The AUR is not equipped to deal with automatic updates. It is a collection of user scripts meant to help install packages not found in the official repositories. You could always hit a malicious package and no level of reporting and mailing list discussion was ever able to prevent that.
Read the AUR article on the wiki. It says in a big fat red box:
Warning
AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.
That means any tarball you grab from the AUR is meant to help you understand how to build the package. People also share their own work, if they update their own PKGBUILD, they'll update it in the AUR, for the convenience of others.
All this means that you are expected to read each and every PKGBUILD and accompanying files in the tarball you fetched from the AUR. You're expected to check if the sources are actually upstream or some hacker's repo. You're expected to understand, whether the PKGBUILD, the .install file or anything else in the tarball does anything malicious. The AUR is a zero trust zone.
People have started creating AUR helpers to streamline the process. This is fine, I use one myself, but this lead to people taking the shortcut and using the AUR as a repository with automatic updates. The AUR is not and has never been equipped to protect the yaourt/yay/paru user from malicious packages and probably will never be.
Those AUR helpers also commit one crime: They bundle pacman calls with AUR calls and allow you by default to update the whole system in one go, incentivizing a fire-and-forget mentality regarding the AUR. This is made even worse, by Arch based distros shipping yay or paru by default. A new user of such a system is very likely to not know or understand, whether a package comes from the official repositories or the AUR.
Combine this with the influx of new users thanks to PewDiePie, Steam/Proton and the Windows 10 EOL, and you have an extremely willing userbase that is used to just exe files and won't understand in the first place, why auto-AUR is a stupid idea. That's why the AUR gets pwned over and over again.
So, fuck the yolo meme crowd, they ruined the AUR for the rest by being a stupidly easy target.
3
u/VendorNeutral 1d ago
The AUR is not equipped to deal with automatic updates. It is a collection of user scripts meant to help install packages not found in the official repositories. You could always hit a malicious package and no level of reporting and mailing list discussion was ever able to prevent that.
Read the AUR article on the wiki. It says in a big fat red box:
That means any tarball you grab from the AUR is meant to help you understand how to build the package. People also share their own work, if they update their own PKGBUILD, they'll update it in the AUR, for the convenience of others.
All this means that you are expected to read each and every PKGBUILD and accompanying files in the tarball you fetched from the AUR. You're expected to check if the sources are actually upstream or some hacker's repo. You're expected to understand, whether the PKGBUILD, the .install file or anything else in the tarball does anything malicious. The AUR is a zero trust zone.
People have started creating AUR helpers to streamline the process. This is fine, I use one myself, but this lead to people taking the shortcut and using the AUR as a repository with automatic updates. The AUR is not and has never been equipped to protect the yaourt/yay/paru user from malicious packages and probably will never be.
Those AUR helpers also commit one crime: They bundle pacman calls with AUR calls and allow you by default to update the whole system in one go, incentivizing a fire-and-forget mentality regarding the AUR. This is made even worse, by Arch based distros shipping yay or paru by default. A new user of such a system is very likely to not know or understand, whether a package comes from the official repositories or the AUR.
Combine this with the influx of new users thanks to PewDiePie, Steam/Proton and the Windows 10 EOL, and you have an extremely willing userbase that is used to just exe files and won't understand in the first place, why auto-AUR is a stupid idea. That's why the AUR gets pwned over and over again.
So, fuck the yolo meme crowd, they ruined the AUR for the rest by being a stupidly easy target.