228
nixpkgs > aur (programming.dev)
submitted 4 months ago by to c/linuxmemes@lemmy.world
31 comments fedilink hide all child comments
 

cross-posted from: https://programming.dev/post/52191489

you are viewing a single comment's thread
view the rest of the comments
[–] 15 points 4 months ago (4 children)

It's possible, but at the very least someone glances over the derivation since it's part of the actual nixpkgs repo right? AUR on the other hand is a wild west.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 15 points 4 months ago (1 child)

    Yeah if the url is https://i_hack.you/ yeah that will be easy to spot. But imagine an attacker just to a "patch update", updating the url and hash to the malicious repository, and use a typo squatted domain/repository, that will make it harder to spot.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 13 points 4 months ago

    No, it would actually be quite easy to spot.

    Nixpkgs templates the source code url fro the url, and then it injects a variable

    Here is an example from bash:

    pname = "bash${lib.optionalString interactive "-interactive"}";
    version = "5.3${fa.patch_suffix}";
    patch_suffix = "p${toString (builtins.length upstreamPatches)}";

    src = fetchurl {
      url = "mirror://gnu/bash/bash-$%7Blib.removeSuffix fa.patch_suffix fa.version}.tar.gz";
      hash = "sha256-DVzYaWX4aaJs9k9Lcb57lvkKO6iz104n6OnZ1VUPMbo=";
    };

    If the url were to be changed, it would show up as a change in git when someone is reviewing before merging.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 7 points 4 months ago

    Yes, on one hand every commit to nixpkgs needs review (to some degree) on the other hand there are far too many committers to nixpkgs.

    There are also gaps such as the bots to auto-merge packages with maintainer approval, so a simple attack looks like this:

    1. Submit a package with you as a maintainer.
    2. Create a new GitHub account and send a malicious update to that package.
    3. Use a bot to merge with maintainer approval.

    So nixpkgs is better than the AUR, but it isn't great and unlike Arch has no separate official repos.

  • permalink
  • fedilink
  • source
  • parent