# Arch User Repository

34 Hacker News commenters recommended Arch User Repository and 74 criticized it, November 2025 to November 2026. It was recommended in 5 of 13 months.

**Verdict:** Gives Arch users packages missing from official repos, with readable build scripts. Critics warn packages are unvetted, so review them before installing.

## Why people recommend it

- Build files for nearly everything (2 comments): "It is very good to be able to find build/install files for everything" ([source](https://news.ycombinator.com/item?id=48604805)) "Wiki and AUR completeness are hard to pass by." ([source](https://news.ycombinator.com/item?id=47027622))
- Readable, simple build scripts (2 comments): "PKGBUILDs are easily readable/reviewable and rarely go beyond a single page." ([source](https://news.ycombinator.com/item?id=48503593)) "AUR is particularly useful because Arch has really simple build scripts." ([source](https://news.ycombinator.com/item?id=47021965))
- Builds locally from upstream sources (2 comments): "AUR can be more secure and predictable than alternatives as you build locally from first-party sources" ([source](https://news.ycombinator.com/item?id=47099031)) "The AUR is still a better option than using curl to freebase shell scripts" ([source](https://news.ycombinator.com/item?id=49127373))

## What people warn about

- Anyone can upload, no review (3 comments): "essentially anyone, at any time, can become a "mirror" and host whatever code they want, with zero review" ([source](https://news.ycombinator.com/item?id=49147443)) "Anyone can make an account and upload to AUR and it has exactly 0% to do with the distro maintainers." ([source](https://news.ycombinator.com/item?id=47639869)) "AUR packages are maintained by randoms on the internet. Anyone can sign up and push a package." ([source](https://news.ycombinator.com/item?id=49147386))
- Abandoned package adoption is risky (3 comments): "the security problems with unilateral adoption of orphaned packages by unprivileged users are fundamental and unfixable" ([source](https://news.ycombinator.com/item?id=49125402)) "Where Arch screws up is in allowing people to take over abandoned PKGBUILDS instead of making them create new ones." ([source](https://news.ycombinator.com/item?id=49126622)) "Still the policy which allows relatively easy adoption of orphaned packages is IMHO a problem." ([source](https://news.ycombinator.com/item?id=48503465))
- Users must verify packages themselves (3 comments): "The AUR has consistently had warnings around it of 'verify the PKGBUILD', far more so than any other package repository" ([source](https://news.ycombinator.com/item?id=48604874)) "AUR doesn't guarantee security, its upto the user to use AUR & verify before installing anything" ([source](https://news.ycombinator.com/item?id=48502745)) "a paste bin for package build scripts you have to go out of your way to enable and use at your own risk" ([source](https://news.ycombinator.com/item?id=49193178))
- Poor quality control breaks systems (3 comments): "I wish AUR packagers used utilities like namcap and chroot building to check their packages before pushing their slop onto the AUR" ([source](https://news.ycombinator.com/item?id=47340679)) "Malware aside, there is very little quality control, and a poorly made AUR has the potential to break the system pretty badly." ([source](https://news.ycombinator.com/item?id=48519237)) "A large number of "an Arch Linux update broke my system" is very likely due to incorrect AUR use" ([source](https://news.ycombinator.com/item?id=48505221))

## Alternatives hackers recommend

- [Nixpkgs](https://hackerapproved.com/p/nixpkgs.md): 38 recommend
- [Arch User Repository](https://hackerapproved.com/p/aur.md): 20 recommend
- [crates.io](https://hackerapproved.com/p/crates-io.md): 17 recommend
- [PyPI](https://hackerapproved.com/p/pypi.md): 16 recommend
- [CPAN](https://hackerapproved.com/p/cpan.md): 13 recommend

## Cite as

Hacker Approved, "Arch User Repository", https://hackerapproved.com/p/arch-user-repository/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).