Registration to the AUR is now reopened. The new release includes changes to harden account registration.
Summary of related changes:
Disposable email addresses are now rejected.
Email verification is now mandatory, most users are unaffected but new accounts must verify their email address via a time-limited token which is valid for 24 hours.
Email changes are locked during the verification cooldown.
If you spot suspicious registration activity or packages, please flag them in ML as usual.
So, in short: Those who didn’t had an account yet would now have the opportunity to register for an account. Which isn’t a strict requirement to use the AUR. But would be required if you want to maintain / submit a package to the AUR or simply want to interact via comments, vote for an package or flagging packages in case they’re out of date and such.
In short: I’m convinced that actively participating , even in the simple form of voting for your installed packages, and providing feedback would contribute to tame the AUR.
Well said. Since the attacks, I’ve voted for all of the AUR packages that I regularly use, but I build them myself instead of using a helper like yay. Is it safer? Maybe, maybe not. At least I feel a little more in control.
I went a bit further and started analyzing the AUR with the goal of submitting deletion requests for old packages that are defunct.
But besides my very first deletion request that has been accepted, the second batch of packages are still pending requests.
But there would be the official AUR Cleanup Day on September 20th, and I’ll go to improve my packages analysis and continue submitting deletion requests in front of that housekeeping date. And share my progress in that topic accordingly.
