I do build some packages in a clean chroot environment, and even though I’m very familiar with systemd-nspawn for other reasons, I never use it to build packages. But all of that sidesteps my actual question: why can `sudo` be executed at all during the build process (not during installation) which, if I understood correctly, was the issue with the last attack, without the user being prompted for a password, and how can this be prevented?
Aside from the fact that the latest attack is also frustrating because you simply don’t want junk in PKGBUILDs, I’d like to understand whether you shouldn’t actually be suspicious during the build process, even if you’re building as a user without a container-based approach, since you should be prompted to enter a password. Or are you not prompted to do so, and if so, why, and if so, wouldn’t deleting the sudo timestamp or something else prevent this? I’d like to understand the latest attack. Fortunately, there are no PKGBUILDs in the AUR that I could look at.
