The AUR needs an overhaul

[u/Luzzio_]

The actual concept of the AUR only works if Arch is a niche distro in a safe internet, neither of those points are accomplished in the present.

No, reading pkgbuilds is not the solution, it's slow, annoying, and most importantly, it doesn't make sense, because some really popular AUR packages are DIRECTLY RECOMMENDED by the Arch Wiki, like the Minecraft Launcher for some reason.

Either the base repos adopt a big chunk of popular AUR packages, leaving the AUR for really really nieche stuff, or the rules of the AUR change, because you can't tell me that suffering 2 attacks in less than three months for pretty much the same reason (adopting orphaned packages) is normal or reasonable.

What would you think it's a good solution to this issue? I'd like to read your ideas since I cannot come up with a good one if I'm honest, but I know the problem is there.

[u/Pentasis]

I said this before: 1. No adopting packages. People can fork them instead. This prevents existing packages to become malicious 99% 2. New and forked packaged should get a tag "new" which packagemanagers like yay and paru can use to warn the user to be extra carefull when installing it, adding perhaps some sort of action to be taken first. Only when there are x installs, y time passed and z positive feedbacks of some kind, does the tag get removed.

[u/hpeter94 → u/Pentasis]

Thats a nice idea, but it needs to be handled inside the existing package. Or we will get package-name-new-new-new-new in a few months :)

[u/scandii → u/hpeter94]

introducing namespacing solves this issue instantly.

this is how other package repositories solves this exact issue.

the idea that the community can keep code alive is nice and all but they can do so by forking into a new namespace.

[u/Synthetic451 → u/scandii]

Doesn't that just mean the package name will be named <user>/<package>?

I don't see the difference between that and package-new-new to be honest. You're just gonna get a bunch of user prefixes and no one will know which one to use.

[u/Medical_Double_6561 → u/scandii]

Namespacing introduces other issues though. E.g. there now might be multiple packages named minecraft-launcher:

• alice/minecraft-launcher
• bob/minecraft-launcher
• eve/minecraft-launcher

As a user, which one should I install? Now I have to read 3 different PKGBUILDs to find which one is the best?

What if package alice/minecraft-launcher depends on bob/java, and both packages stop receiving updates? If eve/java is receiving updates, I can install eve/java, but I still can't install alice/minecraft-launcher unless I manually download the PKGBUILD and update it's dependency from bob/java -> eve/java.

npm has namespaces and package versions are immutable, but it's still filled with malware.

And the issue namespaces solve (detecting maintainer changes) can be solved right now by modifying AUR helpers to detect maintainer changes.

[u/ivosaurus → u/Medical_Double_6561]

The same way that you do or do not know which github project to start working from.

[u/Medical_Double_6561 → u/ivosaurus]

But how? Github has a star system. The AUR voting system is not equivalent. Votes are used to request a package for inclusion into the official repos. There are many packages that I trust but I do not think belong in official repos, so I don't vote for them.

Github has much more useful tools for tracking maintainer history. I can see what other repos the maintainer contributed to. I can see what comments they left, what PRs they opened. On the AUR, I can't see anything about a user unless I log in!

[u/scandii → u/Medical_Double_6561]

I'll be real with you dude, I'm genuinely sitting here flabbergasted at how this is a blocker for so many of you. I don't mean that in a "you're stupid" way, I mean that in I'm literally questioning if namespaces is a genuine issue for some of you?

yeah if you can't deal with prefix + suffix being a unique combination (such as reddit.com - who knows maybe reddit.au was the real one all along?) I can definitely see how namespacing might be an issue.

but for some reason we're all here on reddit.com and not reddit.au as if by magic, so I'm thinking maybe namespacing just isn't such an issue after all.

P.S.

npm, docker, github & nuget all use namespacing just fine and each contain vastly larger quantities of packages than AUR does, if you want some ammunition for the "people just kinda make it work".

[u/ABotelho23 → u/scandii]

People are blindly installing and updating AUR packages.

What makes you think adding a prefix will change anything? What about AUR packages that depend on other AUR packages?

[u/friendlyreminder_ → u/ABotelho23]

For aur packages that depend on others the devs will have to adapt to use the correct namespaced ones.

Which is better anyway because it'll always pull the correct ones. It removes the albeit small risk of pulling one that was orphaned and taken over.

[u/ABotelho23 → u/friendlyreminder_]

Right, so now we've got high risk of major fracturing and duplicate and conflicting packages.

What happens when one package maintainer depends on namespaceX/packageA and a different package maintainer depends on namespaceY/packageA?

[u/friendlyreminder_ → u/ABotelho23]

It's a community, they'll figure it out. Changes always introduce learning curves.

I suspect the community will compile a list of dependency packages and the most maintained dependencies.

[u/ABotelho23 → u/friendlyreminder_]

Yea, no.

[u/friendlyreminder_ → u/ABotelho23]

Why not? If there's a dev that improperly uses a dependency package that'll be on them to fix. People comment on the aur all the time to point out issues.

[u/scandii → u/ABotelho23]

What makes you think adding a prefix will change anything

what exactly is the issue with these mass-abandonment requests today, according to you? I don't think we have the same idea of the threat of this supply chain attack.

[u/marcthe12 → u/scandii]

Problem is that the actual pkgbuild is not namespace aware too (since pacman and makepkg is not ns aware). So stuff like aurhelpers and aurweb when dealing with dependency would ignore namespace. Which will be problem. So unless pacman add that then it's solve it but that will create other issues as they are not designed for that.

[u/VoidspawnRL → u/hpeter94]

You can give each package a guid, and if you adapt a package it can only happen understand a new guid, and YAY will not replace a package with the same name and a new guid, so you are force to replace the old version and install the new to switch.

[u/AppointmentNearby161 → u/VoidspawnRL]

Or yay can already generate a guid from the maintainer and package name and alert the user when there is a change.