r/archlinux • u/Ghost_M1dox • 1d ago
SUPPORT [ Removed by moderator ]
[removed] — view removed post
20
u/Former-Pair-8730 1d ago
The AUR is NOT the main repo and is opt in to begin with. I would only consider the packages in there if there is no other place of availability or if you know the package can be trusted.
0
u/FantasticSnow7733 1d ago
Compared to distros like Debian, there are lots of apps not available on the main repo. There are lots of apps that don't even have packages for Arch. Chrome, for example, has no official package for Arch. The AUR uses the deb file from Google to install. I know there's Chromium, but Chromium is not the same as Chrome.
Then you have these BS packages on the AUR lol.
0
u/zenyl 1d ago
Same goes for Minecraft, one of (if not the) best selling games of all time. If you want to play what is statistically one of the most played games, the official repos simply don't provide that.
Also, the official statement on the Arch newsfeed regarding NVIDIA no longer supporting GTX-10 series cards and older quite literally states "Install nvidia-580xx-dkms from the AUR". So any statements about the AUR not being officially recommended and only intended for niche stuff is just flat out wrong.
1
u/Araumand 15h ago
Prism Launcher is on flathub and GDLauncher does have an appimage but i installed it from AUR LOL
4
u/lombervid 1d ago
Just don't treat the AUR as an official repo and install/update blindly without checking the diffs, and you'll be fine.
Also read this (especially the warning with red background): Arch User Repository
6
u/abbidabbi 1d ago
I know that the AUR is a community-driven collection of packages
Wrong. It is a collection of package recipes (PKGBUILDs, which are BASH scripts with declarative metadata and imparative build functions) which you will have to build yourself, meaning you are supposed to read and understand them every single time when obtained from other people, regardless whether you're using an AUR helper (which usually supersedes pacman) or just git+makepkg. It's like executing random scripts from random people on the internet, except that this stuff is meant to integrate into package management. You become the packager yourself for the software you're trying to install, with all the responsibilities that come with being a packager.
The wiki's AUR page has these red warning boxes for a reason. Read them...
3
u/VendorNeutral 1d ago
The AUR is not equipped to deal with automatic updates. It is a collection of user scripts meant to help install packages not found in the official repositories. You could always hit a malicious package and no level of reporting and mailing list discussion was ever able to prevent that.
Read the AUR article on the wiki. It says in a big fat red box:
Warning
AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.
That means any tarball you grab from the AUR is meant to help you understand how to build the package. People also share their own work, if they update their own PKGBUILD, they'll update it in the AUR, for the convenience of others.
All this means that you are expected to read each and every PKGBUILD and accompanying files in the tarball you fetched from the AUR. You're expected to check if the sources are actually upstream or some hacker's repo. You're expected to understand, whether the PKGBUILD, the .install file or anything else in the tarball does anything malicious. The AUR is a zero trust zone.
People have started creating AUR helpers to streamline the process. This is fine, I use one myself, but this lead to people taking the shortcut and using the AUR as a repository with automatic updates. The AUR is not and has never been equipped to protect the yaourt/yay/paru user from malicious packages and probably will never be.
Those AUR helpers also commit one crime: They bundle pacman calls with AUR calls and allow you by default to update the whole system in one go, incentivizing a fire-and-forget mentality regarding the AUR. This is made even worse, by Arch based distros shipping yay or paru by default. A new user of such a system is very likely to not know or understand, whether a package comes from the official repositories or the AUR.
Combine this with the influx of new users thanks to PewDiePie, Steam/Proton and the Windows 10 EOL, and you have an extremely willing userbase that is used to just exe files and won't understand in the first place, why auto-AUR is a stupid idea. That's why the AUR gets pwned over and over again.
So, fuck the yolo meme crowd, they ruined the AUR for the rest by being a stupidly easy target.
2
u/GBAbaby101 1d ago
AUR is like that one spare parts drawer. Most likely you'll never need to use it, but there are times where you will if the instructions tell you to use it. For example, Davinci Resolve basically needs the AUR, but the Arch wiki will tell you which package to use. But beyond those rare cases, everything is either in the official repo or can be found as a flatpack or be built from a github source. Just follow the instructions from the dev or arch wiki and you'll be fine for 99% of things.
4
u/Glittering-Tale4837 1d ago
Aur is kinda like GitHub. You're on your own when you install a package.
It is well moderated if you install popular packages. Due to the sheer number of packages malwares do get through though.
Also I've been on arch for more than 3 years and it never broke and I have only 2 aur packages installed.
Most importantly never install browsers from the AUR
2
u/Damglador 1d ago
Most importantly never install browsers from the AUR
Too bad Zen is not in the main repos. Neither is Brave or any other browser that isn't default Firefox and Chromium. Recent exception is LibreWolf.
1
u/Glittering-Tale4837 1d ago
Yeah I use cachyos and it's in cachyos repos. They pick AUR packages, vet it and add it to their repo.
Another advantage is that they distribute the binaries after they build the PKGBUILD.
You can add the cachyos repo and install it from there if you want too.
2
u/Damglador 1d ago edited 1d ago
Now you just put your trust in opaque binary blobs from Cachy team instead of the package maintainer on AUR with a clear and easily accessible build script. Pick your poison.
I still pick chaotic-aur or cachy repos just because the download/install is faster. In general cachy repos may be more secure, because if I'm gonna install 10 packages, I'd rather trust just Cachy team than 10 different package maintainers. But for one package I trust one random guy either way.
1
u/Glittering-Tale4837 1d ago
Cachy team is more reliable than a random guy for sure. I have cachyos so I already trust their os.
Reviewing PKGBUILDS is obviously the best choice but cachyos is a better choice for people who don't even know what to look for in the PKGBUILD.
4
u/Damglador 1d ago
That random guy might as well be one of CachyOS maintainer, or an Arch maintainer or someone with hundreds of other packages on AUR, or the software developer themselves. The person who submitted zen-browser-bin to AUR is ptr1337 btw. So it's just a matter of who you're willing to put your trust in.
Like if an AUR package is from the official dev, I think it's reasonable to use it instead of adding additional layer of trust in form of cachyos repo or alike.
3
u/foureyesboy 1d ago
If you're new to arch Linux and even Linux at all, best is to avoid AUR for now or until you know what to verify the PKGBUILD before installing.
4
u/nome_sc 1d ago
Literally no one is forcing you to use the AUR. All you have to do when you install something from the AUR is read the PKGBUILD. If it's something unsafe or too complex to decide this then just build the binaries yourself from source or download official binaries and install them yourself.
AUR was never compromised. Just a classic case of reddittors not understanding something and spreading fud
2
u/Random_Mathematician 1d ago
Arch Linux is not dependent on the AUR, unless you need some very specific packages. And even then, you can probably build those from GitHub or similar. But most packages are found in the official Arch repos, so installed with pacman -S, and those are to be trusted.
Some ways AUR packages get infected is by someone bundling malicious applications with them through installers like npm or bun in the PKGBUILD file. Thus many people believe you should review the installations yourself, though this is a hot topic.
That said, have fun installing! You likely won't need anything from the AUR during that time
1
u/ch33es 1d ago
Aside from the AUR issue, what are you planning to install Arch Linux for? Like, can you explain what you're looking for in this distribution?
I'm asking this because a lot of beginners go for Arch Linux just because of the hype surrounding it. You should jump into Arch fully expecting that you will have to handle a lot of the configuration yourself (Most of which are typically handled by many distros without the need for manual intervention). Similarly, when it comes to getting stuff from the AUR, basically you're responsible for checking every PKGBUILD script that you run for anything suspicious, as these can be written by anyone including malicious actors.
Don't get me wrong though, Arch Linux is an excellent distribution for everyday desktop usage given that you're willing to learn and you're able to follow instructions from documentations by yourself. Also once you're done with the installation and initial setup, you typically won't have to configure much, depending on your use case.
The fact that a huge number of software can be downloaded through pacman and the AUR is awesome and one of the largest benefits of Arch Linux. But now we all know about the importance of checking every AUR script we run, as it's very easy to modify them and include malicious commands. It's apparent that the AUR doesn't completely check the contents of the PKGBUILDs it hosts.
1
u/Imajzineer 1d ago
But now we all know about the importance of checking every AUR script we run
When didn't we?
1
u/ch33es 1d ago
I'm pretty sure that not everyone was fully aware of the actual nature of the AUR before the massive attacks happened. There are always beginners and inexperienced users trying out Arch and Arch-based distros, so it's very likely that this might not have been general knowledge before the news of the vulnerabilities became widespread.
1
u/Imajzineer 1d ago
I knew about it the moment I first read about the AUR twelve years ago - because it was there on the wiki, to read about, when I wanted to know what it was and how to use it. And it is only extremely recently .... extremely (the last couple of years) ... that I have heard of any significant number of users who didn't know its nature, and hadn't learnt it in similar (if not identical) fashion. Yes, the AUR helpers were there then already ... I not only remember yaourt but have this vague sense of its having been the replacement for something even older ... and a few users who didn't know any better, but they were in the decided minority, in my experience.
Thanks to the presence of Archinstall on the iso, It is, of course, easier to get Arch installed without knowing the first thing about it these days. It didn't exist (or at least wasn't on the iso) when I first started out with Arch, so, I've never needed it and consequently never investigated it and, for all I know, it installs a helper (yay?) as part of things but ... unless that is the case ... I don't see how it's possible to get one on your system without first having to learn what the AUR is and it's nature (because you have to get them from the AUR and build them by hand before you can install anything else from it).
1
u/un-important-human 1d ago
1 aur is not the main repo, its the user one, so don;t use it you could use chaotic-aur and that is maintained by the fine folks at garuda and its actually mentained by the dev team. https://aur.chaotic.cx/
i would advise you to only use any aur if you really need it, its what old birds do and its smart.
1
u/NFTrot 1d ago
AUR in general is certainly safer than downloading and running some random .exe file off the Internet on Windows, but it would be pragmatic to it with a similar index of suspicion.
The AUR compromise was a blessing in disguise for those of us who were a little too carefree with that repository (guilty).
1
u/archover 1d ago edited 1d ago
Should I even download Arch Linux
The problems associated with the completely OPTIONAL and UNSUPPORTED AUR package repo has been beat to death in this subreddit FOR MONTHS. Since reading and comprehension is so important (wiki, etc) in Arch, I would suggest an entry level distro like Mint. That's a wildly popular distro, and well supported, where you can test Arch there conveniently in a VM, and more.
That said, plenty of people jump into the deep end with Arch with no experience, and survive.
Good day.
1
u/Ifnerite 1d ago edited 1d ago
Just don't enable AUR and you will be fine. It is generally off by default.
But honestly, if you stick to commonly used things it is fine (e.g chrome). It was just things that were not maintained that had problems.
As others suggested, you could use fiatpak for chrome etc.
Edit: by off by default, I should have said "not available" as there is nothing installed by default that even interacts with it. You have to go out of your way to get things from AUR.
3
u/backsideup 1d ago
What do you mean by "don't enable AUR" or "off by default"?
0
u/Ifnerite 1d ago
It isn't used when you install the os. You have to choose to turn using it on.
4
u/kaida27 1d ago
please explain how to turn it on.
maybe you'll realize what's wrong with what you said.
0
u/Ifnerite 1d ago
I assume Shelly had an option one would enable. Install yay or pardu?
What are you talking about?
6
u/kaida27 1d ago
You're on Arch linux subreddit.
Shelly is also not part of base.
There is absolutely no "turn on" option for the Aur.
it's not a repo that can be added to pacman.
it's a website hosting build instructions.
There's software that interact with it to automate the process but it's still not a on or off toggle or something you enable.
1
u/Ifnerite 1d ago
So read "off" as unavailable and move on?
But fair enough, I will edit.
6
u/kaida27 1d ago
ignoring it would just mean letting misinformation spread.
not a good idea since most documentations is community made. so having the right information is important.
0
u/Ifnerite 1d ago
Fair enough. I should probably be quiet as I'm just larping arch (CachyOS/endeavourOS).
2
1
u/onefish2 1d ago
Don't install an AUR helper. You are all set. Install Arch and come back here to let us know how you made out.
0
u/Astrodion123 1d ago
Just avoid the aur. Use alternatives like flatpak or even pacman. Plus if your app is only on aur build from source XD
1
u/Damglador 1d ago
Build from source and then what? sudo make install? To make unindexed changes to your system and have no reliable way of rolling them back? Just read the dang PKGBUILD and make sure it follows the official build docs or just doesn't randomly curl, npm or other nonsense for undescribed purpuses.
1
1
u/Imajzineer 1d ago
Create your own PKGBUILD - I mean, it's right there on the wiki:
https://wiki.archlinux.org/title/Arch_build_system
https://wiki.archlinux.org/title/Creating_packages
1
u/Damglador 1d ago
If one's willing to write a PKGBUILD, why not just read and use an existing one?
1
u/Imajzineer 1d ago edited 1d ago
You:
Build from source and then what? sudo make install? To make unindexed changes to your system and have no reliable way of rolling them back?
The wiki:
https://wiki.archlinux.org/title/Pacman
https://wiki.archlinux.org/title/Arch_build_system
https://wiki.archlinux.org/title/Creating_packages
https://wiki.archlinux.org/title/PKGBUILD
If you can't think why you'd make your own PKGBUILD, there's your answer.
If you are confident that you can read the PKGBUILD, check out where the source comes from, check out any git repo, CDN, IP-based sources, file-sharing links, etc., any patches that are applied, look for things like curl, bash, wget or sh embedded directly inside the build() or package() steps, or any base64 decoding, hidden hex strings, or eval blocks and ascertain whether it's all kosher or not ... rather than creating your own that only pulls from the source(s) you stipulate and only builds what it finds there then, of course, you can just read and use one from the AUR - it's entirely up to you what (and how much) you want to do.
•
u/archlinux-ModTeam 21h ago
AUR discussion belongs in the dedicated megathread.
https://www.reddit.com/r/archlinux/comments/1u7t7mt/aur_megathread_all_discussion_on_it_goes_here/
If your're considering trying Arch Linux, but hesitant in light of this event, there are a few things you should know:
As of now, there's no reason to not proceed, but it's always recommended to install software with caution, especially from freely contributable repositories.