Hi [email protected], I've dug around a bit, as it also looked weird from my side. Short answer: git history is the full change history of a package. The AURweb "Last updated"/"Last packager" fields are database state set only when a push happens (aurweb's save_metadata), while adoption is Maintainer-only and doesn't touch them. What i assume happened here is that a push occurred and was later removed: commits were pushed, then stripped by a history rewrite, leaving the DB date behind.
I looked at the package you named, xsp, and the pattern around its maintainer: - fennekuiper registered 2026-06-09, adopted 13 orphaned/dormant packages in two tight batches on 2026-06-12 (13:25-13:26 and 15:09 UTC, including xorg-xinit-git which is "Required by 39"), went inactive three days after registering. - All 13 show AUR Last Updated = 2026-06-12 with no git commit on that date (tips verified via ls-remote + clones, ranging 2015-2026-01). - Last Packager on several, including xsp and xorg-xinit-git, is tippfehlr, currently active TU/Package Maintainer. All PKGBUILDs and install scripts look clean to me. So per the mechanism above: the DB records a push by tippfehlr on 2026-06-12 that no longer exists in git. Current content is the pre-rewrite state (xsp itself is clean, a mono webserver; upstream mono/xsp's last commit is 2021-01-26). From the outside I can't tell whether tippfehlr's credentials performed the pushes or tippfehlr did a cleanup force-push afterward, that distinction needs AUR-side push/audit logs, which i lack. Practical takeaway for anyone auditing: "Last Updated > last git commit date" is a reliable history-rewrite indicator, and a fresh account bursting into many dormant high-visibility adoptions is worth a look even when the current tree is clean. I'll keep an eye on them and I'll add them to trustsight's watchlist ASAP, just in case. --- This also suggests three concrete aurweb improvements, since the information loss happens at well-defined seams (checked against the v6.5.1 source): 1. Adoption events should be part of a package's visible history. The original question: "a way to see the history of a package, not just the git log", exposes a real gap: adoption, disown, and merge are metadata-only operations that never touch git, so a maintainer change on any package is invisible in the only public history the AUR has. A per-package event feed (or even synthetic git notes) recording "orphan → fennekuiper on 2026-06-12" would have made this thread unnecessary. 2. An append-only push ledger. save_metadata already runs on every push and already knows the account, recording (pkgbase, account, old_tip, new_tip, timestamp) in an append-only table (or a signed log) would make history rewrites attributable instead of merely detectable. Right now the push logs are the only forensic survivor, and they force AUR security into manual archaeology for every incident of this class. 3. Handle non-fast-forward pushes deliberately. A force-push on a package repo currently rewrites the public audit trail while leaving Last Updated/Last Packager pointing at commits that no longer exist. Two options, not mutually exclusive: refuse non-FF pushes by default (rewrite requires TU/staff action), or on any rewrite, recompute or invalidate the metadata so the web view can't claim an update the history doesn't contain. Either closes the "push malicious commits, force-push them away, leave a fresh date" laundering loop. Lengthy message, but complete ig. Bests, Emiliano > Emiliano Gandini Outeda > emiliano-go[dot]com > emiliano.gandini[at]protonmail[dot]com On Sunday, October 18th, 2026 at 3:54 PM, [email protected] <[email protected]> wrote: > Hi everyone, > > is there a way to see the history of a package (as in, all the package > changes, not just the git log)? I came across packages that have been > updated this year (according to their page in the AUR web interface) but > have not had changes to their git in two years. I suspect either a) > there are changes that are not visible (i.e. maintainer changes) or b) > the package was a target in the AUR attacks and the malicious commits > have been removed, but the "updated" date stayed. To name a specific > package where I see this: xsp. > > The package and its maintainer fennekuiper might also be worth a check. > They registered three days before adopting a dozen packages, then became > inactive. >
publickey - [email protected] - 0xF759D6D4.asc
Description: application/pgp-keys
signature.asc
Description: OpenPGP digital signature
