Hi, On 8/7/26 13:34, Robin Candau wrote: > As judged by the PKGBUILDs and the commit history of the four packages > you linked, a simple bump of the $pkgver variable (and updating the > checksum entries accordingly, which can be automated with the > `updpkgsums` command from the `pacman-contrib` package) should be all > it takes. > > This should hopefully be simple / straightforward enough while we work > on restoring the AUR write access.
Thank you for this command, I was wondering if this could not be used to address the recent AUR attacks. Indeed for most of the AUR packages I have installed, the updates' diff is often just a bump of the pkgver, and of the checksums, and I tend to trust them as benign updates (trusting the hosting provider to have not been compromised). Could it be possible to have a check (on the AUR infrastructure) which flags any update of a package which is not - pkgrel bump - updpkgsums Maybe this should be rather suggested as a feature to the AUR helper maintainers... or to another mailing list... sorry if it is the case. But if it were done on the AUR side, it could enable to have a curated list of all the packages which have "non-standard" updates, to be able to detect more simply when an offensive campaign takes place (by correlation of the changes, or by number of such suspicious updates, or just to get more visibility on the modifications...) Of course this does not solve the "infinitely patient crook" threat model, and users should keep auditing their PKGBUILDs. Yours, toby
