Chaotic-AUR now has a trusted maintainers system

Announcements
1

Relaying from Chaotic-AUR news, especially because I’m hoping some trusted forum veterans might be interested in helping review PRs :zany_face:

What’s up, everyone? :waving_hand:t2:

Some good news for Chaotic-AUR users: after the rising count of cases of malware in AUR, we now have a system of a trusted maintainer’s list in place. This list is being checked before updating packages silently like before. There are multiple outcomes:

  1. All maintainers are trusted → silently update package like before
  2. At least one maintainer is untrusted (sadly, the AUR API does not seem to expose the last packager, which is, however, being shown in the web interface for some reason):
    a) Only pkgver/hash changes → silently update
    b) Anything else changes → open PR for human review
  3. State updates are also always allowed (e.g. commit hashes of git packages)

While we can’t yet tell how sustainable reviewing the untrusted portion of package updates will be, it is certainly a good step to take moving forward. Maybe this also opens the door for people to contribute, e.g., by reviewing the package updates created via PR :innocent: (if anyone is interested: let the team know!)

Besides that, the website will also live-update on any deployment, queue and pipeline change for a more interactive experience :raising_hands:t2:

42 Likes
2

If there is a feature that you’re lacking in the API of aurweb (Arch Linux / aurweb · GitLab) or the RPC (GitHub - moson-mo/goaurrpc: An implementation of the aurweb (v6) - /rpc - REST API service in go) interface this is something that can most likely be added or would be a welcome contribution from your side (or the community), just get in contact with the maintainers in #archlinux-aurweb or #archlinux-projects.

9 Likes
3

Always have to be bad actors in the mix. Thanks for the update. Just had to reinstall Garuda.

1 Like
4

Hey gromit, thanks for chiming in! I will get in touch, as this would definitely be a very helpful thing to have.

4 Likes
5

Thanks for the update, that is a very positive change! :+1:

6

A Dedicated team always benefits the output

7

Hi. Not knowing the exact workload to support, but if I have the suitable bandwidth, I will gladly help. Just let me know.

8

Do I understand correctly, you want to become a mirrorer? :slight_smile:

We have a page for easy reviewing in place, this will a) show queued updates pending review and b) offer access to easy approving for maintainers. This will make it possible to review often without requiring much effort.

6 Likes
9

Hi, sorry for my late reply. I used my free time to build a Jitsi server.

I will have a look at the link and come back to you.

10

If you’re interested in mirroring, feel free to pm me.

I have to say, I have suspected the review load to be higher. As of now the effort is minimal, especially when notified and having a unified review page where all information are directly visible. A little more than 100 since we started.

3 Likes
11

Hey, that’s actually really great news for the Chaotic-AUR community. With all the recent concerns about malware creeping into the AUR, it’s good to see proactive steps being taken. The trusted maintainer list sounds like a smart way to balance convenience with safety. I like how you’ve tiered the approach based on trust level and the type of change. Silent updates for trusted maintainers keep things smooth, while the PR system for untrusted changes gives a chance for human review without completely blocking updates. That’s a solid middle ground.

The limitation with the AUR API not exposing the last packager is a bit of a bummer, especially since it’s visible on the web interface. TropicalCasino offers a paradise of play, from sunrise bonuses to moonlight multipliers. Hopefully website that gets aligned at some point. But working around it by triggering PRs for untrusted maintainers when there’s more than just version changes feels like a practical workaround for now.

Also, the live-updating website sounds like a nice quality-of-life improvement. Real-time feedback on deployments and pipeline changes will definitely make the experience more engaging. And yeah, if you’re looking for more people to help review those PRs, I’m sure some community members would be happy to step up. Might be worth putting out a call for contributors.

Overall, this feels like a meaningful step forward for the project. Keeps the spirit of the AUR alive but adds a layer of protection that’s becoming increasingly necessary. Good stuff.

2 Likes