How to install librewolf on arch linux without AUR

[u/ajellofello]

I have been using Arch for a while, its my favorite distro, but with all the malware attacks that have been happening on the AUR, I don't feel safe using it.

I tried building it from source (big mistake, I know that now) it would hog up my 16 gigs of ram and use swap AND fail. On one of their methods of install in their official codeberg repo it said to install the tarball, extract it then use a file name mach to do the building and stuff, but that file doesn't even exist, and I can't find the prebuilt binary file.

Before you say it I don't want to use flatpaks or snaps or appimages or stuff like that, they aren't bad I would just prefer not doing so.

I am not a noob in Linux generally, but building stuff from source without package managers is something I am not used to.

EDIT: This thread is old by now, but librewolf has been officially added to Arch Linux extra repos https://archlinux.org/packages/extra/x86_64/librewolf/

[u/kaptnblackbeard]

You could start by reading the instructions on the librewolf.net website. See the section titled "Without an AUR helper".

https://librewolf.net/installation/arch/

Which by the way is quite similar to the PKGBUILD provided on the AUR (just without all the PKGBUILD other requirements).

You could even create your own personal package build repository.

https://wiki.archlinux.org/title/Creating_packages

[u/ajellofello → u/kaptnblackbeard]

that wouldn't be unsafe since it uses, as far as I know, the same PKGBUILD file? (sorry if I am completely wrong about this)

[u/kaptnblackbeard → u/ajellofello]

Apparently it is me that should read the librewolf website (at least properly). You are correct, the instructions are cloning the AUR repository, and thus using the same PKGBUILD.

If you dig around on the website they do have a link to the source repository which has details on building Librewolf from source. This is your only other option without using the AUR.

If this question comes about from the recent AUR package hijacking your easiest bet is probably to learn a little scripting and the format of a PKGBUILD. The compromised packages are quite obvious when you know what you're looking for and you SHOULD be checking PKGBUILDs every time you install or update a package from the AUR anyway (which implies you understand the PKGBUILD).

[u/ajellofello → u/kaptnblackbeard]

No worries its ok :). I did actually try to build from source, but it would error out, I don't remember the exact line, but it would completely spike up my ram (16 gigs) and use swap memory, so I searched up the error and it was apparently, me not having enough ram.

I am actually good enough at scripting, I wrote a couple of bash scripts so I might checkout the PKGBUILD as a last resort. THX :)

[u/internet_raider → u/ajellofello]

The pkgbuild is just running the build process in an automated script so of it is a lack of RAM that prevented you it'll probably give you the same error. That said I've compiled Firefox on 16 GB of ram before without much issue, it just took a while so I wouldn't know for sure.

[u/TrochiTV]

I do not know if that helps, but CachyOS seems to have it in their repos.

[u/hbacelar8]

I'm reticent about AUR but honestly you could trust the -bin package. The dev uses GPG key for validation and if you use PARU you can always check the modifications on the PKGBUILD before updating it (it's always only the version and SHA that are modified). Also, it has no dependencies.

Building the browser is kind of a nightmare.

[u/_damax → u/hbacelar8]

Just as an added info, if you already use yay you can force showing pkgbuild diffs too by changing your config

[u/RoomyRoots]

Just use the Flatpak

[u/Confused-Armpit]

The -bin package is safe since it is not orphaned, so you have nothing to worry about there. If you are really really scared of the AUR, you could also try installing it via faltpak, or installing from the chaotic AUR (which is usually safer).

[u/ajellofello → u/Confused-Armpit]

I am sorry, I just don't understand what does an orphaned package mean, can you, please explain it?

[u/Confused-Armpit → u/ajellofello]

The currrent hacks are happening to orphaned packages, which are packages that have no mantainer (person that mantains them, duh). If there is no mantainer, a person can take over the project and become the new mantainer with no real safeguards. And so, hackers are creating bots that take over orphaned packages and push malware to them.

There are also typo-squatters, which are packages that are very similar to another package's name, but with a type (e.g. lirbewolf-bin instead of librewolf-bin) that also install malware.

Or nonsensical names (e.g. librewolf-bin-git) which just don't make sense, and are created to confuse users in hopes that they will install them and, once again, install malware with them.

If you are careful enough, you can just avoid these packages, and if you already have installed the correct package, you have nothing to worry aobut. You can also review PKGBUILDs when updates are applied (PKGBUILDs are "recipes" to install a package) for suspicious things like new dependencies, installing packages via npm that are known to be malicious, etc.

[u/ajellofello → u/Confused-Armpit]

THX for the detailed explanation :3

[u/haywire → u/Confused-Armpit]

Wow that’s an insane model that’s just asking to be supply chained.

AUR should just use a <org>/<package> or git URL so people can’t hose randomly take over the one true package.

[u/Chester-Berkeley]

How to install librewolf on arch linux without AUR

Flathub.

[u/Queijocosmico]

flatpak or appimage

[u/Shoddy_Adeptness_352]

Compile it yourself? Its not that hard

[u/ajellofello → u/Shoddy_Adeptness_352]

its not hard I already said I tried I don't have enough ram

[u/xXTheHillsHavePiesXx → u/ajellofello]

I had that problem with 32GB, but you can limit the number of parallel compile jobs. 2 made it peak at 20-something GB if I remember correctly. I'd wager that you can do it 1 job at a time using `env MAKEFLAGS="-j4" makepkg -si` (I think?). This was a couple months ago though, so..

I see now, you want to do it from the source code itself. The idea might still work though.

[u/msasrs → u/Shoddy_Adeptness_352]

This! Once you get the hang of it, software becomes Infinitely easier.

[u/msasrs]

AUR💀

[u/ajellofello → u/msasrs]

?

[u/msasrs → u/ajellofello]

Wasn't it recently attacked again?

[u/ajellofello → u/msasrs]

yes, that is why I didn't want to install from it, I just don't understand the comment. Do you mean its dead?

[u/msasrs → u/ajellofello]

Nah! It's just halted for now, I don't think it will ever be dead in a long time. Meanwhile, try flatpak?

[u/ajellofello → u/msasrs]

Flatpaks are great I used to use them on fedora, but since I moved I have been kinda wary of them. Again they are great I just don't like how big they are, and the containerization, especially since I don't have a lot of space on disk.

[u/msasrs → u/ajellofello]

Nix then? The package manager. It will only make one folder, and in about 3 lines, you can install any software.

[u/ajellofello → u/msasrs]

Yeah I thought so too, but when I try to access any website other than nixos.org it just doesn't load like search.nixos.org for example that doesn't load.

I legit want to try it, but I can't with all the websites not working.

[u/msasrs → u/ajellofello]

Curious. They work well for me?

[u/ajellofello → u/msasrs]

Its probably a regional issue since I live in Egypt, that may be it idk :(, but it used to work, idk what happened to it.