1

I am new on Linux ecosystem and have some confusions regarding the terminology that are being used. With that being said, my reason to switch to a Linux Distro from Windows because it provides a unified package manager from where I can download and install software, without needing to go on the web and find necessary ones. The distro I am currently using is Ubuntu 20.04.2.0, which is good, but the packages they provide are kind of old and I would not be complaining if they had at least provided the LTS version of the software. So, I recently came across Arch and Manjaro which are rolling release distros, but I am interested as it provides both the latest versions and LTS versions of the softwares. That is great. But, I am little worried because most of the software I use are in the Community Repo (Node JS, Dotnet Core and gh). And, here is quote from Arch documentation:

community contains packages that have been adopted by Trusted Users from the Arch User Repository. Some of these packages may eventually make the transition to the core or extra repositories as the developers consider them crucial to the distribution.

It says "Trusted Users" (respect for them) pick the packages from the AUR to "Community Repo". From some online forums and articles, I learnt that it a good practice to avoid using AUR as it may cause unwanted things or even infect ones PC with viruses and malwares. Once again, I am a noob in Linux world and have absolutely no idea about Arch Linux and its derivatives. So, I wanted to know, is it safe to use packages from the Community Repo. Does the "Trusted Users" (maintainers of Community Repo) check for validity and security of the AURs that transition to the Community Repo?

4
  • What do you mean by "virus and malware" with respect to Linux? Give examples. The security model of Linux mitigates against viruses, and "malware" (as differentiated from a "buggy program") is unlikely to pass the testing. Also, since Linux is Free Open Source Software, anyone can download the source for anything, and read it.
    – waltinator
    Aug 8, 2021 at 4:28
  • @waltinator, malwares like, trojan, spyware or ransomwares, etc. I did not mean any disrespect to the Arch Community. Since, I had been a windows user convert to Linux, so I had some queries. And, from some online articles and forums (as I said), I learnt that it is not wise to blindly trust an AUR and install it. So, I was slightly paranoid and wanted to know do the Community Repo Maintainers thoroughly check an AUR before promoting it to the Community Repo. Arch Docs definitely mentioned about it, but as I said I am slightly paranoid about malwares, that's why I asked this question? Aug 8, 2021 at 5:36
  • I'd just like to add, there is no harm in installing from AUR itself either. Yes anybody can upload to it, so they can add dodgy code, but as long as you read the PKGBUILD before installing the package, it's pretty easy to tell if anything bad is happening. Of course the more popular the package is, the less likely it is to have malicious code since many people are looking at it.
    – KNejad
    Aug 8, 2021 at 8:30
  • Please read this document: itvision.altervista.org/… Short answer, no, there's no such Linux distro all of whose packages you can trust. Backdoors can potentially exist in the Linux kernel itself. Aug 8, 2021 at 18:50

2 Answers 2

0

Yes, you can trust 'Trusted users' of Archlinux and in general also trust well-known distro maintainers. If you don't, you can compile software yourself (but in that case you should trust software developers). I am not familiar with any case when developer of any kind of any distro intentially was spreading malvare in public repositories.

Regarding 'trusted users' in archlinux. They are not just expert users who randomly move packages from AUR to community repo. They are elected and their AUR packages are reviewed. After electing they are granted special rights, including adding packages to community repo. So, essentially in archlinux there are two types of developers: core developers who 'manage' core/extra repositories and trusted users who manage community repo and AUR package scripts.

Also, not many packages are moved from AUR to community repo. It usually happens when someone is elected as trusted user - he can move some of AUR packages he uses to community repo. If you think dozens of random AUR scripts are moved to community repo each day, then this is not the case.

Tl;dr you can trust community repo packages. By default, you should not 'trust' AUR package (PKGBUILD script) because any user can upload it.

1
  • Thank you for your response. Once again, respect to the maintainers of the community repo ("Trusted Users") and I believe they definitely take their precautions while promoting an AUR to the Community Repo. Or else, Arch Linux or Manjaro would not be widely used. I just want to resolve my paranoia of getting malwares into my PC. Nevertheless, thanks for your response. Aug 8, 2021 at 5:25
0

Are Arch Community Packages safe from virus or malwares?

No! And why not:

Most packages are compiled from original sources or e.g. package for another distro is used and extracted/repacked, so there are complex buildscripts, stuff downloaded e.g. from github, patches... you will never be sure other if you read all! scripts, patches and sourcefiles.

So even if the AUR scripts are clean, stuff which comes from other sources might be contaminated.

But, I never read about such an issue in the last decade or so.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .