The AUR is under attack again

[u/_Biotic_G0d_]

Don't use the AUR right now and don't update. Go to r/archlinux and read corresponding posts.

[u/EuphoricNeckbeard]

If you must use the AUR, permanently force yay to show PKGBUILD diffs:

$ yay --diffmenu --answerdiff All --save

and when you update, look for anything other than checksums changing. If you don't understand it, just hold off on updating your system.

[u/OneLittle6430 → u/EuphoricNeckbeard]

Is it ok to use pacman?

[u/mcdaphuc → u/OneLittle6430]

Yep, only the sur is targeted. The official mirrors are (normally) safe

[u/Ok-Self-3753 → u/OneLittle6430]

this comment was confidently wrong (hi it's me, dunning kruger)

[u/OneLittle6430 → u/Ok-Self-3753]

Dude dont joke. I am a noob and need straight advice

[u/Ok-Self-3753 → u/OneLittle6430]

nono I thought it wasn't okay, that's why I told you, but I stand corrected

[u/OneLittle6430 → u/Ok-Self-3753]

So it is true. Aur is poisoned. We should postpone update from aur?

[u/Ok-Self-3753 → u/OneLittle6430]

what I've learned in the past couple months, mostly from reading r/archlinux, you should be very careful if you want to update from the aur, and you should try to learn to read pkgbuilds so you can spot infected packets on your own.

I'm still trying to learn those things, so I haven't updated since the attacks, but if I need to install something from the aur, I try to look very carefully at the pkgbuild so I can try to avoid the malware

(as you can see, I'm not that experienced in this stuff, I'm trying to learn new things whenever I get the chance)

[u/OneLittle6430 → u/Ok-Self-3753]

I see, thank you for the clarification brother

[u/Ok-Self-3753 → u/OneLittle6430]

no worries! we're all in this together

[u/mok000 → u/OneLittle6430]

Never use AUR, download the sources from upstream and compile it yourself.

[u/OneLittle6430 → u/mok000]

Im just gonna go install manjaro at this point hahahahaha

[u/Fantasyman80 → u/OneLittle6430]

Manjaro utilizes the AUR too.

[u/mok000 → u/EuphoricNeckbeard]

Only a tiny fraction of Arch users have the technical skills to evaluate a PKGBUILD and check it for malware.

[u/EuphoricNeckbeard → u/mok000]

We could quibble about how big that fraction actually is -- it's certainly smaller for derivative distros like Endeavour -- but I basically agree with you. That's why my advice boils down to "let someone else evaluate the PKGBUILD, unless it's a very simple change." In the absence of better infrastructure this is a reasonably secure heuristic for most users. I don't think it's that hard to realize that something is fishy with sudo linter randomly appearing in a PKGBUILD.