Note that AUR is generally untrusted, and is not an part of the Arch distro (but included in some derivatives). Arch users always were and are warned not to install packages from it without proper inspection. [Added: And adequate inspection just did become very hard!]
I think AUR is great for trying out things and sharing with people you know personally - and not much more.
For installing or distributing established, trusted software that is not part of the Arch distribution, I think Guix is better (which runs fine as an extra package manager in Arch, and has currently 31,000 packages, in spite of that it is relatively young).
But the general thing is one just cannot run untrusted, unverified code. Regardless from where - regardless whether it is AUR or pip or Anaconda or MELPA or Guix or crates.io . In terms of computing, it is like giving a stranger on the street the keys to your house.
Having a competent community reviewing software before it becomes part of a distro is what makes using Linux relatively safe (but not foolproof).
Is thr solution truly to tell people to read the build instructions and decide if a package is safe? I’m not an arch user, but I’ve used nixos and assessing nixpkg before installation gets old real quick real fast. Somehow I really doubt telling an average user to assessing pkgbuild on their own will be very effective.
It is a different situation, because Nix packages are part of the Nix distributdis, while AUR packages are not part of Arch. AUR packages are more like Ubuntu ppa’s, you can add and run them, but you are on your own risk.
Also,it is a huge number of packages (about 114,000) which are many used by relatively few people. Each arch user has in average probably only a few of these.
So, it makes sense that users review them by themselves. If you can’t do that, you should probably not use them.
Somehow I really doubt telling an average user to assessing pkgbuild on their own
Arch Linux is not really made for the average user, and using code from AUR even less so. I doubt it that everyone using Arch+AUR or CachyOS or youname it is served well by this.
And making it kind of accepted norm to run untrusted code as a non-technical user will bite the Arch community in the ass. For Arch, it is a phony measure of success to have many such users.
This is also a result of Windows user attitudes leaking into the Linux universe. You need to discern code and data, and you can’t run untrusted code, period.
+1 Guix
flathub stays winning?
“But it’s 100 MB larger than its AUR equivalent! That means bloat!!”
- Arch users probably
I wouldn’t have a problem if it was only 100 MB. The problem is when a couple of programs amount for several GB of dependencies. I still use flatpaks, but can’t have this in general. Flatpaks are more like extremely exceptional in my systems.
it is bloat. also were is your package for (insert any very obscure program). I guess your going to have to rely on appimages or building from source for this one!
Bloat implies the extra space is unused or without utility. The extra bytes in Flathub packages usually come from containerization, which adds a layer of protection for the user and makes apps interoperable across all OSes. It’s also funny that you’re calling those extra bytes bloat in a post where AUR users would have benefited from the containerized design.
Nah I’ll keep my 100 mb and ego thank you very much!
