I have a project which I planned to port to Windows, for which I need the following packages:
mingw-w64-sdl2
mingw-w64-sdl2_image
mingw-w64-sdl2_mixer
mingw-w64-sdl2_ttf
mingw-w64-libvorbis
I have already acquired and reviewed the necessary PKGBUILD files – there are 12 of them, see below – and I didn’t spot anything suspicious. However I’m not yet totally familiar with Arch AUR build workflow hence I’m not trusting myself 100% ¹ as to detecting potential malware ² .
Here’s the exhaustive list of packages that I would be about to install when confirmed they don’t pose any threat:
mingw-w64-cmake
mingw-w64-configure
mingw-w64-environment
mingw-w64-flac
mingw-w64-libmodplug
mingw-w64-libogg
mingw-w64-libvorbis
mingw-w64-mpg123
mingw-w64-pkg-config
mingw-w64-sdl2
mingw-w64-sdl2_mixer
mingw-w64-sdl2_ttf
I’ve checked the depends sections and shell scripts and didn’t see anything suspicious. Is there anything else I shall verify before having them processed by yay? Or does anyone know if these are safe at all or make sure they are?
Thanks in advance for any help or suggestion.
¹ Close to that though, I have been running Gentoo for about one decade before switching to Manjaro so I am aware of what build processes may involve
² Actors are extremely creative in that regard…
I certainly understand that the recent news about the AUR increase awareness about security risks. However, these risks have been there right from the beginning and the red warning box isn’t new at all.
You write you’ve verified the PKGBUILD scripts already and you didn’t spot anything suspicious. Then normally I would conclude it’s all good. However, if you’re still unsure, you should leave it alone. I think that’s the best answer to give
I shall add I’m not 100% confident because I’m not entirely familiar with AUR build workflow, maybe that didn’t stand out. As to the red warning box, it also suggests to ask advice in forums, which is exactly what I’m doing .
My expectation is more of a “it is safe right now” mantra than a general statement. I would also argue that because these security risks have always been present that it was enough to be abused and malicious actors leverage that vulnerability to wreak havoc in the repository.
I also admit it is a huge effort to protect against that kind of abuse and AUR is sure going in the right direction. However this is not enough to restore trust. There has to be some mechanism in place to raise the level overall.
But I digress.
If you have concrete supplemental instructions as to verifying the validity of the packages I mentioned, I’ll gladly apply them. If not, well, I’ll take a leap of faith… nah just kidding. I know there are measures to apply, e.g. use a virtual machine.
Indeed. I should have mentioned I had checked that in the beginning of the reported attack. Does that mean they are still compromised? From what I saw, the attack consists in adding a reference to npm or a dependency which I forgot the name. I didn’t spot these names while inspecting PKGBUILD files, does that mean these packages have been restored to their original state?
.
