I’ve been doing my updates routinely, but man, I’ll be damned if I let any of my AUR packages update yet. Ever since the last big ‘hack’ happened to the AUR, I’ve been fearing it like mad. It may only be four packages, but mmmmmm I’ve got my concerns.
I suppose I should give the full story. I have checked them a few times, and two of which had their maintainers altered. Under the recent AUR attack, I believe that’s been a requirement for malicious alterations to seep in, yet I don’t entirely know what the malicious alterations look like in code. Three of the four packages ship default with CachyOS, with the stray one being added by myself. Conveniently enough, the one I added myself is the one I trust the most and actually feel confident enough in my auditing of.
As for removing unnecessary packages, yeah that’s a fair point. Much as I like Cachy for being an easy-to-use Arch based distro, it does bring a handful of bloat with it. Suppose I’ve just been afraid I’d be removing a dependency.
If you use the usual pacman -Rns you can’t accidentally remove a dependency. Pacman will warn you about that
For the last attacks, packages just has additional commands running some JS installer. The best way of being sure is reading and understanding the full PKGBUILD and then checking the diffs. In most cases only the version and SHA sums should change on an update.
I’ve been doing my updates routinely, but man, I’ll be damned if I let any of my AUR packages update yet. Ever since the last big ‘hack’ happened to the AUR, I’ve been fearing it like mad. It may only be four packages, but mmmmmm I’ve got my concerns.
pacman -Qmto check)I suppose I should give the full story. I have checked them a few times, and two of which had their maintainers altered. Under the recent AUR attack, I believe that’s been a requirement for malicious alterations to seep in, yet I don’t entirely know what the malicious alterations look like in code. Three of the four packages ship default with CachyOS, with the stray one being added by myself. Conveniently enough, the one I added myself is the one I trust the most and actually feel confident enough in my auditing of.
As for removing unnecessary packages, yeah that’s a fair point. Much as I like Cachy for being an easy-to-use Arch based distro, it does bring a handful of bloat with it. Suppose I’ve just been afraid I’d be removing a dependency.
If you use the usual
pacman -Rnsyou can’t accidentally remove a dependency. Pacman will warn you about thatFor the last attacks, packages just has additional commands running some JS installer. The best way of being sure is reading and understanding the full PKGBUILD and then checking the diffs. In most cases only the version and SHA sums should change on an update.
some wrappers tell you if owners changed since last time