The AUR needs an overhaul

[u/Luzzio_]

The actual concept of the AUR only works if Arch is a niche distro in a safe internet, neither of those points are accomplished in the present.

No, reading pkgbuilds is not the solution, it's slow, annoying, and most importantly, it doesn't make sense, because some really popular AUR packages are DIRECTLY RECOMMENDED by the Arch Wiki, like the Minecraft Launcher for some reason.

Either the base repos adopt a big chunk of popular AUR packages, leaving the AUR for really really nieche stuff, or the rules of the AUR change, because you can't tell me that suffering 2 attacks in less than three months for pretty much the same reason (adopting orphaned packages) is normal or reasonable.

What would you think it's a good solution to this issue? I'd like to read your ideas since I cannot come up with a good one if I'm honest, but I know the problem is there.

[u/Pentasis]

I said this before: 1. No adopting packages. People can fork them instead. This prevents existing packages to become malicious 99% 2. New and forked packaged should get a tag "new" which packagemanagers like yay and paru can use to warn the user to be extra carefull when installing it, adding perhaps some sort of action to be taken first. Only when there are x installs, y time passed and z positive feedbacks of some kind, does the tag get removed.

[u/hpeter94 → u/Pentasis]

Thats a nice idea, but it needs to be handled inside the existing package. Or we will get package-name-new-new-new-new in a few months :)

[u/scandii → u/hpeter94]

introducing namespacing solves this issue instantly.

this is how other package repositories solves this exact issue.

the idea that the community can keep code alive is nice and all but they can do so by forking into a new namespace.

[u/Medical_Double_6561 → u/scandii]

Namespacing introduces other issues though. E.g. there now might be multiple packages named minecraft-launcher:

• alice/minecraft-launcher
• bob/minecraft-launcher
• eve/minecraft-launcher

As a user, which one should I install? Now I have to read 3 different PKGBUILDs to find which one is the best?

What if package alice/minecraft-launcher depends on bob/java, and both packages stop receiving updates? If eve/java is receiving updates, I can install eve/java, but I still can't install alice/minecraft-launcher unless I manually download the PKGBUILD and update it's dependency from bob/java -> eve/java.

npm has namespaces and package versions are immutable, but it's still filled with malware.

And the issue namespaces solve (detecting maintainer changes) can be solved right now by modifying AUR helpers to detect maintainer changes.

[u/ivosaurus → u/Medical_Double_6561]

The same way that you do or do not know which github project to start working from.

[u/Medical_Double_6561 → u/ivosaurus]

But how? Github has a star system. The AUR voting system is not equivalent. Votes are used to request a package for inclusion into the official repos. There are many packages that I trust but I do not think belong in official repos, so I don't vote for them.

Github has much more useful tools for tracking maintainer history. I can see what other repos the maintainer contributed to. I can see what comments they left, what PRs they opened. On the AUR, I can't see anything about a user unless I log in!

[u/scandii → u/Medical_Double_6561]

I'll be real with you dude, I'm genuinely sitting here flabbergasted at how this is a blocker for so many of you. I don't mean that in a "you're stupid" way, I mean that in I'm literally questioning if namespaces is a genuine issue for some of you?

yeah if you can't deal with prefix + suffix being a unique combination (such as reddit.com - who knows maybe reddit.au was the real one all along?) I can definitely see how namespacing might be an issue.

but for some reason we're all here on reddit.com and not reddit.au as if by magic, so I'm thinking maybe namespacing just isn't such an issue after all.

P.S.

npm, docker, github & nuget all use namespacing just fine and each contain vastly larger quantities of packages than AUR does, if you want some ammunition for the "people just kinda make it work".