Live data from Hacker News

Hijacking Arch Linux Packages by Repo Jacking GitHub Repositories

blog.nietaanraken.nl

Post reply on HN

Print view View original

1–3 of 3 posts

Hijacking Arch Linux Packages by Repo Jacking GitHub Repositories

#1

Post by joren485 » Mon, Apr 10, 2023, 3:40 PM UTC

Hijacking Arch Linux Packages by Repo Jacking GitHub Repositories
blog.nietaanraken.nl

Re: Hijacking Arch Linux Packages by Repo Jacking GitHub Repositories

#2

Post by 2bluesc » Mon, Apr 10, 2023, 5:48 PM UTC

Should note this only applies to AUR packages and `-git` mostly because of missing archive hashes.

AUR packages pinned to mutable tags are easiest to hijack.

Re: Hijacking Arch Linux Packages by Repo Jacking GitHub Repositories

#3

Post by _emacsomancer_ » Mon, Apr 10, 2023, 6:51 PM UTC

2bluesc wrote: post #2

Should note this only applies to AUR packages and `-git` mostly because of missing archive hashes. AUR packages pinned to mutable tags are easiest to hijack.

article notes that they "found nine vulnerable packages (in the community repository)"

Post reply on HN