Linux

14189 readers

547 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 3 years ago

MODERATORS

Ategon@programming.dev

anzo@programming.dev

dwraf_of_ignorance@programming.dev

AURpocalypse now: a look at the recent AUR attacks (lwn.net)

submitted 1 week ago by cm0002@lemy.lol to c/linux@programming.dev

23 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] elucubra@sopuli.xyz 1 points 1 week ago (1 children)

Cachy's new package manager, Shelly, which is awesome, BTW (writing about arch or derivatives without using BTW is against the law, remember.) does checks on AUR packages when installing or updating. Zoey rocks!

[–] ProdigalFrog@slrpnk.net 1 points 1 week ago* (last edited 1 week ago) (1 children)

Could you explain how Shelly does checks on AUR packages? I can't find where it mentions doing so on its website, and even in its documentation is says:

Enable AUR - Allows access to the AUR download features, these packages are managed by individual users so access at your own risk

How does Shelly make using the AUR safe for people who do are not able to effectively investigate the install scripts themselves?

[–] elucubra@sopuli.xyz 2 points 1 week ago (1 children)

I don't know how it's done, but here is a screencap of an update today:

[–] ProdigalFrog@slrpnk.net 1 points 1 week ago

Thanks for that! I was able to find a page that details what it checks for:

https://www.seafoam-labs.org/shelly-alpm/docs/security/

Seems like it's certainly better than nothing, but I'm unsure if the 1500 infected packages in the AUR would've been flagged by this, depending on how the malware was introduced. Even with Shelly, I probably wouldn't recommend most people use the AUR until more protections are put in place by the Arch team.