448
400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers (cybersecuritynews.com)
submitted 3 months ago by to c/technology@lemmy.world
144 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 9 points 3 months ago (3 children)

I was starting to get too confident in AUR. Thankfully I wasn't affected. Just replaced all possible AUR packages to their respective Arch and Flatpak alternatives, with exception of very few or from the ones I had no option. But will definitely check before updating them, and will only install AUR packages as a last resort.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 3 points 3 months ago* (2 children)

    Have a look into the Guix package manager. It works fine on top of Arch, and Guix has 31,000 packages now. Great for cross-language development and also suitable for early sharing of projects. npm support is a bit weak though, but packages written in Python, Rust, or functional languages are well represented.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 3 months ago (1 child)

    Thats like nix packager, right? Looks interesting to layer on top. Says they are all reproducible builds which is nice.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 3 months ago* (last edited 3 months ago)

    Yes, Guix is initially a clone of Nix and has still remains of shared code (the build daemon).

    Differences:

    • Guix packages are defined in a Scheme dialect called Guile, a nice minimal functional language
    • Guix was created as a GNU project and stresses the importance of free software with strong copyleft
    • strong focus on long-term reproducibility and capability of tracking the sources
    • everything is built from source
    • very good and well organized documentation
  • permalink
  • fedilink
  • source
  • parent