Skip to content

harden aur_pre_build (#2228) #4294

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

harden aur_pre_build (#2228) #4294

wants to merge 1 commit into from

Conversation

Misaka13514
Copy link
Member

@Misaka13514 Misaka13514 commented May 14, 2025 •
edited
Loading

Fix #2228

用脚本批量了添加现有 AUR Maintainer 和 CoMaintainers

Todo:

  • AUR 上没有 Maintainer 的包:

    建议维护者在 AUR adopt 后改为 update_aur_repo 的模式

  • 因 AUR RPC 限制，未能获取到 Last Packager，若其与 Maintainer 和 CoMaintainers 不同，lilac 会拒绝

    待测试（预计今晚前完成） 已添加

grep -rl "aur_pre_build" archlinuxcn alarmcn | while read -r file; do
  if grep "aur_pre_build" "$file" |\
     grep -v "maintainers=" |\
     grep -v "^#" |\
     grep -vq "from lilaclib import aur_pre_build"
  then
    echo "$file"
  fi
done
result

可忽略

archlinuxcn/apparmor.d-git/lilac.py.bak

需修改

archlinuxcn/cataclysm-dda-ncurses/lilac.py
archlinuxcn/hpoj/lilac.py
archlinuxcn/hpoj/lilac.yaml
archlinuxcn/httpry/lilac.yaml
archlinuxcn/python-pdm-pep517/lilac.yaml

@lilacbot
Copy link
Contributor

Some maintainers (perhaps outside contributors) cannot be assigned: @yan12125, @Universebenzene, @xiaohuirong, @ykelvis, @tttturtle-russ

@xiaohuirong xiaohuirong requested review from xiaohuirong and removed request for xiaohuirong May 17, 2025 06:30
xiaohuirong added a commit that referenced this pull request May 25, 2025
@xiaohuirong
harden my packages
ca991bf 
#4294
@Misaka13514 Misaka13514 force-pushed the patch branch 2 times, most recently from 7ecac21 to fad49c1 Compare May 30, 2025 04:23
@Misaka13514
Copy link
Member Author

重新获取了所有 maintainers，仅有一处 maintainers 改变

diff --git a/archlinuxcn/python311/lilac.py b/archlinuxcn/python311/lilac.py
index 3ab137e1a04..7c4d5ccc308 100644
--- a/archlinuxcn/python311/lilac.py
+++ b/archlinuxcn/python311/lilac.py
@@ -5,7 +5,7 @@ from lilaclib import edit_file
 
 
 def pre_build():
-    aur_pre_build(maintainers=['soh'])
+    aur_pre_build(maintainers=['Heptazhou'])
     for line in edit_file("PKGBUILD"):
         if line.startswith("provides="):
             continue

@lilydjwg
Copy link
Member

那可以准备合并了吗？

@Misaka13514
Copy link
Member Author

还有4个AUR包没有maintainer，我应该在PR中取消aur_pre_build还是等维护者稍后在AUR adopt后自行修改？

@lilydjwg
Copy link
Member

可以写最后打包者。

@Misaka13514 Misaka13514 marked this pull request as ready for review May 30, 2025 06:34
@Misaka13514
Copy link
Member Author

由于最近 AUR 恶意投毒事件再次发生，我重新 rebase 了我的 commit 并重新检查了我的修改。

更新如下：

  • 新增 harden way-secure

当前的PR更改如下：

  • 对 aur_pre_build 中没有设置 maintainer 的 lilac 配置用脚本通过 AUR RPC 批量了添加现有 AUR Maintainer 和 CoMaintainers
  • 使用 requests 抓取 AUR 网页，确认 Last Packager 在 Maintainer 和 CoMaintainers 中，如果不在，就也将 Last Packager 添加到 lilac 配置中，有以下包添加了 Last Packager
    • abcde
    • cd-discid
  • 对于没有没有 Maintainer 的包，使用 Last Packager 作为 Maintainer，有以下包仅使用了 Last Packager
    • cataclysm-dda-ncurses
    • hpoj
    • httpry
    • python-pdm-pep517

https://t.me/archlinuxcn_group/3505867
这个方案不太好啊，真的能合并吗？只是获取当前 aur 维护者勉强亡羊补牢，应该还要检测最近是否更换过维护者？

从 5 月以来没有换过维护者。

那可以准备合并了吗？

@lilydjwg 如果不需要维护者检查的话，可以准备合并。如果需要检查，我可以创建对每个维护者应该检查的包的列表。

@hour-keeper
Copy link
Contributor

这么干感觉evil过头了，假如有长期的恶意包无人检查就直接呆仓库里了，或许改成无人修改并认领的包直接弃置好些

@Misaka13514
Copy link
Member Author

建议maintainer review各自的包，我晚些时候会整理一个列表。

直接弃置可能过于谨慎，但也是一种好方法。

@hour-keeper
Copy link
Contributor

建议maintainer review各自的包，我晚些时候会整理一个列表。

同意，可以先弄个列表，请管理员公示一段时间，然后再弃置

直接弃置可能过于谨慎，但也是一种好方法。

我不认为，linux以缺乏杀毒软件著称，一旦被恶意软件感染，即使是当事人也很难察觉

@Misaka13514
Copy link
Member Author

我不认为，linux以缺乏杀毒软件著称，一旦被恶意软件感染，即使是当事人也很难察觉

我将会使用VirusTotal扫描仓库中的这些包，并整理结果

@Misaka13514
Copy link
Member Author

Package Version Architecture ArchLinuxCN Maintainers AUR Maintainers SHA256
netease-cloud-music-gtk4 2.5.0-1 x86_64 BruceZhang1993 tkit, AutoUpdateBot dd9c69f0ac77a5f36a915143264d85e221c9db07bf6b5f54b0c5918eb363783e
python-pdm-pep517 1:1.1.4-7 any CoelacanthusHex flyin1501 ecf1bb118e6133c0c246936e54ecd663d465dac2f3d928ae4420a54f14e32471
china-ip-list-git 0.86.ad96987-1 any felixonmars felixonmars cdc056eb18386ba012f6d28ac7dee6f916ad47ef0d5b377c4d39ab7d7be85e8c
chnroutes2-git 0.52234.173889b4-1 any felixonmars felixonmars 0eafb3d180a5dd0a3e400f00527ba1f58e430a7e17c7cc1848a0e01ddd3ea5ba
chnroutes-alike-git 0.153.2be7008-1 any felixonmars felixonmars 753217420714996db6205ea31932bd778b75233945fcb91d27c236ac89b0b128
dnsmasq-china-list-git 0.261298.c5e159f1ab-1 any felixonmars lilac, felixonmars 666b4a75728d292527bed3566f1e961befec9c7d1e81743246154060abee75ad
downgrade 11.5.2-1 any felixonmars atreyasha, brisbin33 4cdd15e19e4d07726059b494902d2e02f0b5a94ce2127b6b9a43038664f5de9d
java-service-wrapper 3.5.59-1 x86_64 KenOokamiHoro skydrome, Salama 42da8dca37f63a2b0bf84c86ed034da0caf353d8d3a55c9c997a4615d4ea81d5
way-secure 0.2.0-4 x86_64 Kimiblock Kimiblock e6cd9e0ef22fab8cb15ff0abab128ffcb17425993498190cc2823b108b107256
beancount 3.1.0-1 x86_64 lilydjwg wzyboy c0e92bbdf0b92b716012e9abb4d2e4cb2d5dab951e5f432126ca568b4f597e3f
abcde 2.9.3-7 any MarvelousBlack FabioLolix, arojas f1773e9c22871fef83f5e22f279cf0b6e9fde523cbfa9200ca9abcce7f008f71
cd-discid 1.4-4 x86_64 MarvelousBlack FabioLolix, arojas 29c48941305ade73e355741ea6cf02df34c446ccca222df3d890654ff8d51cf7
cataclysm-dda-ncurses 0.E.3-1 x86_64 petronny Mr.Smith1974 aca4eced5bb193a8c6fcbf64aa0982b96bac6cca01e2ada7d5b7d6d660f05026
hpoj 0.91-21.1 x86_64 petronny ShadowKyogre 9b4bc056584994512f203cd16a76cc738acf9660383cd1476652ba948bcc0cf2
js-beautify 1.15.4-2 any petronny C0rn3j 1216ed1d4da43c6f414b8afd647ddee3ea164500618b79d275640cafcde950fa
kmozillahelper 1:5.0.6-2 x86_64 petronny fordprefect c5128934b631466381c610c5341a1042af3af73c34bb19ab68e8c3885f7e1457
libnatspec 0.3.3-1 x86_64 petronny natrio 4c738d68299e09f1eb2a533fcb76f5d5a922d1c2f395b6d0befd50ba38bb8aba
minecraft-launcher 1:2.1.3-3 x86_64 petronny pschichtel 018ae56baa3fa6fc5deb030ef264fbaf0a601231c1c407ae23fea9594133ff0b
minecraft-server 1.21.7-1 any petronny edh b9d6992d202d007f17b1bdb2dc684725b78b585b98a70237d888b23c40c8e345
p7zip-natspec 17.05-2 x86_64 petronny buzztaiki 159417d5f7d1e7854125ba7b8c3d9986833d49888fc991f1cd23bb98eac9b92c
qt-installer-framework 4.8.1-3 x86_64 petronny Skycoder42, Muflone 914706ad27af77459569e449d0fb6d915205a0846009e696e619ce0456e7fd99
rssdrop 26.4614df7-1 any petronny petronny 17b4df7971fbb24d3a2a479f15368f5ef2daaab01e58878afcc79ff5f82275be
spigot 1.21.6+b193-1 any petronny edh fbfd40762c425b8d77771b97f3253c4f7577fdf31446fd75b66de7877160ac37
sssm 1.2.1-2 any petronny Infernio e858f24133cf466ad3f738a67dec0571651a9b02693fc578c9339f001d6eaa32
unzip-natspec 6.0-7 x86_64 petronny natrio 1880ab0c2ddd2f42270205d255cb3f0abb59c70cab953bb6133665938564ea25
vim-fcitx 1.2.6-2 any petronny SilverRainZ 54b4eb4a9f204da8437f721b7f67ed13c0b0108e2da4a4d37d78156ab4793bac
vim-pathogen 2.4-1.1 any petronny drrossum 81900873f8e4e573522a4fea267e28ec6a3a0d224589a7e68533b008ef2371e4
xscreensaver-arch-logo 6.12-1 x86_64 petronny morgenstern, Geballin 3c70363571fbe6c8503f46d61b13ea50b8f593fb5deaa52f6716e6f102a4ef73
zotero-bin 7.0.22-1 x86_64 petronny juanmah 1ee9714b24752ff44c190d6cc544e73e2fa7e2db71363bfd24612f3182c16bb9
cloudflarespeedtest 2.3.4-1 x86_64 qwIvan ZhangHua a657c828665d7bcc976e3ed5c56decab104281d656d343520b01ea72fffcd0da
httpry 0.1.8-2 x86_64 qwIvan carstene1ns 445231df6537a81f65f2856ab1d7ce4bc9ed8082016a7b1858a875a80e1e579e
pip-tools 7.5.0-1 any qwIvan SpotlightKid f509d01e2a86dbc2f18ec5832d609fd591f27c8588b28a7a05a90009e0042d32
ptpython 3.0.30-2 any qwIvan kwrazi 1919dd5210b9c2fe2bc5a501200d5d77e688d89bce6e98c52bfecf58be9353f5
pacman-pstatus 0.3.1-1 any renyuneyun renyuneyun a21691c0e958d8eadbddacada1636fc8956d77809ab42681b3eb45278b0d6ee1
trilium-bin 0.63.7-1 x86_64 renyuneyun kleutzinger, OnyxAzryn aa763cd52f19e174a870455e53909d3b9210cce8f1eeca58ad4402e701f04407
python-pygresql 5.2.2-4 x86_64 Sasasu beeender 33c91821dce51840448516e58a5123fd239271ea77bca22f64c103f4b84df1b9
hustmirror-cli 1.1.4-1 x86_64 tttturtle-russ TurtleRuss 31da4e3f2bba1f3b6ad9f91c214eecff62751fbc2295f99baae8fbd1b8b8dd61
python-soco 0.30.10-1 any tttturtle-russ TurtleRuss 7bd8ee7936708771a772a14cfee9b570c417c041728b774b8757ee8c089007c6
qt5-wayland-decorations 5.15.17+kde+r57-1 x86_64 tttturtle-russ yochananmarqos db01cd245fb2d046e82c905bf1284f9e438f3fae5503f993a420859cb11a176b
python-pywavelets 1.8.0-2 x86_64 Universebenzene carlosal1015, AutoUpdateBot b984a9d2004be15f02bd31f3ad27cdb74c59facb423430be304d2909385df75c
lilac-git r1241.cc5a17c-1 any yan12125 yan12125, malacology, lilydjwg a4b98abd1d1f3ffa56c31618eb9ee046d37b7add8278baaaf7da698e4c48f2a4
go-for-it-git 1411.b531790-1 x86_64 ykelvis btd1337 c386a679ae1033460884c281af9a90a65ba33d51bfb7a88d008043187240fbf0

@Misaka13514
Copy link
Member Author

我将会使用VirusTotal扫描仓库中的这些包，并整理结果

VirusTotal都是零报毒，仅供参考

@Misaka13514
Copy link
Member Author

如果现在不急着review的话，可以等 #4378 完成后我再整理一次

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@lilydjwg lilydjwg

@felixonmars felixonmars

@renyuneyun renyuneyun

@petronny petronny

@BruceZhang1993 BruceZhang1993

@qwIvan qwIvan

@Sasasu Sasasu

@MarvelousBlack MarvelousBlack

@KenOokamiHoro KenOokamiHoro

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

harden aur_pre_build