You missed the point of the AUR and that is okay

I’ve seen a lot of news about the recent malware AUR attack, which happened three times [¹] [²] [³], but actually it’s common in AUR. A lot of people just don’t realize how AUR works in the first place, which I don’t blame them. AUR helpers treat it as extension of the extra repository, but it is just like a random script from the stranger. But is that really the Arch Linux maintainers’ fault?

Philosophy Behind Arch Linux

If you read the official documentation on Arch Linux wiki this distribution follows the KISS principle, meaning any design decision follows it. Everything about Arch Linux is about simplicity. It doesn’t have a graphical installation utility, it has packages with minimal patches, the distribution expects you to do everything manually or simpler.

AUR is about this too, you just upload the Bash script that builds the package. It doesn’t have review system, malware analysis, fully automatic installation. It just hosts user made scripts with comments and votes, which is why AUR is so stupidly powerful. It has everything available you probably need, because with little knowledge of Bash and packaging itself you can have any program packaged so easily. That’s why I really like it and most Arch Linux users too.

But here’s a catch, they are still user submitted scripts, meaning you are still trusting strangers on the internet. You either check how it installs or trusting the maintainer. Until recently when Arch was smaller everyone trusted each other. But you cannot blindly do that anymore, because scripts are still just Bash scripts, meaning it could do anything from your user account (or with root if you gave it permission so). That’s why I could blame yay, because it still doesn’t open PKGBUILD by default, which is disappointing, because authors assumed that the user might already checked the package page on AUR. But average user just rarely does that and press N when yay tells to review a diff.

Should AUR Change?

I don’t think so. When AUR is designed that way it is simple and straightforward. This simplicity allows the AUR to be so powerful in right hands, but we need to understand how it actually works. Otherwise, you accepting this malware risk that a lot of news has covered already.

This is not fault of AUR itself, because it is designed to be that way. Otherwise, you wouldn’t have such massive list of packages that AUR has.

How to Make AUR Safer for You

Short answer

JUST REVIEW PKGBUILDs

Long answer

There are many ways to prematurely avoid issues with malware. The simplest one is just check what the AUR package actually does in PKGBUILD. Many malware campaigns have targeted this file, like adding curl | bash lines or obfuscated strings or random dependencies. An ordinary PKGBUILD has the following:

1. source= is always pointing to upstream source code tarball or pulls upstream git repository
2. Checks/install/prepares all required prerequisites or applying patches using prepare()
3. Builds the program according to the building instructions on upstream in build()
4. Installs the files in correct directories using install or mv/cp command in package()

Usually when upstream building instructions are not followed from the upstream in PKGBUILD that is usually a red flag. You should check what dependencies this package tries to pull, otherwise there’s a risk that this dependency is not required and actually is malware payload.

Another stupid thing a malicious package can contain is obfuscated strings, like you can see following:

echo 'cHJpbnRmICIlc1xuIiAiWW91IGhhdmUgYmVlbiBpbmZlY3RlZCEi' | base64 -d | bash

That is usually a red flag that this package is malicious, no programs requires such actions to build a program.

The package can also contain .INSTALL file that execute commands after remove install/upgrade/remove stage, make sure to check this file too.

Handling Updates

When updating packages on your system using paru or yay you see a difference between versions. The non-malicious package only updates these values between versions:

• pkgver (if not git version)
• Checksums
• makedepends/depends updates (usually rarer)

That’s it

If something unexpected is updated, that is a signal to investigate further, because if a package suddenly adds a random command between lines that is usually a malware payload.

So please, DO NOT SKIP PKGBUILD REVIEW BETWEEN UPDATES, this is important too.

So?

With this knowledge you can treat AUR differently, because many of us were less aware of how things actually work and that is okay. I hope you can be more aware now.

If you can’t review by yourself you can always ask help or maybe even me (see About).