Am 01.08.26 um 20:02 schrieb Ralf Mardorf:
Hi,
if I understand correctly, during the recent attack on the AUR,
PKGBUILDs were manipulated in such a way that they executed a malicious
programme via sudo during the build process.
If that is the case, couldn’t we protect ourselves by using an alias in
the form of
sudo -k && makepkg
to prevent sudo from being executed automatically during the build?
Provided, of course, that a timestamp is set to require a password.
I’ve also posted my request on the AUR general list. However, I don’t
think it can do any harm to raise this issue on this list as well.
Have I missed something?
Regards,
Ralf
I think, building as a user directly is something that should be
severely discouraged and building inside a clean chroot should be the
preferred method.
Unfortunately, while this is - from a system side - rather easy nowadays
using `systemd-nspawn`, this is currently not clearly documented (only
in [1], and there is just a small link from [2]). I also have to admit:
I would not know how to do this manually as I rely on `aurutils` [3] to
handle this for me.
- René
[1]
https://wiki.archlinux.org/title/DeveloperWiki:Building_in_a_clean_chroot
[2] https://wiki.archlinux.org/title/Makepkg
[3] https://github.com/aurutils/aurutils
