Hi Emiliano,
From the outside I can't tell whether tippfehlr's credentials
> performed the pushes or tippfehlr did a cleanup force-push afterward, > that distinction needs AUR-side push/audit logs, which i lack. I happen to remember because I was part of the clean-up crew that day.What tippfehlr did is 1. suspend the account under which the malicious commit had been uploaded, and 2. did a `git reset --hard HEAD~1` followed by a force push.
One practical method you can use to detect this pattern: if the `Maintainer` account has a line that says “Inactive since $DATETIME” *and* `Last Packager` is an Arch Linux Package Maintainer *and* `Last Updated` is very close to $DATETIME, then you can be 99 % sure that it’s a case of a malicious commit that was rewritten and force pushed similar to how tippfehlr did.
If the purge was recent and you’d like to see a copy of the purged commit(s), you can contact the Package Maintainer who is marked `Last Packager` and ask them to send it to you. Whenever I purge a commit from the AUR, I usually keep the clone on my computer for at least seven more days so I can fetch it from the reflog on request if anyone wants to see it for forensics.
> I'll keep an eye on them and I'll add them to trustsight's watchlist > ASAP, just in case.Thank you for your effort and watchfulness. However, if by “them” you mean the fennekuiper account, no need to watch that one specifically. Fennekuiper was suspended indefinitely. You still see that account under `Maintainer` because that’s a cheap way for us to add friction to possible attempts at adopting this PKGBUILD again.
In other words, if a PKGBUILD was compromised once, and you want to adopt it later, you’re going to have to file a sequence of *two* requests (orphan first, then adopt) rather than one.
This all might not exactly be the transparency you folks seek, but maybe the pattern helps you until we have better mechanisms in place.
Regards Claudia
OpenPGP_0xD11E9FC4F7C9DA3C.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
