274
Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages (www.phoronix.com)
submitted 4 months ago by to c/technology@lemmy.world
33 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 26 points 4 months ago (2 children)

A couple of weeks ago, some dingbat of an AUR admin orphaned a package of mine, ignoring the comment I left on it and my post to the mailing list.

Even though this package, to my knowledge, didn’t end up being attacked, I wonder if this was a potential precursor to the recent attack…

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 1 point 4 months ago (1 child)

    To answer your question, generally yes the package maintainer is the one who maintains the package for the current version of the distro, even if upstream is unchanged. If a package is no longer compatible and no one is making it compatible, then yes it's unmaintained and should be removed.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 17 points 4 months ago* (last edited 4 months ago)

    It wasn’t removed, it was marked as orphaned, which means anyone can take over and mess with it, lowering the bar for supply chain attacks.

    If another user had said “I can take care of this long-term, gimme”, I’d had handed it over. Instead, some self-important dingbat with too many privileges decided to mass-mark all packages with an “outdated” flag beyond a certain age as orphaned, then ignored my mailing list post.

    For what it’s worth, a distro package maintainer’s inability to update a package to a newer upstream version does not necessarily lead to a package being removed. Debian and Ubuntu kept shipping an ancient version of freetds sometime in the mid-2010s and the package maintainer was incommunicado.

  • permalink
  • fedilink
  • source
  • parent