On 24/08/2026 20:46, Oskar Roesler wrote:
wouldn't it be a relatively low-effort countermeasure to send out a mail to the maintainers if their pkg got updated?That might be a good idea, npm does this for example. Though, I believe the root cause is that maintainers have poor security practices, which puts the entire AUR at risk of worms.
AUR package maintainers have a non-trivial responsibility to secure their credentials. Using a SSH key without a passphrase for maintaining packages on the AUR is a major red flag IMHO. Granted, if the attacker has access to the machine of an AUR PM, then it's not that hard to deploy a keylogger and eventually sniff the passphrase - but that significantly hurts the speed at which malware can spread.
AUR maintainers could tweak the SSH server's configuration to support MFA, requesting a TOTP code before any operation can be performed over SSH (read-only operations like `git pull` could be exempt to not make this infuriating, though that's a bit trickier to do I recon).
Maintainers of significant packages should, if they can afford it, invest in a pair of YubiKeys (or whatever other hardware key) and use a key bound to it. Not sure how usable TPM-backed keys are these days on Linux, but these are a potential free alternative. Perhaps these hardware-backed keys could even be exempted from mandatory MFA, considering that the key's properties account for 2 factors in 1.
~Cynthia
OpenPGP_signature.asc
Description: OpenPGP digital signature
