Conversation

Notices

1. Embed this notice
   Rich Felker (dalias@hachyderm.io)'s status on Thursday, 05-Mar-2026 23:54:01 JST Rich Felker

   • Alpine Linux :alpine:

   Question for @alpinelinux (and other distros): Is there any tooling in place or proposed to catch and block package version bumps, particularly for important dependencies, that would pull in slop code that might introduce bugs and vulnerabilities? Stuff like checking for commits by known slop agents or presence of known prompt files.

   Even if a distro doesn't want to permanently hold these packages back or switch to forks (my preference), it seems like any further version bump now requires detailed review for breakage.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Friday, 06-Mar-2026 00:08:55 JST Rich Felker

     in reply to

     • Morten Linderud
     • Arch Linux
     • Alpine Linux :alpine:

     @Foxboron @alpinelinux @archlinux That's what I'm worried about. Reviewing package bumps was less important when the maintainers were generally expected to be trustworthy and had their repurations on the line if they did anything awful. If they've outsourced that accountability to slopbots, then now bumps require serious review. And I'm worried they're not going to get that.

   • Embed this notice
     Morten Linderud (foxboron@chaos.social)'s status on Friday, 06-Mar-2026 00:08:57 JST Morten Linderud

     in reply to

     • Arch Linux
     • Alpine Linux :alpine:

     @dalias @alpinelinux

     From the @archlinux side; there is not.

     But code review of individual package bumps is something few distros do.