News for hackers. Stuff that matters.

A comment on Arch Linux disables AUR package adoption. Parent comment

Re:Arch Linux disables AUR package adoption by thayne on Friday July 31, 2026 @04:05PM (#49127967)
Most AUR "helpers" show you the PKGBUILD and/or a diff thereof and ask you to confirm that it looks ok before continuing the install. At least by default.

Maybe most users just ignore that and always answer yes without inspecting it. I don't know. But the wiki for the AUR and Readmes for many of these tools have warning banners telling you not to blindly trust AUR packages.

[ Parent | on HN ]
Re:Arch Linux disables AUR package adoption by charcircuit on Friday July 31, 2026 @04:29PM (#49128194)
There are subtle things like abusing how github handles forks which can make malicious PKGBUILD a matter of just changing the rev with no hint in the file itself.
[ Parent | on HN ]
Re:Arch Linux disables AUR package adoption by thayne on Friday July 31, 2026 @07:12PM (#49129542)
Perhaps, but it would be pretty unusual to use a commit/hash id instead of a version tag, or the main development branch.
[ Parent | on HN ]