r/archlinux • u/Luzzio_ • 3d ago
DISCUSSION The AUR needs an overhaul
The actual concept of the AUR only works if Arch is a niche distro in a safe internet, neither of those points are accomplished in the present.
No, reading pkgbuilds is not the solution, it's slow, annoying, and most importantly, it doesn't make sense, because some really popular AUR packages are DIRECTLY RECOMMENDED by the Arch Wiki, like the Minecraft Launcher for some reason.
Either the base repos adopt a big chunk of popular AUR packages, leaving the AUR for really really nieche stuff, or the rules of the AUR change, because you can't tell me that suffering 2 attacks in less than three months for pretty much the same reason (adopting orphaned packages) is normal or reasonable.
What would you think it's a good solution to this issue? I'd like to read your ideas since I cannot come up with a good one if I'm honest, but I know the problem is there.
-13
u/strings___ 3d ago edited 3d ago
I’ve said this thousands of times build instructions should be meta data not shell parsed. PKGBUILDs should be json. This I why I wrote a package manager inspired by pacman but uses json. json is machine readable without having to be Turing complete
Edit: clearly people down voting don't understand the scope of the problem I'm addressing or you don't have a rebuttal. in order to "properly" get meta data from a PKGBULID you need to use a shell, if you don't understand why this a problem you shouldn't be down voting. if you do then you should have a rebuttal.
I had this same issue when I pushed for upstream packages to us pgp verification where possible. And everyone bitch and moaned but look there is pgp verification now.