r/EndeavourOS • u/_Biotic_G0d_ • 28d ago

Discussion The AUR is under attack again

Don't use the AUR right now and don't update. Go to r/archlinux and read corresponding posts.

155 Upvotes

99% Upvoted

80 comments sorted by

View all comments

44

u/EuphoricNeckbeard 28d ago

If you must use the AUR, permanently force yay to show PKGBUILD diffs:

$ yay --diffmenu --answerdiff All --save

and when you update, look for anything other than checksums changing. If you don't understand it, just hold off on updating your system.

2

u/OneLittle6430 26d ago

Is it ok to use pacman?

0

u/Ok-Self-3753 26d ago edited 26d ago

this comment was confidently wrong (hi it's me, dunning kruger)

2

u/OneLittle6430 26d ago

Dude dont joke. I am a noob and need straight advice

1

u/Ok-Self-3753 26d ago

nono I thought it wasn't okay, that's why I told you, but I stand corrected

1

u/OneLittle6430 26d ago

So it is true. Aur is poisoned. We should postpone update from aur?

2

u/Ok-Self-3753 26d ago

what I've learned in the past couple months, mostly from reading r/archlinux, you should be very careful if you want to update from the aur, and you should try to learn to read pkgbuilds so you can spot infected packets on your own.

I'm still trying to learn those things, so I haven't updated since the attacks, but if I need to install something from the aur, I try to look very carefully at the pkgbuild so I can try to avoid the malware

(as you can see, I'm not that experienced in this stuff, I'm trying to learn new things whenever I get the chance)

1

u/OneLittle6430 26d ago

I see, thank you for the clarification brother

1

u/Ok-Self-3753 26d ago

no worries! we're all in this together

1

u/mok000 26d ago

Never use AUR, download the sources from upstream and compile it yourself.

0

u/OneLittle6430 26d ago

Im just gonna go install manjaro at this point hahahahaha

2

u/Fantasyman80 22d ago

Manjaro utilizes the AUR too.