Read it before you build it
Arch disabled AUR package adoption on 30 July 2026 and then blocked all AUR pushes on 1 August, after attackers took over orphaned packages and pushed malicious commits. It was the third supply-chain wave against the AUR since June. An AUR entry is a build recipe that runs on your machine, so the defence is to read it first.
Arch switched off all uploads to the user repository. Third malware wave since June.
A package from a distribution repository is a built artifact somebody signed. A package from the user repository is not that.
It is a recipe. A short file that says where to fetch the code and what to run to build it, and it runs on your machine, as you.
Fetch one and look at it. There is a source line, pointing at whatever address the maintainer chose. There is a checksum. And there are functions that execute during the build.
Attackers took over abandoned packages, then pushed commits into them. Adoption was disabled on the thirtieth of July, and two days later all pushes were stopped.
Nothing was broken into. The mechanism worked exactly as designed. Ownership of an abandoned recipe simply changed hands.
Read the source line and the build function before you build.
#linux#security#archlinux#supplychain#sysadmin
❯ Read the source line and the build function before you build.