I haven’t heard a peep about the security status of AUR since the headlines about malware injections into thousands of packages. I’ve ensured that none of my installed software is affected by the attack (to the best of my ability), but I’ve held off on my regular yay -Syu since then. What has you all done to keep your machine updated but clean?
And is there any update from AUR maintainers that the situation is under control? Most of my installed AUR packages simply don’t exist in the official Arch repos, so if not I’d have to look for other sources.
none of the affected packages were popular and iirc all were flagged out-of-date for a long time, which is also why the attackers got access as they were abandoned.
just review pkgbuilds and pay attention to ones that get flagged out-of-date when you’re updating and go check it out and find an alternative if the upstream project looks abandoned as well or install it from source instead if it’s just the aur pkg.
most out of date aur pkgs i’ve had ended up being things that the arch team put in extra so i just needed to install that one instead anyway.
another thing to note: after an update, when your aur tool says you have orphaned packages installed, highly consider removing them.
if you want to keep them for whatever reason, try to remember (or write them down) so if they get an update out of the blue, you can scruitinize the pkgbuild
It only takes a few moments to scan the diffs in a pkgbuild. It’s not a big ask.