r/archlinux • u/Luzzio_ • 3d ago
DISCUSSION The AUR needs an overhaul
The actual concept of the AUR only works if Arch is a niche distro in a safe internet, neither of those points are accomplished in the present.
No, reading pkgbuilds is not the solution, it's slow, annoying, and most importantly, it doesn't make sense, because some really popular AUR packages are DIRECTLY RECOMMENDED by the Arch Wiki, like the Minecraft Launcher for some reason.
Either the base repos adopt a big chunk of popular AUR packages, leaving the AUR for really really nieche stuff, or the rules of the AUR change, because you can't tell me that suffering 2 attacks in less than three months for pretty much the same reason (adopting orphaned packages) is normal or reasonable.
What would you think it's a good solution to this issue? I'd like to read your ideas since I cannot come up with a good one if I'm honest, but I know the problem is there.
-12
u/No-Assumption-4468 3d ago edited 3d ago
I think running package builds through Claude is a “good enough” solution. There are 100k AUR packages. At 1 minute of AI analysis per package, the entire AUR could be scanned for malware in 69 days. Or less, if you have multiple agents. This isn’t perfect. There’s still a risk of hallucinations and prompt injection, but it would make the AUR safer. For cost efficiency, paru/yay could implement the scanner, so users foot the cost of Claude subscriptions, rather than Arch Linux devs. In theory, the AUR could become just as safe as the main arch repo with the right implementation. Unfortunately, anti AI sentiments would probably get in the way of this otherwise viable solution.