Arch Linux

PeterBB

Member

Registered: 2014-11-06

Posts: 37

Ghost update

I recently received an email notice that mp3guessenc had been updated.
  https://aur.archlinux.org/packages/mp3guessenc
Seems it was updated by tippfehlr on 12th June.

But there are no recent commits!
  https://aur.archlinux.org/cgit/aur.git/ … p3guessenc

Whats actually been updated then?
( tippfehlr is not listed as a maintainer for this package. )

I have no idea if this is related to the current malware issue,
but the timing seems suspicious.

Cheers,
Peter

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 76,569

Re: Ghost update

https://md.archlinux.org/s/SxbqukK6IA - mp3guessenc was subject to the recent https://archlinux.org/news/active-aur-m … -incident/

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

PeterBB

Member

Registered: 2014-11-06

Posts: 37

Re: Ghost update

.... - mp3guessenc was subject to the recent ....**!!

Thanks for clarifying that bit.
I'm still puzzled though;   @Anyone ...

Is tippfehlr a bad actor (1),
or is he fixing the issue as a TU (2),
or was his identity spoofed somehow (3)?

And what was actually updated as there is no git commit?

mithrial

Member

Registered: 2017-03-05

Posts: 156

Re: Ghost update

I believe the offending commits were purged from history, so they cannot show up anymore.

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 76,569

Re: Ghost update

or is he fixing the issue as a TU (2),

Let's hope so, or we got bigger issues
https://archlinux.org/people/package-ma … #tippfehlr

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

PeterBB

Member

Registered: 2014-11-06

Posts: 37

Re: Ghost update

I believe the offending commits were purged from history, so they cannot show up anymore.

Ok, that bit makes sense to me.

But the package was not orphaned,
so how could someone who is not the maintainer,
make offending commits in the first place?

loqs

Member

Registered: 2014-03-06

Posts: 18,967

Re: Ghost update

But the package was not orphaned,
so how could someone who is not the maintainer,
make offending commits in the first place?

What is your source for the historic orphan status of the package?

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 76,569

Re: Ghost update

The current maintainer is https://aur.archlinux.org/account/linasundstrom which is most likely the nefarious (and now inactive) account.

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

PeterBB

Member

Registered: 2014-11-06

Posts: 37

Re: Ghost update

What is your source for the historic orphan status of the package?

https://aur.archlinux.org/cgit/aur.git/ … p3guessenc

But I was not aware that folks were deleting commits,
so I know now that the history is incomplete.

loqs

Member

Registered: 2014-03-06

Posts: 18,967

Re: Ghost update

But I was not aware that folks were deleting commits,
so I know now that the history is incomplete.

The commit history even if complete does not track maintainer ownership or who has commit access. A package can be orphaned,  adopted or switch maintainers without any git record. The git only records what changes were made to the package.