Hi, if I understand correctly, during the recent attack on the AUR, PKGBUILDs were manipulated in such a way that they executed a malicious programme via sudo during the build process.
If that is the case, couldn’t we protect ourselves by using an alias in the form of sudo -k && makepkg to prevent sudo from being executed automatically during the build? Provided, of course, that a timestamp is set to require a password. I’ve also posted my request on the AUR general list. However, I don’t think it can do any harm to raise this issue on this list as well. Have I missed something? Regards, Ralf
