On Mon, 3 Aug 2026 at 13:06, Ralf Mardorf <[email protected]> wrote:
> On Mon, 2026-08-03 at 20:02 +1000, Sam K wrote: > > Many people have sudo configured with NOPASSWD, meaning a password is > > not prompted for. I assume this attack is targeting people with that > > configuration. > > > > Sam > > There is a well-established principle in computer security: once someone has access to your machine, the security boundary has effectively been breached and assumptions about safety become unreliable. In that context, downloading and running a PKGBUILD without first reviewing its contents is a significant security risk. A PKGBUILD contains executable build instructions, not merely package metadata, and blindly trusting one is effectively granting permission for arbitrary commands to run on your system. Reviewing the contents before execution is a simple but important step in maintaining control over the software that runs on your machine. HOWEVER I do agree on the whole that calls to sudo or other ways of bypassing the build environment should be caught/highlighted by the makepkg
