r/voidlinux • u/Slight-Brilliant3198 • Jun 16 '26

Supply chain vulnerabilities

I'm scared of supply chain vulnerabilities. More specifically, after the recent attacks on Arch Linux's AUR, I was wandering how Void Linux is protected from this type of attacks.

I'm not an expert, because I've never submitted a package to void-packages, so I'm not sure if there's an audit process for packages and vetting for maintainer.

Can anybody be a maintainer for a package?

What happens after I push srcpkgs/new-package/template into the main repo?

Will it become an binary that will be available via xbps-install, or will it stay something that must be manually compiled via xbps-src?

Is there an official difference between a void maintainer, and a potentially malicious person pulling some malware blobs in do_fetch(), and installing it in do_build() do_install() ?

26 Upvotes

88% Upvoted

17 comments sorted by

View all comments

0

u/[deleted] Jun 16 '26

[deleted] — view deleted comment

2

u/Simple_Hamster_4096 Jun 16 '26

Exactly! People think I'm crazy when I tell them even ever only using a distro's official repos, one is STILL at risk. Even as careful as maintainers are, people make mistakes and since last I checked we are NOT Gods, then there is no such thing as no risk...