linuxmemes

Idk how the AUR works but I like that nix fetch the source from the repo and also check its hash from a maintainer provided one. Prevents repo hijacking.

Although it's still pretty much vulnerable if the attacker controls both the nix file and the repo

As other people have stated, you do not need to worry about the AUR issue specifically since Bazzite is not based on Arch Linux. Also, unless you are building Node based application (node being a JavaScript based runtime environment), you shouldn't have to worry about that one.

That said, these platforms are just the latest targets because they have huge enterprise user bases. Any centralized repository has the potential for vulnerability, especially ones with unvetted user submissions.

Not likely. Just know that AUR is user driven and not checked or vetted.

npm: Node Package Manager.
AUR: Arch User Repository.

Bazzite is based on fedora not Arch so you don't need to worry.

Arch is a bleeding edge distro. Basically if you hear about some new feature coming to Linux, Arch probably had for about a week already. This obviously has its downsides like stability.

The AUR (Arch User Repository) is basically a list of scripts that anyone can put together. In the scripts are various commands to download a program and how to build/install it. Where it pulls from and how it does it is completely up the uploader. Which makes it extremely dangerous.

This is not representative of the rest of Linux systems and how they function. Arch's AUR is as close to downloading random installers from a website and running it on your Windows computer you can get.

As for NPM, it's basically the same thing for JavaScript libraries, but worse.

AUR is something related only to Arch Linux. Bazzite is not related to Arch, so you're good.

NPM is the Node Package Manager. Unless you're doing something like installing Node JS stuff then you don't need to worry about this. I feel fairly confident that this is one of those things where you'd know if you were using it.

The forking option wouldn't work as well as it does on github because AUR packages are not namespaced like GitHub repos, e.g. communism/mypackage; instead it's just mypackage. So if adoption required a new name you'd have mypackage-cont, mypackage-cont-cont, or whatever. And it wouldn't really be possible to introduce username namespacing because AUR packages are just Pacman packages that are community-contributed rather than official, and Pacman, like most package managers, doesn't namespace their package names; firefox is just firefox rather than, say, mozilla/firefox. Some AUR packages get added to the official repos so when you do, e.g. yay -Syu, you'll then install the official package if you previously had the AUR package installed as it has the same name.

There isn't a perfect solution. Even if package adoptions were moderated, someone could take over a package and initially push a genuine commit, and then their next commit is malicious. Reviewing every single AUR commit would be incredibly labour-intensive. Possibly you could add automated checks for commits that suddenly add an npm install or other suspicious command with regex, but attackers could just get cleverer about avoiding those regex checks. Imo the best solution is just more widespread warnings about the fact that AUR packages are community-contributed with no guarantees of safety (e.g. on the Arch wiki where it sometimes suggests users install AUR packages), and AUR helpers forcing users to read PKGBUILDs before installation.

The developers themselves are often not the package maintainers. Before a package is published or updated in one of the official Arch repos, it has to be built, tested, and sometimes patched (which is why you see a -1, -2, etc. appended to the package version), in order to work correctly not just on its own but in an Arch system with Arch packages that it is likely to encounter. The process is not as thorough as Debian for example, but it's still the responsibility of the package maintainer. If the package is still in early development, deprecated (e.g. wine32), an out-of-tree kernel module (e.g. xpadneo-dkms), or is meant to be built from the latest available commit (any number of *-git packages), the AUR is a convenient way to share PKGBUILD files rather than have the user build the software manually based on a readme, if it even includes build instructions. The PKGBUILD is then ingested by makepkg, which both configures the environment and builds the software, and outputs a package that can then be installed and managed by Pacman.

The caveat is that packages built from the AUR are not vetted by any package maintainers. They can have bugs, they might depend on outdated or no-longer-existent packages, or might contain malware.

it makes sense to me. remove as much friction from the publishing process as possible, so you get a huge amount of packages. this incident just shows they removed a little too much.

there are so many niche packages on the aur useful to so few people that nobody would go through the official process to properly package, test, and maintain them.

for example: vscodium is a fork of vscode, but microsoft disables the marketplace for it. the vscodium-marketplace package from the aur adds it anyway. i don't think any regular repos have these kind of hacks and patches available.

Source packages are a thing.

AUR is a repository for source packages (in Arch it's called PKGBUILD) from users. You can write PKGBUILD yourself or just download it from AUR if someone already made it.

Be real for a second,
Did you, or did you not, manage to review a diff, and say "no, that looks fishy".

Do you really think you are immune from compromised binary AUR packages thats being downloaded straight from GitHub? Sure, now it's not only the AUR that's bad, but in the end of the day, a malicious binary did arrive at your computer.

Let's say that you don't use *-bin packages, and only download from compilable source, are you immune from the strategy that the state actor who caused CVE-2024-3094 used to compromise packages?

Every movie does that. Just how they remove helmets from bikers and armor. Gotta see the actors beautiful face after all.