Oh dear, the situation with the Arch Linux AUR got a fair bit worse since GamingOnLinux initially covered the malicious packages.
  • ultimate_worrier@lemmy.dbzer0.com
    0·
    4 months ago

    Lessons learned:

    • replace AUR with nixpkgs
    • stop using NPM, provision and build javascript with Nix (if you absolutely must use that garbage language and ecosystem)
    • stop using Pypi and Python, provision and build using nix if you absolutely must use the Python ecosystem.
    • stop trusting package managers with major security flaws in their build systems/ that place too much trust in community volunteers/ have no oversight

    I use Nix by the way.

    • Malgas@beehaw.orgEnglish
      0·
      4 months ago

      Do you have any tips on how to set up a python environment using nix?

      I also use NixOS (btw) but have so far sidestepped this by the expedient of giving up on any project not in nixpkgs whose install process is a pypi script.