My question was (also general) about security:
1. I thought that looking at the diffs (with yay) should be able to
show malicious changes like recent. E.g. an update from yay recently
showed a new version number, a new version on a dependency and a
different signature. With that I concluded that there where no big
changes. I hope I'm right with that. I assume that the upstream
sources are unchanged.
2. I get suspicious if i get something about changing the source (in
this case "manual") in my diff.
3. I don't see the upstream source in the diff's. How do you all know
the source the AUR-packages uses?
4. Can I see the source easily with a yay command or do I have to look
at the source code of the AUR-package somehow? How then? I can look
at the aur.archlinux.org, but I think I should check the download
directly.
5. I also do a check in this mail list before I update, that should
help to some extend.
Or even more general: is there an instruction on how to check
AUR-packages/installs on safety issues?
On 10/28/26 16:16, kpcyrd wrote:
On 10/28/26 11:08 AM, Jørgen Best wrote:
Hi there,
What I still don't get: if I see some other source than an upstream
source, but manual in this case.
How can I verify that the source is OK?
Do I have to check the complete package or is looking at the info
with a Diff sufficient?
What do I have to look for in the diff if the last is true. I only
see local sources/files.
Kind regards,
Jørgen
Having read the email thread again after writing my reply, it feels
like an XY-Problem: https://en.wikipedia.org/wiki/XY_problem
If you installed this package from [extra] back then, and an AUR
helper is now suggesting to update it from the AUR, the easiest
solution is to just uninstall the package if you don't explicitly need
it:
pacman -R xfce4-artwork
---
Original reply:
I'm not sure what the diff is comparing against, but it shows Arch
Linux packaging files, that is different from the source code
mentioned by Lone_Wolf that's sometimes mirrored to
sources.archlinux.org.
You can sometimes cross-reference the source code hash with other
distributions[1], or use a cryptographic signature, but it seems
neither is available (except a record that the official Arch Linux
repositories have used this source code in the past).
[1]:
https://whatsrc.org/artifact/sha256:7a97c0acd0ed67ebb871866cc79c2925bea45bf1b92442bd88fac390dbe639ac
The fact an Arch Linux staff member has put the source code on that
server is one data point for credibility, if that's sufficient for you
personally is up to you (there's no objective right or wrong).
cheers,
kpcyrd
