Arch Linux disables AUR package adoption
Arch Linux has temporarily disabled the ability to adopt orphaned AUR packages after attackers created accounts, took over abandoned entries, and pushed malware to users. Commenters see this as an inevitable consequence of AUR’s “wild west” trust model, where anyone can publish build scripts and many users install them via helpers without closely reviewing the code. The change raises broader questions about how to balance openness, anonymity, and supply‑chain security in community repositories, and whether stricter identity checks, automated scanning, or even sunsetting the AUR in its current form will be necessary.
Scope of the Change
- Thread clarifies that Arch has disabled adoption of orphaned AUR packages, not AUR itself.
- Some note the official announcement frames it as a temporary suspension during an ongoing incident; others read it as effectively disabled for now.
AUR’s Security Model and Risks
- AUR is repeatedly described as an untrusted, “wild west” repository, distinct from Arch’s official repos.
- Building from AUR inherently runs arbitrary maintainer-controlled code (PKGBUILDs), so users are expected to review scripts before installing.
- Many argue real-world users treat AUR as first-class and often skip review, creating a large attack surface, especially as Arch/SteamOS gain popularity.
Adoption of Orphaned Packages
- Intended purpose: let volunteers take over abandoned packages, avoid name pollution, and keep popular names (e.g.,
foovsfoo-new,foo-legacy). - Critics call unilateral adoption by anonymous users a fundamental, unfixable vector for supply-chain attacks and “identity laundering.”
- Others see disabling adoption as an emergency stopgap that, if permanent, would slowly kill or force a redesign of AUR.
Proposed Mitigations
- Ideas include: malware scanning (with debate over effectiveness and feasibility), sandboxed builds, stronger account controls, or some form of KYC/real-identity chain of trust.
- Counterpoints: scanners only catch known malware; strict identity requirements threaten anonymity and could have legal/political downsides.
- Some suggest alternative models: user-owned repos, Nix as cross-distro package manager, or Gentoo-style community overlays.
Wider Security & Cultural Debates
- Disagreement over how insecure desktop Linux is compared to Windows; official repos vs user repos are distinguished.
- Discussion of “honor among hackers” vs profit-driven or state-backed attackers; several say attacks were always inevitable once Arch became popular.
- AI/LLMs are seen both as tools that can help review PKGBUILDs and as factors that lower the barrier to writing malware or generating unsafe install commands.
Future of AUR
- Some predict disabling adoption may be the first step toward deprecating or radically restructuring AUR.
- Others insist AUR remains valuable if users treat it as untrusted code, read PKGBUILDs, and accept the inherent risks.