Chaotic-AUR now has a trusted maintainers system

Announcements
1

Relaying from Chaotic-AUR news, especially because I’m hoping some trusted forum veterans might be interested in helping review PRs :zany_face:

What’s up, everyone? :waving_hand:t2:

Some good news for Chaotic-AUR users: after the rising count of cases of malware in AUR, we now have a system of a trusted maintainer’s list in place. This list is being checked before updating packages silently like before. There are multiple outcomes:

  1. All maintainers are trusted → silently update package like before
  2. At least one maintainer is untrusted (sadly, the AUR API does not seem to expose the last packager, which is, however, being shown in the web interface for some reason):
    a) Only pkgver/hash changes → silently update
    b) Anything else changes → open PR for human review
  3. State updates are also always allowed (e.g. commit hashes of git packages)

While we can’t yet tell how sustainable reviewing the untrusted portion of package updates will be, it is certainly a good step to take moving forward. Maybe this also opens the door for people to contribute, e.g., by reviewing the package updates created via PR :innocent: (if anyone is interested: let the team know!)

Besides that, the website will also live-update on any deployment, queue and pipeline change for a more interactive experience :raising_hands:t2:

40 Likes
2

If there is a feature that you’re lacking in the API of aurweb (Arch Linux / aurweb · GitLab) or the RPC (GitHub - moson-mo/goaurrpc: An implementation of the aurweb (v6) - /rpc - REST API service in go) interface this is something that can most likely be added or would be a welcome contribution from your side (or the community), just get in contact with the maintainers in #archlinux-aurweb or #archlinux-projects.

9 Likes
3

Always have to be bad actors in the mix. Thanks for the update. Just had to reinstall Garuda.

1 Like
4

Hey gromit, thanks for chiming in! I will get in touch, as this would definitely be a very helpful thing to have.

4 Likes
5

Thanks for the update, that is a very positive change! :+1:

6

A Dedicated team always benefits the output

7

Hi. Not knowing the exact workload to support, but if I have the suitable bandwidth, I will gladly help. Just let me know.

8

Do I understand correctly, you want to become a mirrorer? :slight_smile:

We have a page for easy reviewing in place, this will a) show queued updates pending review and b) offer access to easy approving for maintainers. This will make it possible to review often without requiring much effort.

6 Likes
9

Hi, sorry for my late reply. I used my free time to build a Jitsi server.

I will have a look at the link and come back to you.

10

If you’re interested in mirroring, feel free to pm me.

I have to say, I have suspected the review load to be higher. As of now the effort is minimal, especially when notified and having a unified review page where all information are directly visible. A little more than 100 since we started.

3 Likes