4 ms·

AUR should be scanning new uploads for malware before allowing them to be published.

tempfile 3mo ago
What does "scanning for malware" mean? As far as I know this is a totally open question, and the only credible answers (install in a sandbox) are too inconvenient for widespread adoption.
- charcircuit 3mo ago
  >are too inconvenient for widespread adoption. The owners of AUR would do this for all packages they host so the inconvenience does not fall on other people. AUR has to take responsibility over the security of what they offer.
  - tempfile 2mo ago
    The inconvenience is always with the person writing the package. When you restrict the build to a sandbox, if it fails, it's because the package actually depends on the thing the sandbox is limiting (usually network requests during the build). To fix this problem, the package has to change. This is why e.g. NPM does not roll out sandboxing.
cube00 3mo ago
You can only scan for known malware. Plenty of ways to write new apps to do bad things that scanners won't detect.
- charcircuit 3mo ago
  Just because it's impossible to catch 100% that doesn't mean it is not worth doing.
gh02t 3mo ago
A complication is that AUR doesn't publish packages, it's more like FreeBSD ports in that they are the build scripts for packages and the user builds the package on their local machine. Building an AUR PKGBUILD inherently runs arbitrary code on the user machine, and that code is controlled by the maintainer of the AUR package. So you have to scan an arbitrary bash script and determine if it pulls malware, or build the package server side in a sandbox and scan it (and some AUR scripts wrap proprietary software blobs the user is supposed to provide e.g. MATLAB, which makes those impossible to build server side). It's a very big extra layer that malware deployments can hide in.
kingwill101 3mo ago
You really only upload a manifest and probably a few scripts. Most often AUR packages are just calling out to download external binaries etc

What does "scanning for malware" mean? As far as I know this is a totally open question, and the only credible answers (install in a sandbox) are too inconvenient for widespread adoption.

charcircuit 3mo ago
>are too inconvenient for widespread adoption. The owners of AUR would do this for all packages they host so the inconvenience does not fall on other people. AUR has to take responsibility over the security of what they offer.
- tempfile 2mo ago
  The inconvenience is always with the person writing the package. When you restrict the build to a sandbox, if it fails, it's because the package actually depends on the thing the sandbox is limiting (usually network requests during the build). To fix this problem, the package has to change. This is why e.g. NPM does not roll out sandboxing.

cube00 3mo ago

You can only scan for known malware. Plenty of ways to write new apps to do bad things that scanners won't detect.

charcircuit 3mo ago
Just because it's impossible to catch 100% that doesn't mean it is not worth doing.

gh02t 3mo ago

A complication is that AUR doesn't publish packages, it's more like FreeBSD ports in that they are the build scripts for packages and the user builds the package on their local machine. Building an AUR PKGBUILD inherently runs arbitrary code on the user machine, and that code is controlled by the maintainer of the AUR package. So you have to scan an arbitrary bash script and determine if it pulls malware, or build the package server side in a sandbox and scan it (and some AUR scripts wrap proprietary software blobs the user is supposed to provide e.g. MATLAB, which makes those impossible to build server side). It's a very big extra layer that malware deployments can hide in.

kingwill101 3mo ago

You really only upload a manifest and probably a few scripts. Most often AUR packages are just calling out to download external binaries etc