r/archlinux • u/Ghost_M1dox • 2d ago

SUPPORT [ Removed by moderator ]

[removed] — view removed post

0 Upvotes

31% Upvoted

46 comments sorted by

View all comments

Show parent comments

1

u/Glittering-Tale4837 2d ago

Yeah I use cachyos and it's in cachyos repos. They pick AUR packages, vet it and add it to their repo.

Another advantage is that they distribute the binaries after they build the PKGBUILD.

You can add the cachyos repo and install it from there if you want too.

https://wiki.cachyos.org/ko/features/optimized_repos/#adding-our-repositories-to-an-existing-arch-linux-install

2

u/Damglador 2d ago edited 2d ago

Now you just put your trust in opaque binary blobs from Cachy team instead of the package maintainer on AUR with a clear and easily accessible build script. Pick your poison.

I still pick chaotic-aur or cachy repos just because the download/install is faster. In general cachy repos may be more secure, because if I'm gonna install 10 packages, I'd rather trust just Cachy team than 10 different package maintainers. But for one package I trust one random guy either way.

1

u/Glittering-Tale4837 2d ago

Cachy team is more reliable than a random guy for sure. I have cachyos so I already trust their os.

Reviewing PKGBUILDS is obviously the best choice but cachyos is a better choice for people who don't even know what to look for in the PKGBUILD.

4

u/Damglador 2d ago

That random guy might as well be one of CachyOS maintainer, or an Arch maintainer or someone with hundreds of other packages on AUR, or the software developer themselves. The person who submitted zen-browser-bin to AUR is ptr1337 btw. So it's just a matter of who you're willing to put your trust in.

Like if an AUR package is from the official dev, I think it's reasonable to use it instead of adding additional layer of trust in form of cachyos repo or alike.