If you want a bunch of stuff that’s not in core or extra and you don’t want to intensely babysit the AUR, you could try Chaotic-AUR. It hosts prebuilt packages for a bunch of AUR packages which are actively maintained by the Chaotic team.
I consider it to be more secure than the AUR proper since they actually care for their packages and review nontrivial changes. For instance, the recent takeover attacks didn’t hit Chaotic-AUR builds since the changed packages didn’t make it past the review.
It’s still an unofficial third-party repository and closer to the AUR than to extra but I consider it a major step up.
I just recently reinstalled since I didn’t feel comfortable with how many AUR packages I had and ive been using ChaoticAUR exclusively now. Can confirm that its a great repo
I mean how often do you install AUR packages? Usually takes like a minute or so to skim through PKGbuild and the pkg comments and look for obvious issues. And most updates are just a sha hash and version change, taking like 5s to check.
Rarely, to be sure. I tried Arch for a bit, but I need a computer that I can actually use to get shit done, that isn’t a constant project itself. Even Qubes doesn’t require as much effort to keep operational.
But wasn’t the latest AUR attack from a dependancy in the pkgbuild? Going out of your way to review all the dependencies as well is not really possible by just skimming through the script.
If you want a bunch of stuff that’s not in core or extra and you don’t want to intensely babysit the AUR, you could try Chaotic-AUR. It hosts prebuilt packages for a bunch of AUR packages which are actively maintained by the Chaotic team.
I consider it to be more secure than the AUR proper since they actually care for their packages and review nontrivial changes. For instance, the recent takeover attacks didn’t hit Chaotic-AUR builds since the changed packages didn’t make it past the review.
It’s still an unofficial third-party repository and closer to the AUR than to extra but I consider it a major step up.
I just recently reinstalled since I didn’t feel comfortable with how many AUR packages I had and ive been using ChaoticAUR exclusively now. Can confirm that its a great repo
Yes, but is it good, neutral, or evil?
IT’S MAHVEL BABY!
It is colorful socks
it is arch
I don’t think Arch is right for you.
Yes
I mean how often do you install AUR packages? Usually takes like a minute or so to skim through PKGbuild and the pkg comments and look for obvious issues. And most updates are just a sha hash and version change, taking like 5s to check.
Rarely, to be sure. I tried Arch for a bit, but I need a computer that I can actually use to get shit done, that isn’t a constant project itself. Even Qubes doesn’t require as much effort to keep operational.
But wasn’t the latest AUR attack from a dependancy in the pkgbuild? Going out of your way to review all the dependencies as well is not really possible by just skimming through the script.
I need a better wrapper that shows me diffs since last build. I’m too lazy for this
Also pulling in release messages from git etc would be nice
paru