On 10/24/26 6:02 PM, Sam K wrote:
Hello,
Ever since AUR registrations were closed, we have been receiving a large
number of requests to create a package for someone on the AUR.
This isn't a huge hassle, and usually someone does it if the software is
decent enough, but doing so might encourage more off-topic emails.
I would like to ask the list if it makes sense to continue accomodating
these sorts of requests, or if they should be asked to wait until the
list reopens and then do it themselves.
Open to discussion
Sam
Never forget, the xz backdoor was pushed very hard by an eager developer
who appeared, for all purposes, to want to help with the project.
I'm not casting any aspersions on the current folks wanting to get
packages into AUR, but I do want to lend support the AUR moderators
decision to take a no-exemption approach to AUR closure until they are
satisfied they have a process in place that will allow it to reopen safely.
Social engineering a way into AUR is a viable way to gain access and
privilege.
Not a pleasant thought, but it is unfortunately the times we are living
in. In a perfect world the greed and corrupt actors causing the
avalanche of malware would not exist. However, we live in a very real,
and very imperfect, world.
I think in makes sense to continue with the policies the AUR moderators
have set until they are satisfied the calamity of the past several
months has been protected against.
I'm not sure there are any other foolproof options.
--
David C. Rankin, J.D.,P.E.
