Oh dear, the situation with the Arch Linux AUR got a fair bit worse since GamingOnLinux initially covered the malicious packages.
  • ultimate_worrier@lemmy.dbzer0.com
    51·
    12 hours ago

    Lessons learned:

    • replace AUR with nixpkgs
    • stop using NPM, provision and build javascript with Nix (if you absolutely must use that garbage language and ecosystem)
    • stop using Pypi and Python, provision and build using nix if you absolutely must use the Python ecosystem.
    • stop trusting package managers with major security flaws in their build systems/ that place too much trust in community volunteers/ have no oversight

    I use Nix by the way.

    • Malgas@beehaw.orgEnglish
      1·
      9 hours ago

      Do you have any tips on how to set up a python environment using nix?

      I also use NixOS (btw) but have so far sidestepped this by the expedient of giving up on any project not in nixpkgs whose install process is a pypi script.

      • ultimate_worrier@lemmy.dbzer0.com
        1·
        2 hours ago

        Here’s an example dev environment for a web scraper provisioned in a flake:

        
{
  description = "Generic Web Scraper";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs?ref=nixpkgs-unstable";
    utils.url = "github:numtide/flake-utils";
  };

  outputs = { self, nixpkgs, utils }: utils.lib.eachSystem ["x86_64-linux"] (system: let
    pkgs = import nixpkgs { system = system; };
  in rec {
    packages = {
      pythonEnv =
        pkgs.python3.withPackages (ps: with ps; [ webdriver-manager openpyxl pandas requests beautifulsoup4 websocket-client selenium keyboard ]);
    };

    devShell = pkgs.mkShell {
      buildInputs = [
        pkgs.chromium
        pkgs.undetected-chromedriver
        packages.pythonEnv
      ];

      shellHook = ''
        export PATH=${pkgs.chromium}/bin:${pkgs.undetected-chromedriver}/bin:$PATH
      '';
    };
  });
}

        Not sure if it’s helpful but each Pypi package needs to be declared in that array. There are other ways to do it but this is an example I had laying around.