5 ms·
I care more about if maintainers actually audit the contents of packages rather than if their builds are reproducible (though the latter still matters)! Not ju
by Bnshsysjab 6y ago
I care more about if maintainers actually audit the contents of packages rather than if their builds are reproducible (though the latter still matters)!
Not just is there obvious malware, but also are there obvious vulnerabilities, is the person that wrote it of good nature / located in a country where they’re safe from nation state pressure, is there a lot of history behind the app.
Obviously this is too much work for any individual and requires a chain of trust. I believe fedora and Ubuntu at the very least audit to some extent but I’ve never seen any doco.
- andr0x 6y agoJust curious, are you saying there is obvious malware within the Arch official repositories? Are you referring to instead the user repositories (AUR)? I know Arch has: https://wiki.archlinux.org/index.php/Arch_Security_Team https://wiki.archlinux.org/index.php/Arch_Security_Team but I'd be really interested to hear that the official packages have obvious malware.
- saghm 6y agoI think they intended the phrase as a question; they're proposing that a maintainer should not just ask "is there obvious malware in this package?", but also several other questions (which they list afterwards).
- Bnshsysjab 6y agoThis is the correct interpret
- karlding 6y agoIsn't this chain of trust essentially what crev [0] tries to do? FWIW Rust implements cargo-crev [1], but I suppose you could extend this to AUR packages with a bit of work. [0] https://github.com/crev-dev/crev/ https://github.com/crev-dev/crev/ [1] https://github.com/crev-dev/cargo-crev https://github.com/crev-dev/cargo-crev