I mean how often do you install AUR packages? Usually takes like a minute or so to skim through PKGbuild and the pkg comments and look for obvious issues. And most updates are just a sha hash and version change, taking like 5s to check.
But wasn’t the latest AUR attack from a dependancy in the pkgbuild? Going out of your way to review all the dependencies as well is not really possible by just skimming through the script.
Rarely, to be sure. I tried Arch for a bit, but I need a computer that I can actually use to get shit done, that isn’t a constant project itself. Even Qubes doesn’t require as much effort to keep operational.
If you want a bunch of stuff that’s not in core or extra and you don’t want to intensely babysit the AUR, you could try Chaotic-AUR. It hosts prebuilt packages for a bunch of AUR packages which are actively maintained by the Chaotic team.
I consider it to be more secure than the AUR proper since they actually care for their packages and review nontrivial changes. For instance, the recent takeover attacks didn’t hit Chaotic-AUR builds since the changed packages didn’t make it past the review.
It’s still an unofficial third-party repository and closer to the AUR than to extra but I consider it a major step up.
I just recently reinstalled since I didn’t feel comfortable with how many AUR packages I had and ive been using ChaoticAUR exclusively now. Can confirm that its a great repo
I mean how often do you install AUR packages? Usually takes like a minute or so to skim through PKGbuild and the pkg comments and look for obvious issues. And most updates are just a sha hash and version change, taking like 5s to check.
I need a better wrapper that shows me diffs since last build. I’m too lazy for this
Also pulling in release messages from git etc would be nice
paru
But wasn’t the latest AUR attack from a dependancy in the pkgbuild? Going out of your way to review all the dependencies as well is not really possible by just skimming through the script.
Rarely, to be sure. I tried Arch for a bit, but I need a computer that I can actually use to get shit done, that isn’t a constant project itself. Even Qubes doesn’t require as much effort to keep operational.
If you want a bunch of stuff that’s not in core or extra and you don’t want to intensely babysit the AUR, you could try Chaotic-AUR. It hosts prebuilt packages for a bunch of AUR packages which are actively maintained by the Chaotic team.
I consider it to be more secure than the AUR proper since they actually care for their packages and review nontrivial changes. For instance, the recent takeover attacks didn’t hit Chaotic-AUR builds since the changed packages didn’t make it past the review.
It’s still an unofficial third-party repository and closer to the AUR than to extra but I consider it a major step up.
I just recently reinstalled since I didn’t feel comfortable with how many AUR packages I had and ive been using ChaoticAUR exclusively now. Can confirm that its a great repo
Yes, but is it good, neutral, or evil?
Yes
it is arch
It is colorful socks