Idea: an AUR repo, to upload directly built packages

bivan · 2026-07-19 12:29:34

There is not official AUR built packages, officially you must build a package yourself, check its PKGBUILD if there is not a malware (I never do it (like read the EULA), I just trust).
But there is https://wiki.archlinux.org/title/Unoffi … positories , notably chaotic-aur , but an issue: even if a package has not malware, it can be refused, e.g. https://github.com/chaotic-aur/packages/issues/3523 etc.

So the idea: an AUR repo a developer can directly upload its built package (or at least if a package has not malware, it's accepted).
Can someone create it? Me I just have a regular PC, sometimes off...

Last edited by bivan (2026-07-19 12:46:59)

cryptearth · 2026-07-19 12:40:57

everyone can use services like github or provide pre-built packages by other means, like -bin packages which pretty much just download pre-built binaries and wrap them in a pacman package
i don't see the need for arch provide such infrastructure

seth · 2026-07-19 12:43:56

check its PKGBUILD if there is not a malware (I never do it (like read the EULA), I just trust)

Please stop using archlinux.

Trilby · 2026-07-19 12:47:21

seth wrote:

check its PKGBUILD if there is not a malware (I never do it (like read the EULA), I just trust)
Please stop using ~~archlinux~~ computers.

FTFY

dimich · 2026-07-19 12:56:38

bivan wrote:

Can someone create it? Me I just have a regular PC, sometimes off...

No one is stopping you from purchasing VPS hosting, upload whatever you want there and use it as repo in your /etc/pacman.conf.

bivan · 2026-07-19 12:57:15

crypteath indeed I can download a built package from github, Google Drive etc but the convenience is to edit /etc/pacman.conf adding the repo, so just sudo pacman -Syu.

https://wiki.archlinux.org/title/Arch_U … g_packages "#Verify the PKGBUILD; the most important step to verify that the PKGBUILD and accompanying files are not malicious or untrustworthy." so yes I can verify PKGBUILD but the accompanying files if -bin, how? Maybe there is a malware?

Confession: when I was on Windows, I installed softwares, from their .exe installers, I didn't verify the source code then build...

Last edited by bivan (2026-07-19 13:05:52)

seth · 2026-07-19 13:04:30

I can verify PKGBUILD but the accompanying files, how? Maybe there is a malware?

In most cases w/ a text editor, sometimes some editor/viewer for the filetype - if a PKGBUILD ships unstructured binary data, you'd ask yourself wtf that actually is - besides a huge red flag.

Confession: when I was on Windows, I installed softwares, from their .exe installers, I didn't verify the source code then build...

You're investing a decent amount of trust in the upstream developers because you'll usually not have the capacity to verify and validate the code, but there's then typically a large userbase and huge effort on the developers side that make malicious behavior less likely.
This isn't true for and there's absolutely no reason to extend that level of trust to the AUR package.

Any kind of open repo where Joe Blackhat can just upload whatever is therefore *much* worse than the AUR since you've no choice but trusting random strangers.
Using an AUR package that wraps a pre-built binary provided by upstream is a better way to avoid resource limits (eg. for browsers etc)

bivan · 2026-07-19 13:18:04

dimich https://www.ovhcloud.com/en/vps/ indeed it costs, so me no, but why not someone experienced?

seth wrote:

Using an AUR package that wraps a pre-built binary

So a -bin package, e.g. rexuiz-bin ? But if it's build, I can't verify it's source code...

seth · 2026-07-19 13:25:03

seth wrote:

You're investing a decent amount of trust in the upstream developers because you'll usually not have the capacity to verify and validate the code, but there's then typically a large userbase and huge effort on the developers side that make malicious behavior less likely.
This isn't true for and there's absolutely no reason to extend that level of trust to the AUR package.
…
Using an AUR package that wraps a pre-built binary provided by upstream is a better way to avoid resource limits (eg. for browsers etc)

Also rexuiz doesn't even seem to provided sources (not gonna download the 700MB zip to figure)

dimich · 2026-07-19 13:31:18

bivan wrote:

dimich https://www.ovhcloud.com/en/vps/ indeed it costs, so me no, but why not someone experienced?

Why someone experienced will do something personally for you?
Experienced people won't install and run binaries uploaded by random people. As well as they won't expect that other people will do.

bivan · 2026-07-19 13:45:56

I'm not alone to use chaotic-aur & want chaotic-aur refused packages, I think lot of people will be interested by this idea.

& about malware: maybe there is a bad guy in chaotic-aur, maybe you can download a malware built package...

seth · 2026-07-19 13:53:03

maybe there is a bad guy in chaotic-aur, maybe you can download a malware built package...

Yes. So?
You're essentially arguing against your own idea at the point.
https://wiki.archlinux.org/title/Unoffi … positories - big fat red warning.

This is just a humongous https://en.wikipedia.org/wiki/XY_problem
You essentially just want someone else to build some AUR package for you and therefore present some 3rd party repo that builds the desired package for you as an "idea". Is that it?

Edit:
https://github.com/chaotic-aur/packages … 3431045182

Rejecting because upstream tarballs of last several releases have been unbuildable (missing files). Project is developed privately, and upstream does not provide old sources.

Ok, I was wrong - actually you want somebody to perform miracles for you and also there's https://aur.archlinux.org/packages/filezilla-server-bin

Edit #2
https://github.com/jebez1
https://bbs.archlinux.org/profile.php?id=165742
I think I start to understand…

Last edited by seth (2026-07-19 13:57:16)

bivan · 2026-07-19 14:02:49

Just see my 1st post.

I built filezilla-server, filezilla-server-bin is in /opt so I prefer the 1st.

Understand what?

Last edited by bivan (2026-07-19 14:05:47)

seth · 2026-07-19 14:04:41

Understand that "bivan" is probably another socket puppet for jebez

cryptearth · 2026-07-19 14:06:53

bivan wrote:

want chaotic-aur refused packages

then you should report to chaotic maintainers and request WHY a particular package was refused - usually there's a more technical reason behind it
btw: you got banned for a reason - expect your puppet to get banned, too

bivan · 2026-07-19 14:10:27

Banned? I don't understand, I'm not jebez.

seth · 2026-07-19 14:29:38

Let's better hope so…

Either way, neither the AUR, nor chaotic-aur nor your idea are any trustworthy.
W/ the chaotic-aur you're delegating the trusting process to its maintainers (and implicitly trust them), w/ your idea you're completely giving up any control - rendering it a "not good" one.

@cryptearth there is, see the forementioned https://github.com/chaotic-aur/packages … 3431045182
Though from https://aur.archlinux.org/packages/filezilla-server (where jebez is heavily active, certainly by mere coincidence) this was because of the GCC generation.

cryptearth · 2026-07-19 14:41:45

seth wrote:

@cryptearth there is

seen that already in the first post - but it was a hint to OP: "when a repo maintainer refuses a software due to some issues - why someone else should bother to maintain yet another repo but unable to provide the requested package for the very same reason?"
the entire idea of this topic is already covered by the chaotic repo and -bin aur packages - if, for some reason, OP still struggle then the best option is what was already mentioned: maybe not stick to arch but some other distro on which the requested software is available

5hridhyan · 2026-07-19 15:00:59

Idea: an AUR repo, to upload directly built packages

Idk why people re-invent ideas, and at some point they are creating problems to solutions.

Edit:

Last edited by 5hridhyan (2026-07-19 15:46:58)

Arch Linux

#1 2026-07-19 12:29:34

Idea: an AUR repo, to upload directly built packages

#2 2026-07-19 12:40:57

Re: Idea: an AUR repo, to upload directly built packages

#3 2026-07-19 12:43:56

Re: Idea: an AUR repo, to upload directly built packages

#4 2026-07-19 12:47:21

Re: Idea: an AUR repo, to upload directly built packages

#5 2026-07-19 12:56:38

Re: Idea: an AUR repo, to upload directly built packages

#6 2026-07-19 12:57:15

Re: Idea: an AUR repo, to upload directly built packages

#7 2026-07-19 13:04:30

Re: Idea: an AUR repo, to upload directly built packages

#8 2026-07-19 13:18:04

Re: Idea: an AUR repo, to upload directly built packages

#9 2026-07-19 13:25:03

Re: Idea: an AUR repo, to upload directly built packages

#10 2026-07-19 13:31:18

Re: Idea: an AUR repo, to upload directly built packages

#11 2026-07-19 13:45:56

Re: Idea: an AUR repo, to upload directly built packages

#12 2026-07-19 13:53:03

Re: Idea: an AUR repo, to upload directly built packages

#13 2026-07-19 14:02:49

Re: Idea: an AUR repo, to upload directly built packages

#14 2026-07-19 14:04:41

Re: Idea: an AUR repo, to upload directly built packages

#15 2026-07-19 14:06:53

Re: Idea: an AUR repo, to upload directly built packages

#16 2026-07-19 14:10:27

Re: Idea: an AUR repo, to upload directly built packages

#17 2026-07-19 14:29:38

Re: Idea: an AUR repo, to upload directly built packages

#18 2026-07-19 14:41:45

Re: Idea: an AUR repo, to upload directly built packages

#19 2026-07-19 15:00:59

Re: Idea: an AUR repo, to upload directly built packages

Board footer