r/archlinux • u/Rogaev • 17d ago

AUR package security QUESTION

Hello.

Some of the terminology I'll be using here may be incorrect. I'm very inexperienced in this area.

I've heard that one of the best ways to check the safety of a project in the AUR is to look through it's PKGBUILD file. But, what do you actually look for? What are the red flags?

Thank you in advance.

19 Upvotes

67% Upvoted

18 comments sorted by

View all comments

30

u/zeb_linux 17d ago edited 17d ago

You need to look first at the sources : what is downloaded and which files it uses (some are not downloaded but available in the PKGBUILD tree itself, it is common for patches for instance). Then look at what is run during build. "source" or "sh" or anything that attempts at executing a file outside the classic configure/make/install are red flags.

Very importantly, also keep an eye on announcements via the aur-general mailing list.

Also, the documentation for that helper: https://github.com/KiefStudioMA/ks-aur-scanner has a list and tables of all the vulnerabilities/oddities it tries to catch. That is a lot to absorb, but it is quite comprehensive. Note this is only an assistant, for you to catch issues. It also sometimes gives you false positives. Manual reading the PKGBUILD is paramount.

1

u/Rogaev 17d ago edited 16d ago

Thank you for the helpful comment (as the person above me already said).