# Arch User Repository Hacker Approved page: https://hackerapproved.com/p/arch-user-repository/ 24 people recommended Arch User Repository in Hacker News comments, 25 had mixed feelings and 85 criticized it, November 2025 to October 2026. It was recommended in 9 of 12 months, in 18 threads. It does not meet the Hacker Approved badge rule. **Verdict:** More people criticize it than recommend it. Gives Arch users packages missing from official repos, with readable build scripts. Critics warn packages are unvetted, so review them before installing. Summary written by Claude from the comments below. ## What people warn about - Abandoned package adoption is risky (3 comments in the sample): "the security problems with unilateral adoption of orphaned packages by unprivileged users are fundamental and unfixable" ([source](https://news.ycombinator.com/item?id=49125402)) "Where Arch screws up is in allowing people to take over abandoned PKGBUILDS instead of making them create new ones." ([source](https://news.ycombinator.com/item?id=49126622)) "Still the policy which allows relatively easy adoption of orphaned packages is IMHO a problem." ([source](https://news.ycombinator.com/item?id=48503465)) - Users must verify packages themselves (3 comments in the sample): "The AUR has consistently had warnings around it of 'verify the PKGBUILD', far more so than any other package repository" ([source](https://news.ycombinator.com/item?id=48604874)) "AUR doesn't guarantee security, its upto the user to use AUR & verify before installing anything" ([source](https://news.ycombinator.com/item?id=48502745)) "a paste bin for package build scripts you have to go out of your way to enable and use at your own risk" ([source](https://news.ycombinator.com/item?id=49193178)) - Poor quality control breaks systems (3 comments in the sample): "I wish AUR packagers used utilities like namcap and chroot building to check their packages before pushing their slop onto the AUR" ([source](https://news.ycombinator.com/item?id=47340679)) "Malware aside, there is very little quality control, and a poorly made AUR has the potential to break the system pretty badly." ([source](https://news.ycombinator.com/item?id=48519237)) "A large number of "an Arch Linux update broke my system" is very likely due to incorrect AUR use" ([source](https://news.ycombinator.com/item?id=48505221)) - Anyone can upload, no review (2 comments in the sample): "Anyone can make an account and upload to AUR and it has exactly 0% to do with the distro maintainers." ([source](https://news.ycombinator.com/item?id=47639869)) "AUR packages are maintained by randoms on the internet. Anyone can sign up and push a package." ([source](https://news.ycombinator.com/item?id=49147386)) ## Why people recommend it - Build files for nearly everything (2 comments in the sample): "It is very good to be able to find build/install files for everything" ([source](https://news.ycombinator.com/item?id=48604805)) "Wiki and AUR completeness are hard to pass by." ([source](https://news.ycombinator.com/item?id=47027622)) - Readable, simple build scripts (2 comments in the sample): "PKGBUILDs are easily readable/reviewable and rarely go beyond a single page." ([source](https://news.ycombinator.com/item?id=48503593)) "AUR is particularly useful because Arch has really simple build scripts." ([source](https://news.ycombinator.com/item?id=47021965)) - Builds locally from upstream sources (2 comments in the sample): "AUR can be more secure and predictable than alternatives as you build locally from first-party sources" ([source](https://news.ycombinator.com/item?id=47099031)) "The AUR is still a better option than using curl to freebase shell scripts" ([source](https://news.ycombinator.com/item?id=49127373)) ## Other package repositories people recommend - [Nixpkgs](https://hackerapproved.com/p/nixpkgs/): 33 recommend, 4 mixed, 21 criticize - [crates.io](https://hackerapproved.com/p/crates-io/): 14 recommend, 3 mixed, 18 criticize - [CPAN](https://hackerapproved.com/p/cpan/): 12 recommend, 0 mixed, 10 criticize - [PyPI](https://hackerapproved.com/p/pypi/): 10 recommend, 6 mixed, 26 criticize ## The badge A product earns the Hacker Approved badge when at least 10 people recommend it, recommenders outnumber critics at least 2 to 1 (mixed feelings count toward neither side), it was recommended in at least 4 of the 12 months and in at least 5 different threads, and no single thread supplies more than half of the people who recommend it. Health and money products are never badged. ## Cite as Hacker Approved, "Arch User Repository", https://hackerapproved.com/p/arch-user-repository/ (24 recommend, 25 mixed, 85 criticize; Hacker News comments, November 2025 to October 2026). Counts updated 2 Nov 2026, with data through October 31, 2026.