And you can check the shasum of the binary to see if it actually matches that provided by the developers of the application.
A malicious PKGBUILD, which is what is being talked about, you would see that it downloads a binary that does not come from the developers and so you should not install that.
If the attack happens on the developers repo, not even Linux repository packages would be safe at that point (eg, the xz heist).
If the attack happens on the developers repo, not even Linux repository packages would be safe at that point
I figured this is the type of attack you were referring to, but then you say you yourself don’t really live by that safety measure.
I don’t either. I don’t have enough time, patience, or knowledge to check the source of everything I install to see if it suddenly has malware. That’s where I draw my line in the security sand. 😅
You never ever install a -bin package from the AUR?
Rarely, but I check the PKGBUILD to see if the binary is what I expect it to be.
Yet, to quote:
And you can check the shasum of the binary to see if it actually matches that provided by the developers of the application.
A malicious PKGBUILD, which is what is being talked about, you would see that it downloads a binary that does not come from the developers and so you should not install that.
If the attack happens on the developers repo, not even Linux repository packages would be safe at that point (eg, the xz heist).
I figured this is the type of attack you were referring to, but then you say you yourself don’t really live by that safety measure.
I don’t either. I don’t have enough time, patience, or knowledge to check the source of everything I install to see if it suddenly has malware. That’s where I draw my line in the security sand. 😅