Post #3320048

2026-06-14 19:50 UTC

This dipshit (me) hasn’t reinstalled their OS since 2014. Not Arch btw. But if my OS was affected by a supply attack like this, I wouldn’t trust the analysis on which packages were affected and which weren’t so I’d likely nuke and pave as all my and my family data is here.

Replies (3)

@Cyber@feddit.uk 2026-06-14 22:33

As long as you’re using a slower release cycle, ie something like Debian, then you shouldn’t need to be concerned. I think anyone riding the crest of the wave with Arch (& esp. the AUR) would likely be aware that things break, so, supply chain attacks are likely to be seen here quicker. I honestly wouldn’t be surprised if PPAs had similar issues, but might take longer to be noticed. Personally, I have a lot of Ansible building my stuff, so actually rebuilding things wouldn’t be an issue, but, would I then be installing everything with all the current latest malware…?

Open ##3320047
@yardy_sardley@lemmy.ca 2026-06-14 23:06

I wouldn’t trust the analysis either; luckily most PKGBUILD scripts are quite short and simple. It would take significantly less effort to hand-audit every single file I’ve gotten from the AUR than it would to reinstall Arch.

Open ##3320230
@thingsiplay@lemmy.ml 2026-06-14 20:04

If your current system were affected by a supply attack, then you would reinstall your system too. I use Arch^[1]^, BTW and did not reinstall the system. 1: Arch=EndeavourOS

Open ##3352239