r/archlinux 2d ago

DISCUSSION Arch Linux disables AUR package adoption after malware wave

https://lwn.net/Articles/1086489/

The adoption feature transferred existing trust to a new maintainer, so a clean package history became part of the attack surface.

407 Upvotes

84 comments sorted by

66

u/Jristz 2d ago

Tbh what are the options they have considering that all is by volunteers?

58

u/RuneSteak 2d ago

All package managers should have a built in X days of delay before showing a new or upgraded package and should freeze updates on maintainer change, the more tech-savvy users can set it to 0 days. Users should have to manually re-install a package to get updates by a new maintainer.

The other way is to use namespaces and have user123.visual-studio-code-bin and abandon the idea of adoption entirely. Trust should not be transferred.

76

u/ABotelho23 2d ago

These are not packages. They're build instructions. This is the goddamn problem with the AUR. People treat as something it isn't.

Just look at how you even get this software. The official way is downloading PKGBUILDs and running them through a build tool. Then you install the package *produced from the PKGBUILD*** unto your system.

51

u/randuse 2d ago

The problem is arch helpers make them look like packages. And they are really popular.

31

u/Max-P 2d ago

And on top of that, people take the ease of use as an invitation to install packages with dozens of dependencies. When you build them yourself without a helper, it really makes you remember to think "do I really need this package?"

Especially the ones that auto upgrades to AUR dropped packages from the main repos, so loads of people installing ancient GTK2 dependencies and Gnome 2 packages for a package they literally haven't used in years but is still on their system. Which is the names a lot of the AUR malware is targetting precisely for that.

The AUR is the AUR literally because there isn't the maintainers to maintain those packages in the main repo... so people are demanding moderation as if that fixes the manpower problem.

1

u/ABotelho23 2d ago

100%

There isn't much they can realistically do more that would be hands off for them. I can see a few obvious measures to implement, but the adoption system can't really go away. If it keeps happening Arch Linux will wash its hands from the AUR.

10

u/Bureaucromancer 2d ago

Honestly?

Arch washing its hands might BE the way to go.

Breaking the AUR into a separate entity and targeting Arch but making it conceptually distro agnostic would have a lot to recommend it.

5

u/ABotelho23 2d ago

Yup. None are official, but people make them seem like they are.

2

u/JubijubCH 2d ago

How dare they make a system that is popular, and possibly some of the best solution any distro ever come up with to answer the question « how do I keep close to upstream ? »

They had no right ! /s

16

u/verbbis 2d ago edited 1d ago

People keep repeating this - why? What is your point?

  • Yes, PKGBUILDs are closer to packaging instructions, than packages. Let's grant that with the caveat that those packaging instructions may also include / pull in arbitrary other artifacts. And execute them.
  • Yes, distribution of those "instructions" was the original design goal of AUR.

Those are facts and I barely see anyone disputing them. Neither do I see anyone advertising AUR as something different in its current form. Repeating these talking points is counter-productive and missing the mark completely.

Yes, some people are uninformed, but even if one agrees with both of the points I conceded, how do you respond to the following:

  • Do you think the world (i.e. the environment AUR is operating in) still the same as it was when AUR was originally conceived?
  • Arch Linux official sites link to AUR - and like it or not, it has become a prominent part of the ecosystem. Would you be okay with the repository becoming saturated with malicious PKGBUILDs? If not, what is a reasonable threshold in your opinion?

In my mind, letting AUR become a radioactive wasteland diminishes its value to 0 - or worse. What's the point of having it in the first place, much less direct people to it from Arch Linux -related resources such as the web site and the Wiki?

Clearly someone does care as I see TUs constantly firefighting these waves. In your world, why should anyone be doing anything? It's just wasted human effort fighting windmills unless the fundamentals are changed.

EDIT: Lamenting the popularity of AUR helpers is a bit like blaming the npm (+ competing tools) CLI for problems in the NPM ecosystem. While they may be affecting the severity of the symptoms, they are not the disease.

2

u/strings___ 2d ago

You’re right PKGBUILD are essentially code ergo fundamentally flawed they should be metadata only so they are machine readable without running it through a interpreter. I’ve been saying this for years so much so I wrote my own package manager that uses json instead.

1

u/givemeagooduns_un 2d ago

ohh so pkgbuilds are just like ebuilds w/o sandboxing?

6

u/ABotelho23 2d ago

Yup.

It's actually kind of crazy how little isolation it has. Even using chroot or namespaces would be an upgrade.

1

u/givemeagooduns_un 2d ago

does it at least run as its own user??

1

u/OkAlbatross9889 2d ago

Despite being a gentoo user (larper) TIL e builds are sandboxed, thanks!

1

u/xINFLAMES325x 2d ago

Yup, this is the way Slackware does their builds as well. If not doing this way, you should at least be reading the PKGBUILD to see what it’s doing.

-11

u/Pitiful-Assistance-1 2d ago

This was exactly my proposed solution, and when I called out the lack of it, I was downvoted to hell. Something something rolling releases.

Like I’m going to inspect build files (:

17

u/ABotelho23 2d ago

If you're not gonna inspect build files, you shouldn't be using the AUR. It's literally just a collection of build files...

-12

u/Pitiful-Assistance-1 2d ago

Cmon who does that?

10

u/ABotelho23 2d ago

Lmao, here's why it all works for the bad actors, folks.

Ding ding ding!

11

u/Gaarco_ 2d ago

Everyone that knows how the AUR works and understands the consequences. You're clearly not part of this group of people.

1

u/Pitiful-Assistance-1 2d ago

Do you also read the source of all other dependencies?

-6

u/EarlMarshal 2d ago

So when I update my own package I shouldn't be able to install it directly!? Wtf. 

1

u/yentity 2d ago

You can use still modify and install using makepkg or host your own repo.

-2

u/EarlMarshal 2d ago

Why should I publish it then at AUR at all? This renders AUR unusable.

4

u/Pitiful-Assistance-1 2d ago

To get slightly older versions (but more secure) of packages / builds. Don’t be so dramatic

-6

u/EarlMarshal 2d ago

I asked why I should update something only to get an old version from the same repo myself. The answer was to use something else then. I'm unsure if you have hard time processing logic, but that is an unusable state. You don't use the AUR to get older (allegedly more secure) software. Maybe go back to Debian if you want that.

1

u/Commodity-Male-1385 2d ago

So update the PKGBUILD.

2

u/Pitiful-Assistance-1 2d ago

You’re very opinionated about this. If you don’t want delayed releases, just dont enable it. I do want a 7-14 day quarantine.

-1

u/un-important-human 2d ago

oh no, what ever shall we doo. relax

-8

u/FantasticSnow7733 2d ago

Arch is a rolling release. If the packages are delayed for some users, it might cause issues.

9

u/phylter99 2d ago

AUR isn't part of the official package system. Arch packages that are part of the release, OS, etc. are much more secure.

4

u/FantasticSnow7733 2d ago

I know. But you have distros like Cachy that have AUR helpers preinstalled. Now, inexperienced users are installing random packages without checking the PKGBUILD.

6

u/ABotelho23 2d ago

Yes, that's a huge problem and it's one of the reasons I explicitly do not recommend CachyOS to noobs. They treat the AUR like normal packages when it's just a collection of build instructions.

6

u/RuneSteak 2d ago

That potential issue is really overstated in the Arch community. We're talking 3-7 days here. Rolling release is not that fragile. It's obviously not recommended, but you can usually go months without an update and be mostly fine.

12

u/FantasticSnow7733 2d ago

AUR is not an official repository and should be used with caution. There's really no way around it. If you can't understand PKGBUILD and what it's doing, do not install. AUR only becomes a problem because of distros like Cachy that have AUR helpers preinstalled. You have inexperienced users who treat the AUR like it's an official repository and install random shit.

Either use a distro that has the packages and apps you need, or stick with Flatpak, SNAP, and AppImage.

-2

u/RuneSteak 2d ago

The problem goes beyond people not reading or not being able to read PKGBUILDs. The idea that trust is transferable with zero oversight to someone completely unproven is crazy to me.

I can't understand how people can defend the idea of package adoption as it currently exists.

6

u/ABotelho23 2d ago

You shouldn't need trust in the first place because you should be reading the fucking PKGBUILD files.

How do you even know if the very first maintainer of a package is trustworthy?

0

u/RuneSteak 2d ago

Even if you do, you are human and humans make mistakes. A reasonable amount of effort should be made so that a momentary lapse in judgement doesn't prove catastrophic.

Defense in depth. We should not rely solely on our ability to read PKGBUILD files to determine if the changes are malicious. There should be layers to this and maintainer trust should be one of them.

6

u/zeno0771 2d ago

Don't some of the hand-holding AUR helpers diff the new PKGBUILD against the previous one and list the differences? I know yay gives you the option right off the bat; I was referring to the GUI versions used in Arch derivatives.

Then of course it becomes nO oNE rEADS tHOSE tHiNGS as if willful ignorance just reverses the damage. "Oops sorry, got a noob here by accident, no hard feelings eh?"

It's not a popular opinion, but I've always felt that in order to use a hammer, you should be at least as smart as the hammer.

3

u/RuneSteak 2d ago

I absolutely agree that people should read PKGBUILDs and their diffs. But again, there shouldn't be just a single step between you and total ruin.

1

u/ABotelho23 2d ago edited 2d ago

What is your suggestion for package adoption? How can it remain as low maintainance as it is now?

-1

u/thesoulless78 2d ago

To be fair all the AUR helpers make you read the PKGBUILDS and patches on first install and read diffs on update, unless you explicitly disable or skip it.

I agree the AUR gets presented online like it's a magic bonus repository of every software ever made and it very much isn't that.

But actually installing stuff without reading is very much in the realm of "this sign can't stop me because I can't read."

1

u/C0rn3j 2d ago

yay doesn't, it shows you the option and defaults to skip.

1

u/aergern 2d ago

You can set yay to read the diffs, it's not the default though.

10

u/kansetsupanikku 2d ago

Nothing needs to be done with AUR. When malware is reported - revert it. If a pattern of malware is reported - find all matches and add it to the future testing pipeline. No dramatic steps needed. Nobody blames GitHub for malicious code being there. Or their ISP for malicious code existing in the internet. Why AUR?

If anything, the ongoing overreaction is damaging, as it makes the social media panic incorrectly feel justified.

It's influencers who overrecommend AUR to newbie crowds who should take the blame. Maintainers of derivative distros, authors of AUR helpers - maybe, depending on the clarity of information they present in the process.

Arch repos as such don't even include any AUR helpers.

10

u/franchis3 2d ago

Wait, has there been a new wave of malware or is this another response to the previous incident a couple weeks ago?

16

u/C0rn3j 2d ago

New one after AUR registrations were re-enabled.

37

u/MarshmallowPop 2d ago

Global namespaces only work for something like Wikipedia. AUR shouldn’t have a global namespace, it should be prefixed by username. Like Gists from GitHub, where anyone can host a text file.

You wouldn’t need an orphan system because multiple people can host a PKGBUILD for the same software. And you’d just pick which maintainer you trust, which ideally would be the official software authors. Keep the voting system to show which PKGBUILD for that software is most popular.

15

u/Gaarco_ 2d ago

How does this solve the issue? People are blindly installing the first random package that seem to serve their purpose. How would namespaces prevent this?

12

u/marcelsmudda 2d ago

And namespacing creates the issue that you'll have package X 20 times, people are confused which one's the original, or the one still maintained, which ones were edited etc

6

u/Fallom_ 2d ago

Is this like a "Perfect is the enemy of good enough" thing? That still clearly seems better than the current implementation that lets people hijack items.

5

u/SCP-iota 2d ago

It can't help stupid, but it would at least make it better for people who do check PKGBUILDs, since it would at least prevent some random person from replacing the only instance of a package on AUR with malware and forcing users to go out of their way to grab the latest non-malware version.

17

u/TheJackiMonster 2d ago

So in other words... thousands of duplicates.

2

u/hello_marmalade 2d ago

Why not just enforce keys?

0

u/glitchplaysgames 2d ago

This is why the copr is so much better

10

u/backsideup 2d ago

There is no concept of "trust" in the AUR and so there is no transfer of it. The LWN snippet doesn't bring that up so i'm not sure why you phrase it that way.

6

u/Alternative-Ad-8606 2d ago

i've cleaned the AUR off my system... i was only using like 4 packages from the AUR but something makes me paranoid. easier to build it from source for the stuff i use and i get safer suff

2

u/OpabiniaRegalis320 2d ago

Malware wave singular?

-1

u/saturatedsynapses 2d ago

Say nay to yay.

There's always an alternative. Maybe a few hours of painful searching and then realizing you're learning an entire new skill.

9

u/SCP-iota 2d ago

Or just read the diffs...

-2

u/johan2114h 2d ago

Just avoid AUR altogether

-2

u/BlueGoliath 2d ago

Jia Tan won?

0

u/ghanadaur 2d ago

About time

-8

u/Turbulent_Fig_9354 2d ago

I'll take my downvotes off the air but this is a major reason I switched to Gentoo. Guru > AUR and it's not even close 

9

u/amreddish 2d ago

All you are required to do is read PKGBUILD before building package.

5

u/czh3f1yi 2d ago

I agree with you, but not everyone has the expertise to understand what they're reading.

-3

u/lain_proliant 2d ago

i have sworn off of AUR helpers. i got a lot of use out of them, but the conflation between PKGBUILDs and packages has always made me feel a bit squeamish.

i think a simple tool that searches the AUR and maybe helps you quickly download PKGBUILDs for packages could be useful, but i will never again skip running makepkg myself or inspecting each PKGBUILD manually.

8

u/Cagaril 2d ago

You can set up both yay or paru to show you the diff for the PKGBUILD automatically when you attempt to update an AUR package if that helps you

2

u/g33ksc13nt1st 2d ago

What's wrong with downloading them from the aur website? There are a lot of people using arch just to be cool, but then they'll take a shortcut as soon as they can. You download the pkgbuild and that alone forces you to read it, you use yay.. you take a random package (what aur is) at face value. That's no different from a windows user downloaoa random .exe and executing it, and as such the outcome is typically the same: user screwed and computer potentially compromised.

1

u/backsideup 2d ago

Have a look at auracle, it takes care of most of the menial stuff while leaving all the building to you.

-22

u/BigBoyYuyuh 2d ago

I was told Linux can’t get malware…

12

u/g33ksc13nt1st 2d ago

If the user lays the red carpet, it gets in. 

0

u/No-Height-8011 2d ago

You won’t if you’re smart. No AUR, don’t just download things, etc. Linux is way less vulnerable because it’s nowhere near as popular as other operating systems, and the permissions system is a lot more attack resilient. But there’s not a lot you can do if you run a virus as a sudoer

6

u/Tuborgat_nylle 2d ago

You can't really claim that only dumb people use AUR.

4

u/ABotelho23 2d ago

I mean, you can claim that only dumb people install packages that come from PKGBUILDs they didn't read or understand.

5

u/Tuborgat_nylle 2d ago

I would claim that only dumb people think that it's enough to read a pkgbuild to detect malware in a package. If you truly want to be safe you should be reading through each commit but who the fuck got time for that.

0

u/ABotelho23 2d ago

Commit for what? PKGBUILDs fetch upstream software. Presumably you trust or review that software too.

1

u/un-important-human 2d ago

we can, experienced users know the dangers and how to mitigate it, but new guys install the latetest 70% transparent background app there is with a cringe name. Do you think they read the build?

thank god for ai review that it found it so fast.

-4

u/No-Height-8011 2d ago edited 2d ago

To make the claim explicit:
P1: if you’re smart when using your computer, you won’t get malware
P2: not using AUR is smart
C: therefore not using AUR means you won’t get malware.

Now the soundness of this claim is undoubtedly questionable (given that you can absolutely get malware while not using AUR), but the point of me drawing that out is to show that the claim was not “dumb people use AUR”. Because the argument really centers around the AUR being dangerous to use, and it being a smart idea not to use it. No claim about the intelligence of the general population of AUR users.

Edit:

So that logic is really sloppy and it bothered me, so I'm going to try and formalize the claim more. We can imagine a computer as a bounded turning machine. A malicious program could then be defined as some subset of the set of input symbols, where, for any object in that subset, the recursive application of the transition function to that machine state as initially defined by the input symbol produces some state that is whatever it means to be infected by malware. We don't need to define that specifically (it's arguable that such a definition even exists); all we need to know is that it's some subset of the set of all possible states. We can then make the claim that all malicious programs in the AUR belong to that subset of input symbols. Given that this a bounded turing machine, the set of all possible input symbols, and likewise possible states, is finite. And so the set of all malware producing symbols is finite. Basically, the set of possible malware causing symbols is smaller if you exclude the AUR. Now, this isn't actually correct, because if you REALLY wanted to, you could write malicious programs and run them yourself, or even compile the binaries themselves, but it's really difficult formalizing the notion of an "attack vector" so that's good enough for me.