im re-posting this as when i sent my last email i forgot to subscribe to
aur-dev
first of all thank you if you read this and i would like to forward my
proposal to you regarding the AUR malware problem and how we can look at
fixing it with an official CLI developer tool and new staging workflows to
make the life of devs easier without needing any effort from the tus:
i think the arch team can make an official developer CLI tool called
aurctl. right now making and updating packages is a bit of a mess because
people have to use a web portal for ssh keys, manually build .SRCINFO, and
push blindly to master.
with aurctl it can look like this:
1. aurctl auth login -> uploads your ssh key to your profile via api
2. aurctl init <package> -> auto-generates a clean PKGBUILD template and
metadata files
3. aurctl push --commit="msg" -> locally runs validation checks on the
PKGBUILD syntax, auto-builds .SRCINFO, and signs commits seamlessly
to fix the security without overloading the volunteer trusted users, the
code changes could just go to the package owners instead of the tus. if a
co-maintainer wants to change code, their push can go to a staging branch
instead of master, and the main owner can look at the diff and approve it,
which takes zero time from the arch staff. and if a package is orphaned and
someone tries to adopt it, the majority of the maintainers of that package
would have to agree and the changes could also be approved by the owner so
adopting and immediately changing would need the owners to approve more
than once and not need any effort from the tus.
and also to show the exact workings of how the aurctl authentication loop
functions locally and on the server, here is the basic step by step logic
for how it works:
1. When a user runs 'aurctl auth login' the first time:
[Client Side]
user_secret = "input_password"
unique_salt = generate_random_string()
secure_hash = sha256(user_secret + unique_salt)
-> Send secure_hash and unique_salt to the server
[Server Side Database]
Save user profile: { username: "name", salt: unique_salt, hash: secure_hash
}
(The cleartext password is never sent or saved anywhere)
2. When a user tries to run 'aurctl push' to update a package:
[Client Side]
-> Request package push for username
-> Server sends back that user's unique_salt from the database
[Client Side calculation]
input_secret = get_password_from_terminal()
current_hash = sha256(input_secret + unique_salt)
-> Send current_hash to the server along with the code payload
[Server Side validation]
if (current_hash == database.secure_hash) {
allow_git_merge_to_staging_branch()
} else {
reject_unauthorized_push()
}
this completely cuts out the risk of database leaks or credential sniffing
on public networks, and the server only has to execute a single basic
string comparison which requires almost zero CPU or memory footprint.
and again, thank you very much for taking my ideas into consideration and
making this wonderful distro