news
Chaotic-AUR is trying to fight Arch Linux malware
After a rash of malware in the Arch User Repository (AUR), one AUR packaging system, Chaotic-AUR, is in response taking steps to increase trust and reduce chances of malicious software reaching Arch Linux folks. Based on this system, certain package updates will get flagged for human review before being released to the public.
Chaotic-AUR, a package repository containing pre-compiled software from the AUR, is introducing a maintainer trust system to reduce instances of folks receiving malware-infused packages from Chaotic-AUR. The new system will involve a list of trusted maintainers, presumably people compiling software for Chaotic-AUR who are known to be trustworthy individuals without a history of spreading malware.
Chaotic-AUR developers say that before software updates are released, the maintainers of that software will be checked against the trusted maintainer list. If all the maintainers are trusted, nothing unusual will happen and the update will be sent on to people accessing Chaotic-AUR as normal.