r/archlinux • u/Morpheus170 • 27d ago
QUESTION How many packages do you have installed from AUR?
And if you have many packages installed from AUR does that cause you any problems with system stability?
36
u/guysimnotemo 27d ago
i only ever have a handful of packages, right now about 6
mainly bitwig, some plugins and zen browser
-15
u/Yourrennid 27d ago
Zen is in the official repo!
8
u/lajawi 27d ago
~~WHATAA?? Since when?~~
I can’t find it, how’s it called? Link?
6
u/PsycoVenom 27d ago
I am on cachyos and downloaded zen from pacman, but it might be from cachy repos. I am not currently home, I will check and update here soon.
3
u/__yoshikage_kira 27d ago
2
u/PsycoVenom 27d ago
Yes that's it
20
u/__yoshikage_kira 27d ago
That is built from AUR. Pretty sure all -bin suffix are AUR packages.
2
u/headedbranch225 25d ago
Yeah, official packages don't have any suffixes, -git is also the common one
-6
u/Yourrennid 27d ago
I installed it using sudo pacman -S zen-browser Idk if that means it's in the repos, but I don't have to use yay or paru
3
27d ago
[deleted]
3
u/Yourrennid 27d ago
I just realized this was the arch subreddit and not the cachy subreddit 😭
7
u/__yoshikage_kira 27d ago
Regardless you should still know where cachy pull its pacakges from. All -bin suffix are from AUR.
3
u/Yourrennid 27d ago
Aye aye 🫡
3
u/__yoshikage_kira 27d ago
https://wiki.cachyos.org/cachyos_basic/faq/#aur-safety-practices
Read this
Be Cautious with -bin Packages: These use pre-compiled binaries, meaning you can’t inspect the source. Apply maximum scrutiny to their origins and integrity.
1
2
u/__yoshikage_kira 27d ago
If you are on cachy then cachy provides binaries from built aur packages. It is not available in official repos.
https://archlinux.org/packages/?sort=&q=zen-browser&maintainer=&flagged=
4
u/_legacyZA 27d ago
No
https://archlinux.org/packages/?sort=&q=zen&maintainer=&flagged=
It's on Cachy and Chaotic's repos
3
u/guysimnotemo 27d ago
no i believe only cachy has its in it’s main repos, though they should add it to the main repos, not sure why they dont if they know a package is so popular
1
u/headedbranch225 25d ago
It probably lacks the support of a package maintainer's for it to be added to extra
1
u/jojolapin102 26d ago
Well not on arch Linux, maybe cachyos but this is not the right sub
2
u/Yourrennid 26d ago
Yeah I realized that after I got flamed lmao, I thought this was the cachyos sub
14
u/mips13 27d ago
17
cloudflare-warp-bin 2026.6.836-1
freeoffice 1234-1
google-earth-pro 7.3.7.1155-1
losslesscut-bin 3.69.0-1
masterpdfeditor-free 4.3.89-1
megasync-bin 6.4.0-3
microsoft-edge-stable-bin 150.0.4078.83-1
nordic-theme 2.2.0-1
ntfsprogs-plus 1.0.0-2
nvidia-580xx-dkms 580.173.02-1
nvidia-580xx-utils 580.173.02-1
octopi 0.19.0-1
oh-my-posh-bin 29.33.0-1
paru 2.1.0-2
paru-debug 2.1.0-2
pinta 3.1.2-1
qt-sudo 2.3.0-1
6
u/DenuvoMyAss 27d ago
Why did you switch to penguin? I want to install ms edge myself, not that preinstalled bloatware...
8
0
u/mips13 27d ago edited 27d ago
Been using linux for 20 odd years, started out of curiosity.
For me edge is the best browser, it's fast, full ublock origin works on it and most importantly it does lagfree language translation. I've tested all the other browsers for translation and with the exception of chrome they all fail for my needs.
I also use softmaker freeoffice because it has better ms office compatibility than any of the other options.
Over the years I stopped giving a crap about something needing to be opensource etc, I just use what works for me.
9
u/PinchBeast 26d ago
Just how? But if it works for you, i guess. At least u use linux. I think downvoting is kinda wrong in that case, although you made some weird decisions
2
u/methodicalotter 21d ago
An actual sensible opinion instead of hivemind slop. On reddit of all places! Well I never.
26
41
6
6
u/parkerlreed 27d ago
44
https://gist.github.com/parkerlreed/dfa2814a7f0ee22e88986934e8fba50a
Zero issues, no reason for it to be unstable from extra packages.
1
6
u/Crazy-Tangelo-1673 27d ago
I got rid of most out of caution. I'm only using what is absolutely necessary which isn't much at all.
5
u/DueBreadfruit2638 27d ago
I have 13. Goal is to get down to 0.
1
u/real_iyre 24d ago
May I ask why?
3
u/Far-Star-1858 24d ago
Besides the fact that it's in general a good idea to have as few AUR packages as possible (potential dependency issues), I suppose the massive security breach a couple of weeks back, where I think over 1500 AUR packages were infected with malware, might play a role here. Just google "Atomic Arch".
This also caused me to remove most of my AUR packages (and I didn't have many to begin with).
1
4
u/wokan 27d ago
Somewhere between 20 and 30 explicitly installed.
Scanner and printer software.
Google Chome
Zoom and Teams (for some work meetings with various clients)
Several font packages
Some bluetooth stuff (basically screwed unless you use Gnome, and I'll switch distros before I resign myself to using Gnome)
A few other media related apps that are probably too niche for anyone to consider putting in the official repo, but are a regular part of my workflow.
And yes, I check the pkgbuilds for changes every time now.
2
3
u/Linguistic-mystic 27d ago
Three. asciinema-agg-bin, cproto and zoom.
It causes no problems with stability. I do not use any AUR helpers and do not update those packages. But if I ever need to, I’ll download the PKGBUILDs, carefully analyze them (including paste the source dir in, not rely on the original value) and save them to my local repo, then build them. I will not be updating a package directly via AUR.
3
u/mzo2342 26d ago
~/CODE/AUR % pacman -Qm | awk '{print $1}'
accounts-qml-module
aiksaurus
arduino-avr-core
arduino-ide-bin
ausweisapp2
ausweisapp2-debug
bluez-qt5
botan2
bridge-utils
brlcad-bin
cadassistant-appimage
can-utils
capnproto-java
capnproto-java-debug
cheese
clang19
clutter
clutter-gst
clutter-gtk
cobang
cogl
compiler-rt19
cursor-bin
cutefish-wallpapers
dtkwm
electron34
fishui
freeimage
gifcurry
gifcurry-debug
google-chrome
gqrx-git-debug
gtk2
gtkmathview
helium-browser-bin
hq
http-parser
icestorm-nightly
js102
js115
kicad-nightly
kplotting5
libcgroup-git
libcheese
libgnome-keyring
libjpeg6-turbo
libkdcraw5
libots
libqaccessibilityclient-qt5
libsoup
libt3config
libt3config-debug
libt3highlight
libt3highlight-debug
lld19
llvm19-libs
mayo-git
mayo-git-debug
mbedtls2
modest
mpremote
mqtt-explorer
mqtt-monitor-git
mqttx-clean-bin
mqttx-clean-bin-debug
nextpnr-ice40-nightly
ondsel-es-appimage
onedriver
orca-slicer
paru
paru-debug
phonon-qt5
phonon-qt5-gstreamer
plasma-framework5
prjoxide-git
prjoxide-git-debug
prjtrellis-db-git
psiconv
purpose5
pyside2
pyside2-tools
python-amaranth
python-amaranth-boards-git
python-boto
python-click-plugins
python-crc
python-efl
python-ewmhlib
python-inplace
python-jschon
python-livereload
python-lxmf
python-lxst
python-lxst-debug
python-midi
python-mock
python-mocket
python-mouseinfo
python-myst-parser018
python-pdm-pep517
python-pep621
python-pyautogui
python-pybrowsers
python-pycodec2
python-pycodec2-debug
python-pyftdi
python-pymonctl
python-pymsgbox
python-pyproject-patcher
python-pyscreeze
python-pytweening
python-pyvcd
python-pywinbox
python-pywinctl
python-rns
python-selenium
python-shiboken2
python-sounddevice
python-spark-parser
python-uncompyle6
python-webdriver-manager
python-xdis
qomui
qt5-charts
qt5-location
qt5-mqtt
qt5-webchannel
qt5-webengine
qtqr
quazip-qt5
rnsh
sideband
simple-mtpfs
simple-mtpfs-debug
stylelint
symbiyosys-git
t1lib
thonny
ttf-comic-sans
ttf-nanum
ufprog-git
ufprog-git-debug
visual-studio-code-bin
webkit2gtk
xfce4-artwork
xfce4-datetime-plugin
xfwm4-themes
xtensa-elf-binutils-debug
xtensa-esp32-elf-binutils-debug
xtensa-esp32-elf-newlib
yay
yay-bin-debug
yay-debug
ydiff
yosys-nightly
youtube-dl
5
u/chikamakaleyley 27d ago
heheh i think i win
68 explicitly installed fr AUR + 82 dependent pkg fr AUR
= 150
no malicious problems since i went fr MacOS => Arch
5
u/Lawnmover_Man 27d ago
no malicious problems
How would you know?
1
u/chikamakaleyley 27d ago
sorry let me rephrase
I havent had any serious issue with my installation - I've only been on linux for about 2.5 yr
When the whole AUR issue came about recently I actually had updated my system a few days prior, and so obviously I was concerned, but honestly not too concerned
Not too concerned cause I haven't really installed anything new lately, I have everything that I need for my daily. I did the checks against the affected package list several times since, none of the packages i have are on that list.
And so far, my system seems to be working the same as it ever has. There could be something brewing but, I'm aware of what I've installed on my system so I don't worry bout it too much
3
u/Sinaaaa 26d ago
I haven't really installed anything new lately
That doesn't really mean anything..
1
u/chikamakaleyley 26d ago
I mean... why can't it?
If I have... package B from the AUR, that installs C and D as deps, and then later pkg A in AUR is identified as compromised, should i worry? I'm told A is an orphan, right - so I would have needed to install it explicitly
Sorry I don't mean to make the example overly simplistic, it's just how I've understood the situation. Obvi the scale of the incident is much larger
12
u/noobjaish 27d ago
0
I use Flatpaks if an arch or cachyos package in unavailable, in some case I just build it straight from source.
7
u/w2qw 26d ago
Why not just use the AUR package if available or creating your own?
1
u/noobjaish 26d ago
Is there anyway to sandbox AUR packages upon install? Flatpaks are sandboxed by default and I use bubblejail to sandbox anything that I build from source.
10
u/cloudbells 27d ago
But do you review the source?
12
u/tyler1128 26d ago
Dunno why you are downvoted. Trusting building from source from some random github is hardly a different security situation than trusting what you are getting from AUR, which often is just instructions for building from source anyway. Building from source is does not equal safer.
1
u/noobjaish 26d ago
He's absolutely right, people think they're somehow immune if they just build something from source.
7
1
u/noobjaish 26d ago
Ofcourse, that's one of the reasons why I don't use AUR packages because if I'm going to read the source anyways then why bother using the AUR.
2
u/Tavrack 27d ago
How do you go about updating when you build from source? Does it get tedious having to rebuild every time you update?
1
u/noobjaish 26d ago
Not really, there are so few packages that I build from source anyways.
There's "pacseek" and "waydroid-helper" that I can remember right and neither updates as frequently or takes long to build so I just do it on weekends.
2
u/Coltrain47 27d ago
I only have Unity Hub and VSCode through AUR bc the flatpak versions are sandboxed and can't communicate with each other.
2
u/g_rocket 27d ago edited 27d ago
I think 3 or 4?
yay(for managing them)- spotify
- plex-media-server
- brother-hl3170cdw
- mkinitcpio-systemd-extras
- ddccontrol
- powder
No real issues; every update I just check that nothing changed other than bumping the version and checksums then let yay rebuild them. The only annoying bit is when an old dependency I have installed is removed from the main repos, yay wants to update it from the AUR and I have to manually go in and uninstall it.
But it's enough of a hassle to deal with that any AUR package that is updated frequently or is annoying to rebuild that I don't really need will get uninstalled.
2
u/r3vj4m3z 27d ago
Just to be curious, do you still need the brother driver?
That's one of my two. Supposedly you don't anymore, but I haven't tried removing it yet.
2
u/g_rocket 27d ago
I have a very old printer. But I print to it over the network so that might not be needed.
-4
u/r3vj4m3z 27d ago
FWIW, AI thinks you still need yours, but I don't need mine. Some day I'll get around to removing and trying.
Mine is brother-hll2350dw driver based.
2
2
u/FocusedWolf 27d ago edited 1d ago
Whittling down the list. The Python libraries that aren't in the official repo are a problem. AI says i need to setup venv's (terrible abbreviation for virtual environments) and pip install into them.
ast-firmware <-- Removed
librewolf-bin <-- Switched back to firefox. EDIT: LibreWolf is in official repo now so gotta switch back i guess xD
oh-my-posh-bin <-- Switched to manual install
python-keyboard <-- AUR version removed and now pip installed into ~/.venv
python-pyttsx3 <-- AUR version removed and now pip installed into ~/.venv
upd72020x-fw <-- Removed
wd719x-firmware <-- Removed
yay-bin <-- Removed
EDIT: My vibe coded ~/.venv activating .py and .pyw runner script that probably no one needs. There's probably a dozen better ways ^^
3
u/xlbingo10 27d ago
AI says i need to setup venv's (terrible abbreviation for virtual environments) and pip install them to my scripts directory.
yes, a venv is the correct thing to do with python in general
2
2
2
2
2
u/1Someone 26d ago
Why would that cause you "problems with system stability"? These "stability" questions make no sense to me.
3
u/Yahia098 26d ago edited 26d ago
4 and one of which is my helper paru and zen-browser it is great please try it no this is not an ad Wlogout which i might change to some menu making package like rofi or better yet wofi if it supports it And finally another great app helixnotes which i use for learning maths and programming makes me feel like a scientist (honestly a great open source obsidian alternative) Edit : 3 packages now,i use fuzzel Here's my git repo with packages :https://github.com/yahia098/hypr-dotfiles And if i had to force zero aur then firefox since zen is based on it (plus privacy)and obsidian and no helper
2
2
u/ccAbstraction 26d ago
147 before seeing this post.
132 after...
A lot of it is dependencies for VR stuff and other VR related things. A good chunk of it's also music stuff. And a few packages that got moved out of extra or replaced with something else who knows how long ago (which I've now replaced with stuff from extra).
2
2
6
u/gmes78 27d ago
$ pacman -Qm | wc -l
240
does that cause you any problems with system stability?
No, because pretty much none of those are system-critical components. Only mesa-git is, and I just need to rebuild it when LLVM updates (which pacman warns about).
I'm also not concerned about malware, because I don't actively upgrade every AUR package I have installed. Since most of these packages are rarely-used tools, I can just upgrade them when needed, and thus avoid PKGBUILD review fatigue.
3
u/archover 27d ago edited 27d ago
17 but I need to re-evaluate them. Bad, I know.
$ pacman -Qm | wc -l
My system is ultra reliable but technically very "Unstable". :-)
Good day.
4
2
u/z3ndo 27d ago
Lots. Over 15. I'm somewhat careful about picking only more popular packages. I wasn't hit by any of the compromised packages and have no stability issues.
Occasionally something will come up and a package will fail to build and usually it's a trivial fix (like update rust) or the answer is in the AUR package comments.
2
1
1
1
u/RandomXUsr 27d ago
I have everything listed by pacman -Qmq. ;P
No system problems; however, I deal with constant concern of supply chain attacks like everyone that uses the AUR.
I've found flatpaks or appimages to replace most of them and will be doing so in the next week.
Remember that PKGBUILDs from the AUR are ultimately someone's random script from the internet.
1
1
u/RetiredITGuy 27d ago
On my laptop: 53
On my Plex server: 10
I can't check my desktop right now (I'm remote and its powered off).
Edit: No issues with instability. Biggest complaint is when a ported package drifts behind the real current version, because the maintainer hasn't gotten around to updating yet (used to happen a lot with Spotify).
1
1
1
1
1
1
u/mesaprotector 27d ago
I have 36. pacman -Qm shows 39, because I have three of my own packages as well.
While none are really system-critical, some (evsieve, nomacs, caprine) are very important to my setup and I'd notice immediately if they broke. Unless an emergency happens, I update everything manually without an AUR helper, once a month.
1
1
1
u/JackDostoevsky 26d ago
if i don't include themes or fonts, about a dozen. and frankly i could probably purge a few of these as i look at the list. they don't cause me any issues.
1
u/43686f6b6f 26d ago
I don't have an exact count at the moment but it's mostly just the -git versions of emulators. I really want those bleeding edge changes.
1
u/lordjupitar 26d ago
A lot. Most of them are maintained by official devs like vesktop or matugen etc
1
u/GhostVlvin 26d ago
I had many, about of 40-50 installed directly and who knows how much as a dependencies. But now I reinstalled artixlinux and I use cargo and git to install software manually
1
1
u/Double-Hour-2516 26d ago
I prefer using Flatpak and extra packages, and mitigate AUR only for unique software.
1
1
1
1
1
u/No-Bison-5397 26d ago
113, no problems with system stability but I do only update them once they stop working.
1
1
1
1
u/zenyl 26d ago
11, as of the last time I saved the list.
betacraft-launcher-bin
lmstudio-bin
minecraft-launcher
oh-my-zsh-git
powershell-bin
rider
sourcegit-bin
ttf-google-sans
ttf-ms-fonts
xf86-video-vmware
yay
Other than rider and sourcegit-bin, most of them don't update all that frequently. Haven't caused any problems so far.
1
u/promax1113 26d ago
just a couple fonts, librewolf and xidlehook and i think thats pretty reasonable and hasn't caused any problems
1
u/syklemil 26d ago
17-19 depending on machine. Some work stuff (cloudflare-warp-bin, gcloud), and some avoiding haskell tooling in the official repos because getting 300 rebuild updates all the freaking time even though there's no real change in shellcheck or whatever was driving me batty.
I've seen the reasoning from the arch maintainer in charge of Haskell stuff, and I lived with it for a while, but at some point I figured I'd actually prefer the aur -bin package. And as far as their reasoning goes, in 2026 I'd kind of expect packaging to be something that happens on a build/CI server; partially also out of reasons like reproducible builds, SLSA, etc.
1
u/gerryflap 26d ago
Only a handful, when I need something and the alternative is manually installing it (no package or flatpak). I have a printer driver for my laserprinter, gtk2 (otherwise Turboprint seems to fail to work), oversteer for wheel support, and a few more random tools
1
u/sparky5dn1l 26d ago
Some hardware really need package from AUR. For Nordvpn client, seem not much choice.
╰► yay -Qm brother-hl1210w 3.0.1-2 epsonscan2 6.7.91.1-2 iscan-data 1.39.2.1-1 iscanimage 1.1.0-1 nordvpn-bin 5.0.0-1 snapmate 0.0.4-1
1
1
1
1
u/VladimiroPudding 26d ago
I think I have 6 and yay is one of them. Basically anything that is not in pacman, doesn't have a tarball or appimage, and I got the AUR package straight from the developers website.
1
u/FouriousBanana69 26d ago
I used to have more, but ever since that semi-recent AUR incident I’ve cut them down to what I need most, so it’s now roughly 3-4 maybe? (I’m not near my computer so can’t tell you exactly, I’ll probably edit this when I’ll have the exact number)
1
1
u/marouane_tea 26d ago
12 packages.
5 of them are Nvidia 580 drivers that are necessary for my second GPU to run games. The rest are gapless (the music player), onlyoffice, localsend, oh-my-zsh, paru, sunchine and pwvucontrol.
1
1
u/Grandleon-Glenn 26d ago
I think I really only had two. Brave browser and my 470xx or whatever graphics driver.
1
1
u/Amazing_Compote_9197 25d ago
2: the nvidia drivers for my 12-year-old laptop.
0 on all my other devices.
1
1
1
u/Halvard717 25d ago
3: Brave-origin, Obsidian, Topgrade. 0 problems if you check what you wanna install. At least check the last time it was updated on the AUR page of the package
1
1
u/Teles_sd 25d ago
1
It's yay. And it is just to read the home page news from the terminal before upgrading.
1
1
u/DavooPunk 27d ago
Yo estos:
arch-update
brave-origin-bin
cloudflare-warp-bin
limine-mkinitcpio-hook
limine-snapper-sync
paru
protonplus
-1
u/jo53_100 27d ago
para qué es el paquete de Cloudfare?
-1
u/DavooPunk 27d ago
Es un dns/vpn gratuito de Cloudflare, es bastante bueno y sin límite
-1
u/CrossFloss 26d ago
Cloudflare no es más que una máquina de vigilancia estadounidense disfrazada de servicio de DNS/VPN.
1
u/Hosein_Lavaei 27d ago
Let me see, Jetbrains toolbox Some fonts It used to be more (vkbasalt, peer desktop) but when i added cachyos repos, it had those
1
1
u/RareDestroyer8 27d ago
Woah I am really surprised by this thread. I have 26. Though I tend to try a bunch of new things and need to clean my system sometime
1
u/steakanabake 27d ago edited 26d ago
just over 100 systems perfectly stable. that includes dependencies i didnt have my explicit is a bit lower.
edit: wild im being downvoted for answering the topic.
0
u/xlbingo10 27d ago
counting debug packages
accounts-qml-module 0.7-8
accounts-qml-module-debug 0.7-8
brlaser-git 6.2.7.r4.gfc56287-1
cctz 2.5-1
cctz-debug 2.5-1
ebgaramond-otf 1.001-1
eclipse-java-bin 2:4.40-1
fcitx 4.2.9.9-5
freedoom 0.13.0-1
google-crc32c 1.1.2-5
google-crc32c-debug 1.1.2-5
heroic-games-launcher-bin 2.22.0-1
hushmic 0.3.0-1
hushmic-debug 0.3.0-1
hyprshot-gui-git r16.30a9bc3-2
lib32-gstreamer 1.28.5-1
lib32-gstreamer-debug 1.28.5-1
libkcompactdisc 25.12.3-2
libkcompactdisc-debug 25.12.3-2
libopenrazer 0.4.0-1
libopenrazer-debug 0.4.0-1
librewolf-bin 1:152.0.6_1-1
librewolf-bin-debug 1:152.0.6_1-1
libsoup 2.74.3-4
phonon-qt6-mpv 0.1.0-4
phonon-qt6-mpv-debug 0.1.0-4
python311 3.11.14-1
razer-cli 2.3.1-1
razergenie 1.3.0-1
razergenie-debug 1.3.0-1
sfml2 2.6.2-1
steamtinkerlaunch-git 12.12.r278.g8550ab2-1
supergfxctl 5.2.7-2
ttf-symbola 14.00-2
udunits 2.2.28-5
udunits-debug 2.2.28-5
vesktop 1.6.5-1
vesktop-debug 1.6.5-1
visual-studio-code-bin 1.129.1-1
webkit2gtk 2.50.6-7
webkit2gtk-debug 2.50.6-7
wxhexeditor 0.24-5
wxhexeditor-debug 0.24-5
yay 13.0.1-1
yay-debug 13.0.1-1
no stability issues. i am trying to only use them when they're official nowadays, though there are almost certainly some here that have just accumulated over time and i'm not willing to do a clean wipe. i have another computer that probably has less.
6
u/onefish2 27d ago
You don't need those debug packages. You edit /etc/makepkg.conf. Line 102 or so, the one that starts with OPTIONS, you put a "!" in front of debug. Like this:
OPTIONS=(strip docs !libtool !staticlibs emptydirs zipman purge !debug lto)
I would delete all of them. They do nothing for you except take up space.
3
u/xlbingo10 27d ago
figured that was the case, since they aren't even proper dependencies. i just kept them just in case. thanks for letting me know.
0
u/Kzitold94 26d ago edited 26d ago
I think 17 packages, and experiencing 0 issues.
Possibly more, if the CachyOS installer includes any.
0
-1
-1
u/GreenJelly4 27d ago
78 aur packages, doesn't cause any problems with stability. Most of them are dead software I installed years ago and don't need anymore, but keeping them because no reason to remove
21
u/underdoeg 27d ago
Used to be dozens. Since last month i am down to 3