Transcript

Image of a man pointing a gun at his own foot.

Caption: Installing an AUR package without reading it’s PKGBUILD.

    • Jesus_666@lemmy.world
      link
      fedilink
      English
      arrow-up
      23
      ·
      13 hours ago

      If you want a bunch of stuff that’s not in core or extra and you don’t want to intensely babysit the AUR, you could try Chaotic-AUR. It hosts prebuilt packages for a bunch of AUR packages which are actively maintained by the Chaotic team.

      I consider it to be more secure than the AUR proper since they actually care for their packages and review nontrivial changes. For instance, the recent takeover attacks didn’t hit Chaotic-AUR builds since the changed packages didn’t make it past the review.

      It’s still an unofficial third-party repository and closer to the AUR than to extra but I consider it a major step up.

    • Azzu@leminal.space
      link
      fedilink
      arrow-up
      15
      ·
      edit-2
      14 hours ago

      I mean how often do you install AUR packages? Usually takes like a minute or so to skim through PKGbuild and the pkg comments and look for obvious issues. And most updates are just a sha hash and version change, taking like 5s to check.

      • NaibofTabr@infosec.pub
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 hours ago

        Rarely, to be sure. I tried Arch for a bit, but I need a computer that I can actually use to get shit done, that isn’t a constant project itself. Even Qubes doesn’t require as much effort to keep operational.

      • HereIAm@lemmy.world
        link
        fedilink
        arrow-up
        8
        ·
        11 hours ago

        But wasn’t the latest AUR attack from a dependancy in the pkgbuild? Going out of your way to review all the dependencies as well is not really possible by just skimming through the script.

      • Baŝto@discuss.tchncs.de
        link
        fedilink
        English
        arrow-up
        5
        ·
        edit-2
        12 hours ago

        I need a better wrapper that shows me diffs since last build. I’m too lazy for this

        Also pulling in release messages from git etc would be nice