables AUR package adoption

#58

Post by qwery »

vlovich123 wrote: post #29

> The project had suspended new account registration in June. That followed a campaign in which an attacker or attackers created new accounts to adopt orphaned packages and push malicious updates to them that would install malware on user systems. AUR registration was reopened on July 13 after the DevOps team added some minor, and apparently ineffective, restrictions on creating new accounts. Disabling AUR package ad…

I'm sure the team are having a rough time with all this, but I don't understand the path you followed to go from the maintainers have not taken this action until now to "This doesn't speak well to the security headspace of the Arch maintainers". Or what "security headspace" means exactly.

Yes, lots of people thought disabling package adoption is/was a good idea. It seems quite likely that the Arch DevOps team also could have come up with that one, and they certainly wouldn't have missed all of the people telling them to do so.

It seems to me that disabling package adoption is not a desirable thing to do in general, and can only be used as a stopgap response to an emergency, which seems to be what is happening right now.

"just disable adoption" certainly can't be a long-term solution: Without adoption, the AUR will slowly fade away as orphaning a package would be permanent. Maybe the idea is to have some sort of approval process to filter adoption requests? In that case the AUR just dies instantly as that would effectively be another official repo with all of the issues that that would bring.

Re: Arch Linux disables AUR package adoption

#60

Post by einsteinx2 »

shevy-java wrote: post #32

AI is killing linux distributions now. This is another example.

This kind of hyperbole isn’t helpful.

Security concerns about supply chain attacks in the AUR (well known to be extremely insecure well before LLMs got popular) isn’t “killing” Arch let alone “killing Linux distributions”, plural.

Post reply on HN