How trustworthy is AUR

milomak · 2010-02-18 20:27:24

I've read the official documentation and I have seen the warnings like inspect every PKGBUILD file etc. The official documentation seems, to me, to have a lot of disclaimer language about it.

What I am more interested in is the trust level users put in AUR. Essentially a short description of what precautions, if any, you take when installing from AUR.

brisbin33 · 2010-02-18 20:42:32

it's pretty self explanatory. anyone can join the AUR and submit a PKGBIULD. period. the only way to be safe, is to inspect each PKGBUILD before running it.

bauerbill has a cool feature to list 'trusted' AUR users in the config file; PKGBUILDs from those users can be installed without the prompt-to-edit annoyance. i think this is neat.

.:B:. · 2010-02-18 22:48:33

It's the kind of jibber jabber one puts in because one is afraid to get sued I'm afraid.

I don't really get the fuss. It's an unofficial repository of package buildscripts and stuff that goes with it. A bad PKGBUILD can damage your system, but it's no more likely that someone will do that on purpose than that the pacman mirror you use gets hacked and packages get replaced with trojans and other pesky things.

It's safe to check a PKGBUILD for what it does before you run it, but I don't get why we need to scare people about it. It's not like a cat being put in a microwave, is it?

jac · 2010-02-18 23:24:31

I think that the AUR is usually very trustworthy, and you sort of have a rating system of how bug/malicious-free a PKGBUILD is from the number of votes, and the comments. Plus, you can take a look around briefly for something obviously dangerous, so in general it seems relatively secure. I think that there is a higher likely hood of bad things happening through negligence or mistake than an attack though.

B wrote:

It's not like a cat being put in a microwave, is it?

I had the unfortunate event of seeing one come out of a microwave, and she was fine. The AUR could eat your hamster, though

Last edited by jac (2010-02-18 23:24:53)

linkmaster03 · 2010-02-21 17:19:59

You should take a quick look at the PKGBUILD before installing, but I've never come across a malicious package. It's pretty trustworthy.

fukawi2 · 2010-02-21 22:34:31

Personally, I've never come across a *malicious* PKGBUILD. I've come across some technically atrocious PKGBUILD's, but nothing malicious.

I tend to follow these rules:
- Popular packages I tend to trust and just let them build and install. It's unlikely they'd be popular if they didn't work or were malicious.
- Other packages I inspect manually, often changing/tweaking something; or rewriting it if it's really bad.

I definitely build in /var/abs/local/ and include this in my backup scheme. If I ever have to reinstall, I have the PKGBUILD, source code and a working package already build there ready to go

Arch Linux

#1 2010-02-18 20:27:24

How trustworthy is AUR

#2 2010-02-18 20:42:32

Re: How trustworthy is AUR

#3 2010-02-18 22:48:33

Re: How trustworthy is AUR

#4 2010-02-18 23:24:31

Re: How trustworthy is AUR

#5 2010-02-21 17:19:59

Re: How trustworthy is AUR

#6 2010-02-21 22:34:31

Re: How trustworthy is AUR

Board footer