Re: Ideas for moderating malicious AUR packages

[Aaron Liu]

Oops, I sent this before explaining why I don't like the adoption queue. I don't like it because I feel like it gives too little information for meaningful action. Adoption is before PKGBUILD changes can be made; all PMs would see is the account name and the package that's attempted to be adopted.

--
Cheers,
Aᴀʀᴏɴ

It could work if it pretended to the adopter that they've adopted it and flagged commits for review for a month. That would also be quite easy to work around (just wait a month after adopting, which would also be harder to spot than new accounts pushing commits), though.

OpenPGP_0xCBC3973CD9FC6A16.asc
Description: OpenPGP public key

OpenPGP_signature.asc
Description: OpenPGP digital signature