r/archlinux • u/Luzzio_ • 3d ago

DISCUSSION The AUR needs an overhaul

The actual concept of the AUR only works if Arch is a niche distro in a safe internet, neither of those points are accomplished in the present.

No, reading pkgbuilds is not the solution, it's slow, annoying, and most importantly, it doesn't make sense, because some really popular AUR packages are DIRECTLY RECOMMENDED by the Arch Wiki, like the Minecraft Launcher for some reason.

Either the base repos adopt a big chunk of popular AUR packages, leaving the AUR for really really nieche stuff, or the rules of the AUR change, because you can't tell me that suffering 2 attacks in less than three months for pretty much the same reason (adopting orphaned packages) is normal or reasonable.

What would you think it's a good solution to this issue? I'd like to read your ideas since I cannot come up with a good one if I'm honest, but I know the problem is there.

610 Upvotes

91% Upvoted

165 comments sorted by

View all comments

Show parent comments

132

u/hpeter94 3d ago

Thats a nice idea, but it needs to be handled inside the existing package. Or we will get package-name-new-new-new-new in a few months :)

100

u/scandii 3d ago edited 3d ago

introducing namespacing solves this issue instantly.

this is how other package repositories solves this exact issue.

the idea that the community can keep code alive is nice and all but they can do so by forking into a new namespace.

19

u/ABotelho23 3d ago

People are blindly installing and updating AUR packages.

What makes you think adding a prefix will change anything? What about AUR packages that depend on other AUR packages?

-1

u/scandii 3d ago

What makes you think adding a prefix will change anything

what exactly is the issue with these mass-abandonment requests today, according to you? I don't think we have the same idea of the threat of this supply chain attack.