Ah yes, I’m sure the comment section will be normal and respectful about this…
It is in fact.
With some added “let’s introduce AI for thew workload” nonsense mixed in.
Hating Arch is performative work for memes, so nothing you will find in comment sections… 😆
when the AUR gets malware attacked for the 900th time
don’t use the aur if you can’t read a PKGBUILD
Edit: And Kids remember to always check the diff when updating
Reading PKGBUILD won’t save you if you don’t read the code or if the PKGBUILD installs a prebuilt bin. Same as Slackbuild or a third-party APT repository: you need to understand what a supply-chain attack is and do your duly work to prevent it, or stick with the consequences.
But if you read the PKGBUILD, you would see that it downloads and runs a black-box binary and should therefore not install it. It’s a little harder with PPAs I think. The build files are not so easily found.
You never ever install a -bin package from the AUR?
Rarely, but I check the PKGBUILD to see if the binary is what I expect it to be.
Yet, to quote:
But if you read the PKGBUILD, you would see that it downloads and runs a black-box binary and should therefore not install it.
And you can check the shasum of the binary to see if it actually matches that provided by the developers of the application.
A malicious PKGBUILD, which is what is being talked about, you would see that it downloads a binary that does not come from the developers and so you should not install that.
If the attack happens on the developers repo, not even Linux repository packages would be safe at that point (eg, the xz heist).
