Binary AUR repository

Marenz · 2010-05-11 10:01:24

Greetings,

I was wondering if you think this is a good idea: A repository, just like the AUR, only having binary packages so you can just put it in your pacman.conf. If enough people think this is worth a try, I would setup such a system.
Basically like the community repository, only that everyone would be TU of his package.

--Marenz

karol · 2010-05-11 10:47:46

> Basically like the community repository, only that everyone would be TU of his package.
So how is it different form community?

You can have custom repo: if you trust this person, you add their server to your mirrorlist and voilà.

Marenz · 2010-05-11 10:50:47

Well, community needs a TU and enough votes. What I talk about is a repos where everyone can put their binary packages .. like in AUR .. only binary.

--Marenz

.:B:. · 2010-05-11 10:55:42

I think archlinux.fr builds a lot of AUR packages, not all of them. Arch is a rolling release and the chance that all AUR maintainers would build their packages on the same libs is minimal. Offering buildscripts eliminates that problem almost completely.

Allan · 2010-05-11 11:10:00

Well... I would prefer to know who built the packages I install. The community repo is run by trusted users for a reason.

bluewind · 2010-05-11 11:53:51

Once we have signed packages you could link to built packages on the AUR website and maybe even add support for downloading them using pacman. If you trust the signature install it and otherwise refuse and tell the user to build it himself.

dcc24 · 2010-05-11 18:04:02

Another method could be the following: Two AUR-binary servers (one for i686, one for x86_64) that fetches every non-orphan and not-flagged-out-of-date (to reduce clutter) package that supports the given architecture on AUR, builds them and makes a repo with them. Cron jobs could run once every 24 hours to keep the repo updated.

If this is done on one of Arch's servers (though this might easily be considered a waste of resources), or if someone from the community donates disk space and bandwith, I think this would work

Last edited by dcc24 (2010-05-11 18:07:49)

denisfalqueto · 2010-05-11 18:12:34

As Allan said, it is a huge security problem. Some months back, Gnome Looks was bitten by screensavers that could be installed readily and caused problems. I wouldn't trust binary blobs compiled from a script that can be uploaded by anyone with a little time to register an account. Maybe some user can do that by himself, but Arch shouldn't give any official support to that.

dcc24 · 2010-05-11 18:16:37

Well, as I said, it should better be placed on a volunteer's server, not Arch's. As for the security concern, if a notice that explains the situation with big fat words were to be placed (say, on this repo's wiki page), that could provide enough warning.

Another precaution, especially for malicious packages, could be this: If a package has less than "n" votes, it is omitted from the repository.

I think these two actions would provide protection for most cases.

Allan · 2010-05-11 22:48:46

So... I just have to get a package to have enough votes before I can start making it malicious. Or I could just adopt one meeting the criteria?

Anyway, there is no way that I would automate bulding from the AUR. It is a very, very good idea to have some understanding of what every command in a PKGBUILD is trying to do before you run makepkg on it.

fsckd · 2010-05-12 00:07:39

dcc24 wrote:

Another precaution, especially for malicious packages, could be this: If a package has less than "n" votes, it is omitted from the repository.

You are aware votes are not cleared when the maintainer is changed, right?

wonder · 2010-05-12 00:12:18

why making another community repo and not trying to improve the one that already exists?

mythus · 2010-05-12 11:00:20

I don't understand this. What is so hard about getting a package from the AUR anyways?

Sorry, but I agree with those who are against this idea. If you need a more automated process, just grab yourself a AUR helper like yaourt/packer/clyde/etc... most, if not all, of them let you search the aur and grab a package from them just as simply as grabing a package from the official repositories. Only here you get to inspect the package for malicious intent and unwanted surprises. Sorry, but using, say clyde -S packagename is no more difficult than using pacman -S packagename.

Though doing it the good old fashion way isn't that difficult either.

Sorry, but arch doesn't need this. The AUR is fine as is, and things are more secure this way.

Marenz · 2010-05-12 12:22:19

Well, there is at least one special case where this doesn't work: gcc-multilib

appart from that, I was just curious how the idea would hit.

--Marenz

tuxce · 2010-05-12 15:54:30

About gcc-multilib, you can do like for kernel26-xen, users have to uncomment one line (pkgname), I don't know for others aur helpers, but yaourt-git handles it.

Marenz · 2010-05-12 15:57:00

I was more referring to the problem that you need gcc-multilib to build gcc-multilib

--Marenz

Stythys · 2010-05-12 16:01:31

whether or not people think it's a good idea or not, it's ultimately up to the users to decide. There *are* people out there who would use it, and some who wouldn't. I can help provide some initial hosting if anyone is actually interested in starting this.

fsckd · 2010-05-12 19:58:00

Since AUR has an rss feed of updates, it's possible to do this by oneself. If anyone is really interested in providing this, he can set it up and those who want it can use it.

SoleSoul · 2010-05-12 20:14:27

This would be the first door for viruses on linux.
EDIT:
I must add, sadly.
I really like the idea.

EDIT2:
Maybe we can do something in the middle.
step one: some not-trusted user prepares everything for compilations.
step two: a trusted user approves the package and the pkgbuild.
step three: an automated system builds the approved packages.

Last edited by SoleSoul (2010-05-12 20:20:22)

senorsmile · 2011-12-20 04:42:32

I know this is a really old idea, but I have to admit that the AUR and its various problems have been the one reason I can't recommend Arch Linux to anyone who is not Technical. I have settled on user pacaur, and even have a few custom scripts to make it as automated as possible. However, having an even semi-trusted binary repository to install aur packages from would make life so much easier. Plus, it would allow searching for and installing packages directly in PackageKit.

ngoonee · 2011-12-20 05:30:34

senorsmile wrote:

I know this is a really old idea, but I have to admit that the AUR and its various problems have been the one reason I can't recommend Arch Linux to anyone who is not Technical. I have settled on user pacaur, and even have a few custom scripts to make it as automated as possible. However, having an even semi-trusted binary repository to install aur packages from would make life so much easier. Plus, it would allow searching for and installing packages directly in PackageKit.

Technically a necro, but the discussion is sort of timeless.

Also pointless though. Arch is not made for 'anyone who is not Technical', if 'Technical' is translated to mean 'wanting control over their own system'. Debian and Ubuntu are freely available for all.

[community] is the binary AUR repo. If you see no problem with installing binaries compiled by random strangers for the sake of convenience, please do start your own alternative repo. I wouldn't use it, but that's beside the point.

karol · 2011-12-20 09:17:48

One of the reasons packages are dropped from [community] to AUR is the lack of manpower - no dev or TU is willing to maintain them. If you have what it takes, apply for a TU position.

As ngoonee pointed out, you can just create an unofficial repo, like https://bbs.archlinux.org/viewtopic.php?id=126183

Arch Linux

#1 2010-05-11 10:01:24

Binary AUR repository

#2 2010-05-11 10:47:46

Re: Binary AUR repository

#3 2010-05-11 10:50:47

Re: Binary AUR repository

#4 2010-05-11 10:55:42

Re: Binary AUR repository

#5 2010-05-11 11:10:00

Re: Binary AUR repository

#6 2010-05-11 11:53:51

Re: Binary AUR repository

#7 2010-05-11 18:04:02

Re: Binary AUR repository

#8 2010-05-11 18:12:34

Re: Binary AUR repository

#9 2010-05-11 18:16:37

Re: Binary AUR repository

#10 2010-05-11 22:48:46

Re: Binary AUR repository

#11 2010-05-12 00:07:39

Re: Binary AUR repository

#12 2010-05-12 00:12:18

Re: Binary AUR repository

#13 2010-05-12 11:00:20

Re: Binary AUR repository

#14 2010-05-12 12:22:19

Re: Binary AUR repository

#15 2010-05-12 15:54:30

Re: Binary AUR repository

#16 2010-05-12 15:57:00

Re: Binary AUR repository

#17 2010-05-12 16:01:31

Re: Binary AUR repository

#18 2010-05-12 19:58:00

Re: Binary AUR repository

#19 2010-05-12 20:14:27

Re: Binary AUR repository

#20 2011-12-20 04:42:32

Re: Binary AUR repository

#21 2011-12-20 05:30:34

Re: Binary AUR repository

#22 2011-12-20 09:17:48

Re: Binary AUR repository

Board footer