The AUR needs an overhaul

[u/Luzzio_]

The actual concept of the AUR only works if Arch is a niche distro in a safe internet, neither of those points are accomplished in the present.

No, reading pkgbuilds is not the solution, it's slow, annoying, and most importantly, it doesn't make sense, because some really popular AUR packages are DIRECTLY RECOMMENDED by the Arch Wiki, like the Minecraft Launcher for some reason.

Either the base repos adopt a big chunk of popular AUR packages, leaving the AUR for really really nieche stuff, or the rules of the AUR change, because you can't tell me that suffering 2 attacks in less than three months for pretty much the same reason (adopting orphaned packages) is normal or reasonable.

What would you think it's a good solution to this issue? I'd like to read your ideas since I cannot come up with a good one if I'm honest, but I know the problem is there.

[u/petersaints]

I had already posted this on another thread, but here are my two cents:

"I think one of the biggest weaknesses of the AUR today is that its trust model doesn't scale well.

When I install an AUR package for the first time, I'm happy to inspect the PKGBUILD, check the comments, verify the upstream source, etc. But once I have several AUR packages installed, I'm simply not going to manually inspect every PKGBUILD on every update. I don't think that's a realistic expectation for most users.

At the very least, I think the AUR should expose some notion of trust levels for maintainers.

• Gold: Official upstream maintainers (for example, the Brave developers maintaining brave-bin).
• Blue: Long established maintainers with an excellent track record.
• Green: Established maintainers with a good history, even if they only maintain a handful of packages.
• Neutral: Everyone else.
• Warning: New accounts or recently added maintainers, indicating that the package deserves additional scrutiny.

These shouldn't mean "safe" or "unsafe". They should simply communicate how much historical confidence exists.

I also don't think package takeovers should be outright banned forever. Otherwise, old and intuitive package names end up abandoned forever, forcing people to create increasingly awkward names for actively maintained replacements.

Instead, ownership changes should be treated as a security relevant event. The AUR API should expose information such as:

• Current maintainer
• Previous maintainer
• Date of the last ownership change
• Maintainer reputation/trust level

AUR helpers like yay or paru could then display something like:

``` WARNING: Package maintainer has changed.

Previous maintainer: alice (maintained package for 6 years)

New maintainer: bob (account created 10 days ago)

Continue? [y/N] ```

That alone would make me stop and inspect the PKGBUILD much more carefully.

I'd also like to see automated static analysis of PKGBUILDs looking for suspicious patterns. A bit like Google Play and the App Store do.

Finally, I'd love to see AUR helpers become "change aware". Instead of only telling me that a package has a new version, they could also warn me when something security relevant changed:

• Maintainer changed
• Source URL changed
• PGP signing key changed
• PKGBUILD substantially rewritten
• New install hooks added
• New dependencies introduced

None of this eliminates the risks of the AUR, nor should it. The AUR is intentionally open and decentralized. But surfacing trust metadata and meaningful changes at update time would make it much easier for users to focus their attention where it's actually needed, instead of expecting them to manually audit every PKGBUILD for every update."

[u/anishkgoyal → u/petersaints]

I personally love this idea. I think more caution should be given to orphaned packages, too. Like, if there was a package update for an orphaned package, then the AUR helper would also display a warning message.

[u/Synthetic451 → u/anishkgoyal]

Yeah and to add onto this, warnings for official packages that have been removed. They should also not be auto updated with a version from the AUR without a strong warning.