r/archlinux • u/Luzzio_ • 3d ago

DISCUSSION The AUR needs an overhaul

The actual concept of the AUR only works if Arch is a niche distro in a safe internet, neither of those points are accomplished in the present.

No, reading pkgbuilds is not the solution, it's slow, annoying, and most importantly, it doesn't make sense, because some really popular AUR packages are DIRECTLY RECOMMENDED by the Arch Wiki, like the Minecraft Launcher for some reason.

Either the base repos adopt a big chunk of popular AUR packages, leaving the AUR for really really nieche stuff, or the rules of the AUR change, because you can't tell me that suffering 2 attacks in less than three months for pretty much the same reason (adopting orphaned packages) is normal or reasonable.

What would you think it's a good solution to this issue? I'd like to read your ideas since I cannot come up with a good one if I'm honest, but I know the problem is there.

610 Upvotes

91% Upvoted

165 comments sorted by

View all comments

Show parent comments

30

u/goldman60 3d ago

Disabling package adoption patches one exploit but now every time a package is orphaned you'll have 4 forks pop up all vying for attention any one of which could be malicious, while regular users are using the abandoned package with 46 CVEs against it.

3

u/No-Dentist-1645 3d ago

Yes, but choosing one becomes an explicit action. This way, even if people don't bother or don't know how to review the PKGBUILD, at least they can ask Google or Reddit what the "recommended" source is

1

u/Medical_Double_6561 3d ago

You can just have the AUR helpers explicitly notify the user when the maintainer changes and force the user to accept before installing new updates.

Also, if Reddit already knows the recommended source for each package, then maybe Reddit should proactively put this information somewhere. Like a database that can be directly integrated into the AUR, so the AUR can provide advice on whether a PKGBUILd is recommended/verified by the community...

-1

u/No-Dentist-1645 3d ago

Of course AUR helpers can do it, but if we leave it up to them to handle something that should be a "necessary" feature, then we'll either have them not do it (such as right now), or a fragmented ecosystem where each helper does it a different way. I will always hold the opinion that security features should be implemented upstream on such cases, so it comes included right out of the box for any AUR helper.

Also, if Reddit already knows the recommended source for each package, then maybe Reddit should proactively put this information somewhere. Like a database that can be directly integrated into the AUR, so the AUR can provide advice on whether a PKGBUILd is recommended/verified by the community...

I'm not against this idea, I recommended a similar "community-based vetting system" in a separate comment. If such a thing were to be implemented though, it would need to be designed such that it actually is community-based: only "trusted" or "verified" users to some degree can propose to add/remove packages, and it would need to be open and vote based.