Arch Linux

Morten Linderud is resigning from the Arch Linux development team. The article provides a link to the official announcement and a Hacker News discussion thread with limited engagement metrics.

The Arch Linux project has temporarily disabled adoption of Arch User Repository (AUR) packages following a surge in malicious takeovers of existing packages.

Valve and Collabora are developing an Arm64 port of Arch Linux called Holo Core for the Steam Frame VR platform, aiming to integrate it into the official upstream distro. The effort supports SteamOS 3, which is based on Arch Linux, and the Steam Frame will use a 4 nm Snapdragon 8 Gen 3 chip instead of AMD CPUs.

Arch Linux has stated that a malware incident affecting more than 1,500 packages is now under control. The incident involved compromised packages in the Arch User Repository (AUR).

Attackers hijacked over 400 packages in the Arch User Repository (AUR) to install a Rust-based credential stealer that harvests developer secrets. The malware can load an eBPF rootkit to hide itself when executed with root privileges. The AUR is a community-maintained package collection separate from Arch Linux's official repository.

A proof-of-concept exploit has been released for the PinTheft Linux privilege escalation vulnerability, allowing local attackers to gain root privileges on Arch Linux systems. The vulnerability was recently patched. This exploit allows attackers to escalate their privileges.

Arch Linux has introduced a new Docker image that is bit-for-bit reproducible, ensuring consistent builds across different environments. This update addresses a key need for developers requiring verifiable and deterministic package builds.