Re:Running an independent Arch Linux rebuilder
by andr0x on Tuesday April 21, 2020 @06:49PM
(#22940149)
Just curious, are you saying there is obvious malware within the Arch official repositories? Are you referring to instead the user repositories (AUR)?
I know Arch has: https://wiki.archlinux.org/index.php/Arch_Security_Team
but I'd be really interested to hear that the official packages have obvious malware.
Re:Running an independent Arch Linux rebuilder
by saghm on Tuesday April 21, 2020 @07:39PM
(#22940484)
I think they intended the phrase as a question; they're proposing that a maintainer should not just ask "is there obvious malware in this package?", but also several other questions (which they list afterwards).
Re:Running an independent Arch Linux rebuilder
by Bnshsysjab on Wednesday April 22, 2020 @04:16AM
(#22943341)
This is the correct interpret
Re:Running an independent Arch Linux rebuilder
by karlding on Tuesday April 21, 2020 @08:48PM
(#22940907)
Isn't this chain of trust essentially what crev [0] tries to do? FWIW Rust implements cargo-crev [1], but I suppose you could extend this to AUR packages with a bit of work.
Not just is there obvious malware, but also are there obvious vulnerabilities, is the person that wrote it of good nature / located in a country where they’re safe from nation state pressure, is there a lot of history behind the app.
Obviously this is too much work for any individual and requires a chain of trust. I believe fedora and Ubuntu at the very least audit to some extent but I’ve never seen any doco.