Idk how the AUR works but I like that nix fetch the source from the repo and also check its hash from a maintainer provided one. Prevents repo hijacking.

Although it's still pretty much vulnerable if the attacker controls both the nix file and the repo

Wait AUR works in windows?

The developers themselves are often not the package maintainers. Before a package is published or updated in one of the official Arch repos, it has to be built, tested, and sometimes patched (which is why you see a -1, -2, etc. appended to the package version), in order to work correctly not just on its own but in an Arch system with Arch packages that it is likely to encounter. The process is not as thorough as Debian for example, but it's still the responsibility of the package maintainer. If the package is still in early development, deprecated (e.g. wine32), an out-of-tree kernel module (e.g. xpadneo-dkms), or is meant to be built from the latest available commit (any number of *-git packages), the AUR is a convenient way to share PKGBUILD files rather than have the user build the software manually based on a readme, if it even includes build instructions. The PKGBUILD is then ingested by makepkg, which both configures the environment and builds the software, and outputs a package that can then be installed and managed by Pacman.

The caveat is that packages built from the AUR are not vetted by any package maintainers. They can have bugs, they might depend on outdated or no-longer-existent packages, or might contain malware.

it makes sense to me. remove as much friction from the publishing process as possible, so you get a huge amount of packages. this incident just shows they removed a little too much.

there are so many niche packages on the aur useful to so few people that nobody would go through the official process to properly package, test, and maintain them.

for example: vscodium is a fork of vscode, but microsoft disables the marketplace for it. the vscodium-marketplace package from the aur adds it anyway. i don't think any regular repos have these kind of hacks and patches available.

Source packages are a thing.

AUR is a repository for source packages (in Arch it's called PKGBUILD) from users. You can write PKGBUILD yourself or just download it from AUR if someone already made it.

The forking option wouldn't work as well as it does on github because AUR packages are not namespaced like GitHub repos, e.g. communism/mypackage; instead it's just mypackage. So if adoption required a new name you'd have mypackage-cont, mypackage-cont-cont, or whatever. And it wouldn't really be possible to introduce username namespacing because AUR packages are just Pacman packages that are community-contributed rather than official, and Pacman, like most package managers, doesn't namespace their package names; firefox is just firefox rather than, say, mozilla/firefox. Some AUR packages get added to the official repos so when you do, e.g. yay -Syu, you'll then install the official package if you previously had the AUR package installed as it has the same name.

There isn't a perfect solution. Even if package adoptions were moderated, someone could take over a package and initially push a genuine commit, and then their next commit is malicious. Reviewing every single AUR commit would be incredibly labour-intensive. Possibly you could add automated checks for commits that suddenly add an npm install or other suspicious command with regex, but attackers could just get cleverer about avoiding those regex checks. Imo the best solution is just more widespread warnings about the fact that AUR packages are community-contributed with no guarantees of safety (e.g. on the Arch wiki where it sometimes suggests users install AUR packages), and AUR helpers forcing users to read PKGBUILDs before installation.

Every movie does that. Just how they remove helmets from bikers and armor. Gotta see the actors beautiful face after all.

shake my head rest

Be real for a second,
Did you, or did you not, manage to review a diff, and say "no, that looks fishy".

Do you really think you are immune from compromised binary AUR packages thats being downloaded straight from GitHub? Sure, now it's not only the AUR that's bad, but in the end of the day, a malicious binary did arrive at your computer.

Let's say that you don't use *-bin packages, and only download from compilable source, are you immune from the strategy that the state actor who caused CVE-2024-3094 used to compromise packages?

Not likely. Just know that AUR is user driven and not checked or vetted.

npm: Node Package Manager.
AUR: Arch User Repository.

Bazzite is based on fedora not Arch so you don't need to worry.

It's referring to those unfortunate findings

"Unstable as hell", "breaks for no reasons", "seriously insecure", other distros "work perfectly". I find this kind of uninformed hyperbole tiring, but probably entirely descriptive of your own user journey. Arch is intended for technical users, not "average users" (Whatever that means), and people should not be recommending that their uninitiated friends start their Linux journey there unless they're prepared and capable of providing technical support. I used Fedora and Ubuntu for decades before moving to Arch a few years ago, and I've never loved an OS more than I love this one. But that's my journey.

My experience is arch is more stable than ubuntu. Broke once in the last 10 years, because of a bug in a package, fixed the system with manual upgrade from live usb in 1h. AUR is not part of the archlinux repositories, it's a community thing with mostly the same security problems every similar package manager has (npm, gems, etc.)

1-1, we did not learn anything except you don't like arch.

You said Ubuntu three times. /s

AUR is supposed the last resort, after distro repos, building from source, Flatpak, and Appimage. Ubuntu's equivalent to the AUR would be PPAs.

Personally, I have fewer problems gaming on Arch than any other I've tried.

Edit: Snap is bad for software freedom. I won't touch Ubuntu anymore; if I use apt, I meant apt and not snap. Hijacking my command is Microsoft-style rug-pulling.

Arch is deliberately minimal making it a good base system in the same way Debian or Fedora is. It's smaller, simpler, updates faster than the others and is far more configurable. It is however not built for the average user and most distros built on top of it that try to make it more "usable" are IMO pretty dangerous ideas. I think the only derivative i've tried that was good was SteamOS because they made it Atomic like nix or silverblue.

None of this really has to do with the AUR. That was always labelled as "use at your own risk". And to their credit they caught and addressed the attack within a day of it happening. Still, hosting user PKGBUILDs and leaving it to individual users to audit them is not a secure solution, its just punting on the responsibility.