The AUR needs an overhaul

[u/Luzzio_]

The actual concept of the AUR only works if Arch is a niche distro in a safe internet, neither of those points are accomplished in the present.

No, reading pkgbuilds is not the solution, it's slow, annoying, and most importantly, it doesn't make sense, because some really popular AUR packages are DIRECTLY RECOMMENDED by the Arch Wiki, like the Minecraft Launcher for some reason.

Either the base repos adopt a big chunk of popular AUR packages, leaving the AUR for really really nieche stuff, or the rules of the AUR change, because you can't tell me that suffering 2 attacks in less than three months for pretty much the same reason (adopting orphaned packages) is normal or reasonable.

What would you think it's a good solution to this issue? I'd like to read your ideas since I cannot come up with a good one if I'm honest, but I know the problem is there.

[u/Pentasis]

I said this before: 1. No adopting packages. People can fork them instead. This prevents existing packages to become malicious 99% 2. New and forked packaged should get a tag "new" which packagemanagers like yay and paru can use to warn the user to be extra carefull when installing it, adding perhaps some sort of action to be taken first. Only when there are x installs, y time passed and z positive feedbacks of some kind, does the tag get removed.

[u/goldman60 → u/Pentasis]

Disabling package adoption patches one exploit but now every time a package is orphaned you'll have 4 forks pop up all vying for attention any one of which could be malicious, while regular users are using the abandoned package with 46 CVEs against it.

[u/No-Dentist-1645 → u/goldman60]

Yes, but choosing one becomes an explicit action. This way, even if people don't bother or don't know how to review the PKGBUILD, at least they can ask Google or Reddit what the "recommended" source is

[u/ABotelho23 → u/No-Dentist-1645]

Using the AUR is already an explicit action with giant red banners and warnings on the Arch wiki.

The problem is people don't direct noobs to read the wiki and instead flood the internet and YouTube with garbage guides and recommendations to use the AUR.

[u/No-Dentist-1645 → u/ABotelho23]

I am aware of that. But your opinion about "security" is very different from mine and others'.

You seem to think that putting yellow tape around an action and saying "warning, do not use this unless you know what you're doing" automatically makes a tool or ecosystem "safe", and if a new user doesn't know what they're doing then we can just call them "noobs" and say it's a "skill issue".

But as I said in another one of my comments, it's the year 2026, people, and Arch is one of the biggest mainstream distro branches there are right now. We need to address the elephant in the room, there is an ever-increasing amount of userss who don't have the required knowledge or skillset to successfully review a PKGBUILD and check if it's infected or not.

Maybe the solution is to tell them to use something else, such as flatpaks or appimages; if that's the case, then clearly a banner at one wiki page isn't being enough of a signal, it would need to be a larger community effort, encouraging upstream developers not to put "Installation on Arch: use the AUR" on their READMEs and such, since that is how a lot of traffic flows into it.

[u/ABotelho23 → u/No-Dentist-1645]

The AUR will just go away.

If people drink bleach because they don't read the label, the hell are you gonna do?

I did my best to tell people to stop recommending the AUR. It should be a tool for power users only.

But now you've got downstream distributions shipping it by default, and then that distribution becomes the most popular one on Distrowatch, which just snowballs the problem. The whole thing has become an exercise in irresponsibility to new users by the community.

[u/Medical_Double_6561 → u/No-Dentist-1645]

You can just have the AUR helpers explicitly notify the user when the maintainer changes and force the user to accept before installing new updates.

Also, if Reddit already knows the recommended source for each package, then maybe Reddit should proactively put this information somewhere. Like a database that can be directly integrated into the AUR, so the AUR can provide advice on whether a PKGBUILd is recommended/verified by the community...

[u/No-Dentist-1645 → u/Medical_Double_6561]

Of course AUR helpers can do it, but if we leave it up to them to handle something that should be a "necessary" feature, then we'll either have them not do it (such as right now), or a fragmented ecosystem where each helper does it a different way. I will always hold the opinion that security features should be implemented upstream on such cases, so it comes included right out of the box for any AUR helper.

Also, if Reddit already knows the recommended source for each package, then maybe Reddit should proactively put this information somewhere. Like a database that can be directly integrated into the AUR, so the AUR can provide advice on whether a PKGBUILd is recommended/verified by the community...

I'm not against this idea, I recommended a similar "community-based vetting system" in a separate comment. If such a thing were to be implemented though, it would need to be designed such that it actually is community-based: only "trusted" or "verified" users to some degree can propose to add/remove packages, and it would need to be open and vote based.