I always review the PKGBUILD file before building something from the AUR. I just make sure the source URL looks sane. What else should I be looking out for?
What it does/commands it runs (e.g. in the package() and such functions, the .install files too). If they pull in external scripts, especially from the internet. What said scripts do.
ⓘ This user is suspected of being a cat. Please report any suspicious behavior.
Specific git revision is a risk because github will give you commits from forks.
Just tracking branches is kinda normal on AUR but is also not ideal since it exposes you to upstream getting screwed more directly.
Honestly my biggest disappointment with archlinux is that they haven’t written up something about the attack vectors that were actually used. Seems really important when you are betting on individual responsibility so hard. It’s also the norm to write an incident report after a fuckup even 0.1% of that size.
Which aur helper are you using? I’ve been using yay for years, but now I’m thinking it makes it too easy to just mash Y and skip all diffs etc when updating. I’d like one that forces you to check the pkgbuild before installing something…
I always review the
PKGBUILDfile before building something from the AUR. I just make sure the source URL looks sane. What else should I be looking out for?What it does/commands it runs (e.g. in the
package()and such functions, the.installfiles too). If they pull in external scripts, especially from the internet. What said scripts do.ⓘ This user is suspected of being a cat. Please report any suspicious behavior.
Specific git revision is a risk because github will give you commits from forks.
Just tracking branches is kinda normal on AUR but is also not ideal since it exposes you to upstream getting screwed more directly.
Honestly my biggest disappointment with archlinux is that they haven’t written up something about the attack vectors that were actually used. Seems really important when you are betting on individual responsibility so hard. It’s also the norm to write an incident report after a fuckup even 0.1% of that size.
I just do
git clone "https://aur.archlinux.org/$AUR.git". Is that bad?I’m talking about the srcs used in the PKGBUILDs
Which aur helper are you using? I’ve been using
yayfor years, but now I’m thinking it makes it too easy to just mash Y and skip all diffs etc when updating. I’d like one that forces you to check the pkgbuild before installing something…I wrote my own AUR helper
It’s more likely than you think!
Paru iirc opens the pkgbuild and forces you to hit q to close/confirm.