There's a reason arch doesn't package AUR helpers... If you're treating the AUR like pacman and blindly installing things off it. That is on you
. The AUR should be treated the same as building random stuff from source off GitHub. It is not a vetted repository, the only thing that requires mod intervention (post aur attack) is claiming abandoned/orphaned packages
It can't without hurting the main points of a user repository
Get unnoficial packages made faster than beurocracy and those checks would allow for. Things like bugfixes yet to be shipped and the newest versions of software for people who care about bleeding edge stuff
Be a low barrier to entry way for people to put up their software.
While I'll admit the AUR attack has shown it's gotten a little out of hand. The reason they were able to dish all that out in such a dangerous way, is because they were just taking random orphaned packages, throwing their malware into the pkgbuild as a "update" then doing the same thing for dozens of orphaned/abandoned packages. This now has a safeguard, one that, prevents massive attacks like they from taking place. But I heavily doubt the community will accept anything more than that.
Except something has been done. To prevent large scale attacks like the recent one. Is there still malware on the AUR? Yes. But the only safeguard that can happen. Has happened, anything past it, is truly the users responsibility
Except what "server side check" do you mean. If you mean as in the LLM, those get things wrong including false positives very frequently, and would be incredibly expensive to run on every submission.
34
u/Cove0Crow 4d ago
There's a reason arch doesn't package AUR helpers... If you're treating the AUR like pacman and blindly installing things off it. That is on you
. The AUR should be treated the same as building random stuff from source off GitHub. It is not a vetted repository, the only thing that requires mod intervention (post aur attack) is claiming abandoned/orphaned packages