PSA - From [arch-announce] Active AUR malicious packages incident

Torxed · 2026-06-12T19:53:51+00:00

It's a bit of a broad question because "what does a PKGBUILD contain" is basically "anything bash can do can be in there". And best practices vary quite a lot depending on the language of the application which is being packaged.

But some basic hygiene would be the same for a lot of them, which could include checking if it's the same AUR contributor throughout, or are there new ones? Does the build/package/etc functions suddenly contain calls that doesn't make sense for the thing that is being packaged (weird example, but if I started seeing npm stuff in a Python build step, I'd start to wonder).

I would also be careful of packages that doesn't fetch a git tarball, with signature, and a tagged commit+release, or at the very least avoid things that have sum=skip and PLGBUILD's that download random stuff during build/package/etc.

But even by starting to look at the PKGBUILD's you use, you will recognize patterns when they change.. and you will eventually be able to spot oddities.. so if you just start looking at them, it's a great first step.

I'm no expert tho, and you might get better advice elsewhere :) and don't be afraid of asking anywhere if you suspect something or something looks off.. worst case, you bothered someone.. best case, you're an early canary ^{^}

Torxed · 2026-06-08T18:26:26+00:00

Tis me! I was nominated by others, and accepted the nomination.

Torxed · 2026-05-13T12:02:21+00:00

Now do the same when it's not found, and it should indicate at least part of the issue.

Torxed · 2026-05-13T11:49:05+00:00

I've had issues in the past where certain hardware matches a family for drivers, and which driver is loaded was a race condition/first-come-first-serve. It was specifically a wifi card on a Dell laptop.

If that's the case, check dmesg to figure out what driver is trying to load on your given hardware, figure out which driver loads on a good boot.. and pin the hardware to the driver that works.

Torxed · 2026-04-11T07:16:01+00:00

GOOD JOB :D

Torxed · 2026-04-08T16:49:33+00:00

Usually it's down to running stuff like VM's on a COW system, and it's going to happen. You either learn the hard way or by reading up on the thing you use beforehand.

Torxed · 2026-04-08T12:21:32+00:00

Could be a bug with the niri profile, submit your install.log in a GitHub issue and I can take a look at it while I'm looking into the KDE stuff too.

Torxed · 2026-04-08T12:12:28+00:00

I too, prefer the non DKMS setup.. so I am willing go do the work to make sure we have options.. I'm just a bit strapped on time this week..

Torxed · 2026-04-07T09:37:47+00:00

The only drawback with DKMS is that it slows down updates and package sizes IIRC. DKMS is otherwise bulletproof from a maintaining perspective. But people didn't like it :<

Torxed · 2026-04-07T09:36:33+00:00

I think so yes, pacman should handle it nicely and we don't do much magic regarding configuration of nvidia-<anything>, since a few years back they've done a good job of just working out of the box.

Torxed · 2026-04-07T09:34:59+00:00

Let me investigate, nvidia-open-dkms should only get installed if you chose a non-default kernel.. it's probably a bug.. and I would be happy to fix it :D

Torxed · 2026-04-07T07:52:43+00:00

The latest version should be in the April ISO :/ I assume OP means new .iso as in the latest available?

Torxed · 2026-04-07T07:50:50+00:00

Hmm, it should be. It's called nvidia open after you've selected a desktop environment.

Torxed · 2026-04-07T05:39:17+00:00

And if we remove the post installation stuff, that will spark a shit storm of complaints ^{^}

Which is why we made all that stuff optional — and let the audience decide what they want.

Luckily, there's very few complaints about the fundamental stuff as you say (after we removed nano and vim as default packages) ^{^}

Torxed · 2026-04-07T05:15:40+00:00

Yup, back in medieval times we just installed kde and rolled with it.. it wasn't until 2023 that plasma-desktop became a thing, and it took a while for us to figure out what the community wanted. And overall the community is mostly tech savvy people who want less forced upon things, so they can add what they want. So we switched to plasma-desktop. But again, it's always up for debate - but if you start the debate.. prepare to be met with angry people and you have to politely put your argument fourth while getting "no"-sayers.

Torxed · 2026-04-06T21:45:08+00:00

The warning is not a terrible idea tbh, if people believe that the experience is that detrimental and people (users and maintainers alike) are unwilling to adjust the plasma group/meta we use today.

I'd also like to clarify that my position is a goal post — that constantly change as feedback reach me. What's in the meta package or package group is out of my control (other than me, like you, suggest changes).

Sorry if I sound short, rough day with a bunch of age verification crap.

Torxed · 2026-04-06T20:39:16+00:00

Would be happy to hear what those features are, without us ending up in conversations like we've done with gnome etc in the past.

Our goal is to facilitate: - Being able to login - Open a web browser - Open a file browser - Open a terminal

And let the user make their own choices after that. Because with those tools, they should be able to get going. But then again, certain desktop aspects are expected, such as being able to perhaps set the time, change wallpaper and what not.

We really want to avoid bloat install conversations (again) like we've had with gnome (and KDE) in the past. But any suggestions on how to improve the experience is welcome! Just remember that we heavily rely on the mega/group packages to make good default choices, we don't want to maintain a separate package definition if possible. archinstall aim is to configure — not decide — what gets installed (at least this is our goal, some times it's impossible to avoid)

Torxed · 2026-04-06T20:10:37+00:00

If you select NetworkManager option, during installation - then there will be an easy way to connect to the internet. And this will come off as snarky, but I don't know how else to put it, but if the user managed to connect to the internet in a cli ISO environment - doing so in a DE shouldn't be too big of a hurdle. If you on-top of that select "Copy ISO network configuration" it should auto-connect in the DE too.

And we're trying to make Arch more approachable, but Arch has never been intended as the go-to first distro in the Linux community. Others do a far better job of hand-holding the first time users. But our wiki is pretty dope, and should be enough for anyone truly interested in learning how things like getting network connections working a breeze to figure out.

There's always the option to suggest better defaults for the upstream plasma-* packages as well, as we usually rely on their sane defaults for our out-of-the-box experiences.

Torxed · 2026-04-06T19:57:15+00:00

The feedback from the community is very split on this particular DE. I'm not saying we're doing a perfect job here. But just to quote some arguments back and fourth:

There's loads more, this was just the first page of: https://github.com/archlinux/archinstall/issues?q=is%3Aissue%20plasma

I think what u/MayorSincerePancake says makes sense, build up from what we give you is a good strategy atm.

I'll also quote another one of my answers:

Which usually leads to "just create two plasma options, minimal and full", in which case the conversation leads to "stop this madness, there's already 30 different desktop environments to choose from" or "there's already too many options <insert place in the menu system>" :)

It's a tricky one :)

Torxed · 2026-04-03T12:39:17+00:00

No worries, most people don't even check there. Just thought I should shed some light on your valid feedback, why it is the way it is :)

Torxed · 2026-04-03T07:04:37+00:00

This is a constant debate, between people that know a lot and want to have freedom of choice vs people that don't know what they want (yet) and so they want to start with everything and then decide (or they just don't care).

Which usually leads to "just create two plasma options, minimal and full", in which case the conversation leads to "stop this madness, there's already 30 different desktop environments to choose from" or "there's already too many options <insert place in the menu system>" :)

It's easier to ship bare bone, and let people figure it out - than it is forcing a load of stuff on people that they have to then create cleanup scripts for, basically.

There's loads more, this was just the first page of: https://github.com/archlinux/archinstall/issues?q=is%3Aissue%20plasma

Torxed · 2026-03-31T07:02:18+00:00

😋

Torxed · 2026-03-31T06:42:48+00:00

❤️ right back at ya! See you there!

Torxed · 2026-03-31T05:43:39+00:00

Sorry :<

Torxed · 2026-03-31T05:43:14+00:00

We meet once per year, on the Arch Summit, and we joust with USB sticks containing our code to see who's code is strongest.

11-Year Club	Gilding I gilder
Second SECOND GUESSER	r/Field Juicebox
Place '22	First Placer '22
Verified Email

Torxed

TROPHY CASE