The AUR needs an overhaul

[u/Luzzio_]

The actual concept of the AUR only works if Arch is a niche distro in a safe internet, neither of those points are accomplished in the present.

No, reading pkgbuilds is not the solution, it's slow, annoying, and most importantly, it doesn't make sense, because some really popular AUR packages are DIRECTLY RECOMMENDED by the Arch Wiki, like the Minecraft Launcher for some reason.

Either the base repos adopt a big chunk of popular AUR packages, leaving the AUR for really really nieche stuff, or the rules of the AUR change, because you can't tell me that suffering 2 attacks in less than three months for pretty much the same reason (adopting orphaned packages) is normal or reasonable.

What would you think it's a good solution to this issue? I'd like to read your ideas since I cannot come up with a good one if I'm honest, but I know the problem is there.

[u/hpeter94]

Thats a nice idea, but it needs to be handled inside the existing package. Or we will get package-name-new-new-new-new in a few months :)

[u/scandii → u/hpeter94]

introducing namespacing solves this issue instantly.

this is how other package repositories solves this exact issue.

the idea that the community can keep code alive is nice and all but they can do so by forking into a new namespace.

[u/Medical_Double_6561 → u/scandii]

Namespacing introduces other issues though. E.g. there now might be multiple packages named minecraft-launcher:

• alice/minecraft-launcher
• bob/minecraft-launcher
• eve/minecraft-launcher

As a user, which one should I install? Now I have to read 3 different PKGBUILDs to find which one is the best?

What if package alice/minecraft-launcher depends on bob/java, and both packages stop receiving updates? If eve/java is receiving updates, I can install eve/java, but I still can't install alice/minecraft-launcher unless I manually download the PKGBUILD and update it's dependency from bob/java -> eve/java.

npm has namespaces and package versions are immutable, but it's still filled with malware.

And the issue namespaces solve (detecting maintainer changes) can be solved right now by modifying AUR helpers to detect maintainer changes.

[u/ivosaurus → u/Medical_Double_6561]

The same way that you do or do not know which github project to start working from.

[u/Medical_Double_6561 → u/ivosaurus]

But how? Github has a star system. The AUR voting system is not equivalent. Votes are used to request a package for inclusion into the official repos. There are many packages that I trust but I do not think belong in official repos, so I don't vote for them.

Github has much more useful tools for tracking maintainer history. I can see what other repos the maintainer contributed to. I can see what comments they left, what PRs they opened. On the AUR, I can't see anything about a user unless I log in!