Hi Garrett, all, On 15/10/2026 16:35, Garrett wrote:
Hello all,The AUR new account registrations have been closed for months now. All inquiries are met with "there is no manual process." No path forward has been published, and discussions in this forum for how to harden the AUR have not resulted in concrete steps.
I understand the frustration, and the criticism on communication is fair.
I say this not as a criticism, but as a statement of fact. We are currently in a place where account registrations are disabled indefinitely with no "next step" defined. I assume that we can all agree that account registration should be reopened at some point.
Agreed and some context first. The AUR has been under sustained abuse for many months: automated account creation used to push malicious packages (supply-chain attacks against users everywhere, with the AUR as the delivery route), alongside DoS and growing bot and AI scraping load.
Our first priority is cleaning up and containing what is already there, not opening new ways in. I won't go into detail on the attacks or our defences here though.
It's also a good moment to repeat the usual disclaimer: the AUR packages are user produced content. Any use of the provided files is at your own risk. AUR helpers that mix official repository packages and AUR builds into one seamless "install" can give a false sense of safety. Please read the PKGBUILD and supplementary files before you build.
So my questions are these:What needs to be true to reopen account registrations? Who is working on it? Can they communicate the status of their work?Is there a path forward for new accounts to be created in some way that is not simply turning the registration page back on? Manual verification, sponsorship, probation of some kind?
The aurweb developers, DevOps and Package Maintainers are working on it. In progress:- A workflow for reporting a package as malicious, handled by PMs so reports no longer depend on the mailing list [3]
- Tooling for staff to act quickly on confirmed reports [4] - Narrowing the AUR's abuse points [work in progress] Options for reopening:- A vouched/sponsored registration model. This is under evaluation and would have to come with a new audit view that lets PMs see and act on what sponsored accounts do, without that it only moves the problem around. - Implementation of the RFC for an AUR moderator role [5]. AUR Moderators would help take care some of the tasks that PMs handle today and reduce the maintenance burden.
From an outsider's perspective, it seems that what needs to be true is to plan and execute a way to harden the AUR against bad actors. It does not seem that a plan has been agreed to, or that anyone is currently working on it. I'm not saying this is true, I'm saying this is what *seems to be the case* to someone who only knows what is stated in this forum. If work is being done on this, and it has been communicated, I apologize. If work is being done on this, and it has not been communicated, I respectfully suggest that some kind of communication be made.Regardless of whether that is the case, an interim solution should be implemented. Manual verification of new users is no one's ideal, but perhaps it could be used until a better solution is found. No one should expect the Arch TU/PM team to do this in addition to their other responsibilities, but perhaps they can delegate this task to a team of volunteers. I would certainly be happy to donate some time to this.
Thank you, the offer is appreciated. Manual verification means handing volunteers trust and access to applicants' personal data, so it needs a defined role, rules and tooling first. The moderator RFC [5] is where that would fit. All of this is done by volunteers, in their spare time, while we keep dealing with the abuse itself. That is the honest reason it's slower than anyone would like. Please consider getting involved in the aurweb issues [1] and joining the discussion on IRC [2]. People able to review and test open merge requests are more than welcome too. [1]: https://gitlab.archlinux.org/archlinux/aurweb [2]: #[email protected] [3]: https://gitlab.archlinux.org/archlinux/aurweb/-/merge_requests/920 [4]: https://gitlab.archlinux.org/archlinux/aurweb/-/issues/560 [5]: https://gitlab.archlinux.org/archlinux/rfcs/-/merge_requests/19 Regards, -- Leonidas Spyropoulos Developer & DevOps PGP: 59E43E106B247368 244740D17C7FD0EC
OpenPGP_0x244740D17C7FD0EC.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
