- Ukwephulwa okukhulu kwezokuphepha kuye kwabeka engcupheni amaphakheji angaphezu kuka-400 ngaphakathi kwe-Arch User Repository (AUR).
- Umkhankaso ononya usebenzise i-commit spoofing kanye ne-unofficial npm/bun dependencies ukuze kusetshenziswe ikhodi.
- Izindawo zokugcina ezisemthethweni ze-Arch Linux azithinteki nhlobo, njengoba inkinga ihlukaniswe kokuqukethwe okulondolozwe ngabasebenzisi.
- Abaphathi besistimu basusa ngenkuthalo izenzo ezinonya futhi bavimbela ama-akhawunti ahilelekile ekuhlaselweni.
Kube yizinsuku ezimbalwa eziphithizelayo kunoma ngubani oqhuba i-Arch Linux, njengoba kuvele izindaba mayelana nomkhankaso omkhulu we-malware okwazile ukungena kwi-Arch User Repository (AUR). Nakuba lesi sikhungo esiqhutshwa ngumphakathi sithandwa ngenxa yokukhetha kwaso isofthiwe eningi engatholakali ezindaweni zokugcina eziyinhloko, muva nje sibe yindawo yokuzingela yabenzi bobubi abafuna ukuxhaphaza ukwethenjwa kwabasebenzisi abangaqaphile.
Ukuze kucace kahle kusukela ekuqaleni, lesi sigameko sokuphepha sikhawulelwe kuphela ku-AUR futhi asithinti amaphakheji asemthethweni aphethwe ngqo yithimba le-Arch Linux. Kodwa-ke, ngenxa yokuthi abasebenzisi abaningi bathembele kubasizi be-AUR ukuze benze ngokuzenzakalelayo ukufakwa kwesofthiwe yabo, amathuba okuba kube nokuphazamiseka kwesistimu yendawo ngokuqinisekile abeke umphakathi endaweni yokuzivikela.
Ubuchwepheshe Bokuvumelana Kwamaphakheji angu-400
Ngokusho kwemibiko yobuchwepheshe kanye nezingxoxo zohlu lweposi, amaphakheji angaphezu kuka-400 ashintshiwe phakathi nalokhu kuhlasela okuhleliwe. Abasolwa abazange bahlose amathuluzi akhethekile kuphela; balandele okufakiwe okudumile njenge- exodus-wallet-bin, i-alvr, kanye ne-anythillm-appimage , beqinisekisa ukuthi ikhodi yabo enonya inethuba eliphezulu lokufinyelela izinhlelo ezahlukahlukene.
Esinye sezici ezikhathaza kakhulu kulo mkhankaso ukuthi abahlaseli bakwazile kanjani ukukhohlisa ubunikazi bomgcini emlandweni wabo wokuzibophezela. Ngokulingisa amagama namakheli e-imeyili abantu ababambe iqhaza ngokusemthethweni, benze izibuyekezo ezinonya zibukeke njengemisebenzi yokulungisa ejwayelekile, okwenza kwaba nzima kakhulu kumbukeli ojwayelekile ukubona ukuthi kukhona okungahambi kahle ngaphandle kokujula ikhodi.
Ngobuchwepheshe, i-malware yayivame ukusebenza ngokungeza ama-hook abiza amathuluzi afana ne-npm noma i-bun ukulanda ukuncika okungagunyaziwe njenge-atomic-lockfile . Ezimweni ezithile, njengasephaketheni le-nodejs-elm, i-PKGBUILD yashintshwa ukuze isebenzise izikripthi ngqo ngaphakathi kwesiqondisi se-/tmp, esivule umnyango wangemuva wokusebenzisa ikhodi yangaphandle ngesikhathi senqubo yokufaka.
Indlela Umphakathi Olwa Ngayo
Lapho nje kuphakanyiswa amafulegi abomvu ohlwini lweposi lwe-aur-general, abaphathi be-Arch Linux baqala isinyathelo sokususa izenzo ezinonya futhi bavimbele unomphela ama-akhawunti ahlobene nokwephulwa kwale nqubomgomo. Le mpendulo esheshayo ibe yinto ebalulekile ekuvimbeleni ukusabalala kwaleli gciwane, yize inqubo yokuhlanza inani elikhulu kangaka lamaphakheji iyinto enzima kakhulu.
Okunye ukusatshalaliswa ngaphakathi kwe-ecosystem, njenge-CachyOS, nakho kube nomthelela ngokukhipha izikripthi ukusiza abasebenzisi ukuthi bahlole ukuthi izinhlelo zabo zasendaweni zithintwe yinoma yimaphi amaphakheji asengozini. Nakuba lawa ma-scanner ewusizo kakhulu ekuhlolweni okusheshayo, awawona amaphutha, futhi abasebenzisi basaxwayiswa ngokuthi ukuskena okuhlanzekile akusho ukuthi kufanele bayeke ukuqapha.
Kulabo abavame ukudonsa isofthiwe kusuka ku-repo yomphakathi, isincomo samanje ukuthi bamise zonke izibuyekezo ze-AUR kuze kube yilapho isimo sesizinzile ngokuphelele. Uma kufanele ufake okuthile, kubalulekile ukuhlola ngesandla umehluko we-PKGBUILD ukuqinisekisa ukuthi akukho miyalo engavamile ye-npm noma ukulanda kwangaphandle okungalindelekile okufakwe ku-recipe yokufaka.
Lesi siqephu sonke sisebenza njengomsindo wokuvusa abasebenzisi asebekhululeke kakhulu ngabasizi babo be-AUR. Ukusebenzisa amathuluzi anjenge -paru noma i-yay kulula , kodwa akufanele kuthathe indawo yomkhuba wokufunda izikripthi ngaphambi kokucindezela inkinobho ethi enter, njengoba imodeli yokwethenjwa esabalalisiwe ye-AUR idinga ukuqondiswa ngesandla ukuze ihlale iphephile.
Leli gagasi lamuva nje lomsebenzi ononya liqokomisa umzabalazo oqhubekayo phakathi kokuvuleka kwezindawo zokugcina isofthiwe yomphakathi kanye nesidingo sezinqubo zokuphepha eziqinile. Ngenkathi izenzo ezisheshayo zabanakekeli ziqede usongo olusheshayo futhi zaqinisekisa ubuqotho bendawo yokugcina, lo mcimbi usebenza njengesikhumbuzo esicacile sokuthi abasebenzisi bangumugqa wokugcina wokuzivikela ohlelweni lokusebenza lwe-DIY. Ukuhlala unolwazi kanye nokwenza inhlanzeko yedijithali eyisisekelo kuseyindlela kuphela yokujabulela ukuguquguquka kwe-Arch Linux ngaphandle kokuba yisisulu salezi zinhlobo zokuhlaselwa kwe-supply chain okuhleliwe.
