Arch User Repository

“a paste bin for package build scripts you have to go out of your way to enable and use at your own risk”

“I only use AUR packages that just wrap binaries from well known sources”

“essentially anyone, at any time, can become a "mirror" and host whatever code they want, with zero review”

“AUR packages are maintained by randoms on the internet. Anyone can sign up and push a package.”

“use the AUR mindfully in terms of which packages you install and review the code”

“The AUR is still a better option than using curl to freebase shell scripts”

“the vast majority of Arch users use and speak about AUR as if it were a part of arch proper”

“Where Arch screws up is in allowing people to take over abandoned PKGBUILDS instead of making them create new ones.”

“I think Arch has to rethink what the AUR really is for in the age of AI.”

“the security problems with unilateral adoption of orphaned packages by unprivileged users are fundamental and unfixable”

“this is a good hardening measure from the Archlinux team”

“It's one of the tradeoffs for a heavily user supplied repository of packages.”

“Publishing a AUR is easy, getting something from an AUR to official is hard and most people give up”

“It's mostly fine, but it's not exactly a surprise when things go wrong.”

“No need to trash the entire AUR when there is one specific feature broken”

“I think you overreact. Sure there were a few hundreds of compromised packages, but obviously it's a small percentage of all AUR.”

“in my (admittedly hazy memory) it's usually mentioned in the sense of "Arch is great because you always get the latest packages”

“a pretty convenient selling point if you use any esoteric software”

“The AUR has consistently had warnings around it of 'verify the PKGBUILD', far more so than any other package repository”

“It is very good to be able to find build/install files for everything”

“Its just a community host for packages, comes with warnings, and isn't enabled by default”

“Only the AUR made the lack of trust explicit and part of the culture.”

“Malware aside, there is very little quality control, and a poorly made AUR has the potential to break the system pretty badly.”

“those aren't vetted, those you need to take the time to review”

“I've also written PKGBUILDs before and have had packages in AUR.”

“A large number of "an Arch Linux update broke my system" is very likely due to incorrect AUR use”

“it's hard to see how Arch is a usable distro for most potential users without AUR”

“It's one that places the burden of verification and validation on the system administrator”

“PKGBUILDs are easily readable/reviewable and rarely go beyond a single page.”

“Still the policy which allows relatively easy adoption of orphaned packages is IMHO a problem.”

“AUR doesn't guarantee security, its upto the user to use AUR & verify before installing anything”

“Anyone can make an account and upload to AUR and it has exactly 0% to do with the distro maintainers.”

“I wish AUR packagers used utilities like namcap and chroot building to check their packages before pushing their slop onto the AUR”

“AUR can be more secure and predictable than alternatives as you build locally from first-party sources”

“The AUR, along with Arch's minimalism, is one of my favorite things about it.”

“Wiki and AUR completeness are hard to pass by.”

“AUR is particularly useful because Arch has really simple build scripts.”

“just look at the Aur of Arch Linux which works perfectly”

“Using a separate repo for each package, like the Arch User Repos, does not have the same problems.”

“It's still a package manager. You're not running the config and make commands yourself.”