Gentoo Linux holds the reputation of being a “build it yourself” distribution; it needs you to download the source code from the web and compile it on your own. Making this experience scary, some unknown notorious actors have hacked Gentoo Linux GitHub repository and infected it with malware.
As per the official statement from Gentoo developers, the incident took place on 28th June at about 20:20 UTC. So, if you downloaded anything from the distro’s GitHub repo recently, consider it compromised and get rid of the same.
“We are still working to determine the exact extent and to regain control of the organization and its repositories,” the statement reads. The hackers “modified the content of repositories as well as pages there.”
Code hosted on Gentoo infrastructure is safe
Before you start freaking out, let me tell you that any code hosted on Gentoo’s own infrastructure, which is the masted Gentoo build repo, is SAFE; the code hosted on GitHub is just a mirror.
It means that if you’ve been performing the downloads via gentoo.org, things are fine in your case. It’s worth noting that all changes in the main repository are digitally signed, and you can verify them for their integrity.
It’s also worth appreciating that Gentoo developers made things clear and posted the announced on their website without keeping the users in the dark for long.
The developers have promised to share more updates, and we’ll be telling you the same when they’ll become available.
