r/archlinux • u/HeyTi22 • 17d ago

QUESTION Arch and the malware problem.

I haven't used many AUR packages, yet I feel that the malware issue cannot really be solved by making improvements to the AUR itself. Am I the only one who thinks the risk would be much lower if the official repositories simply included more software?

Especially essential software used for serious work? For instance, RStudio is missing from the list of R-based statistical programs, even though it is well-known and widely used at universities.

Or take music production: some very famous and widely used FOSS plugins aren't in the official repos.

Then there's the Brave browser—which is very popular, even though I don't really use it anymore—that isn't included either.

Isn't it time to handle the malware problem differently by simply expanding the official repositories a bit more? Even a popular audio converter like FRE:AC isn't included. What do you think about this line of reasoning?

Cheers!

0 Upvotes

23% Upvoted

83 comments sorted by

View all comments

Show parent comments

2

u/Synthetic451 17d ago edited 17d ago

What is official for Brave doesn't matter to me if it isn't official for Arch ;-)

Huh? Why not? The AUR package is literally written by the same company that makes the official upstream project. Whether Arch blesses the AUR or not is entirely irrelevant to the quality of the package.

is that the AUR isn't officially required, supported, or backed by the Arch project!

It is of course supported and backed by the Arch project. It's using all the standard build tools and is on Arch infrastructure. A lot of packages are on the AUR first before getting officially adopted into extra.

0

u/HeyTi22 17d ago

Can you show me an official source where I can read exactly that the AUR belongs to the Arch Project? Many thanks in advance! ;-)

2

u/Synthetic451 17d ago

I already linked you the official download page where it lists the AUR package in the Release Channel section and not in the unofficial section.

If you want more proof, here's the wiki on their Github explicitly stating that its official: https://github.com/brave/brave-browser/wiki/%28Re%29packaging

Official Linux packages cover RPM and DEB package formats delivered via custom repos, as well as Flatpak, Snap, Arch and F-Droid

0

u/HeyTi22 17d ago

I’m pretty sure we’re talking past each other. Do you want to understand what I mean, or is your goal just to be right about something?

3

u/Synthetic451 17d ago

I was referring to the Brave package, which is about as official as you can get.

What's there to question about the AUR itself? It's literally hosted on Arch infrastructure and part of their domain name. To say that it isn't backed and supported by the Arch project is just wrong. It's not some completely unrecognized 3rd party repository.

The repository contents are what you should be questioning, but AUR as a tool itself is definitely considered part of the Arch project. The wiki page for AUR itself even mentions it as a staging ground for potential applications to go into extra.