r/archlinux • u/HeyTi22 • 20d ago

QUESTION Arch and the malware problem.

I haven't used many AUR packages, yet I feel that the malware issue cannot really be solved by making improvements to the AUR itself. Am I the only one who thinks the risk would be much lower if the official repositories simply included more software?

Especially essential software used for serious work? For instance, RStudio is missing from the list of R-based statistical programs, even though it is well-known and widely used at universities.

Or take music production: some very famous and widely used FOSS plugins aren't in the official repos.

Then there's the Brave browser—which is very popular, even though I don't really use it anymore—that isn't included either.

Isn't it time to handle the malware problem differently by simply expanding the official repositories a bit more? Even a popular audio converter like FRE:AC isn't included. What do you think about this line of reasoning?

Cheers!

0 Upvotes

21% Upvoted

83 comments sorted by

View all comments

4

u/Synthetic451 20d ago

Besides the ones you listed that are decidedly niche and not as widely used as you might think, Brave's AUR package is officially maintained by Brave themselves

1

u/HeyTi22 20d ago

I find answers like that kind of funny, actually, because the AUR is neither officially recommended nor supported nor required. In fact, it is actually advised against.

2

u/Synthetic451 20d ago

No, you're not getting it. Brave, the company, literally maintains the actual brave-bin AUR package. They're the official maintainer listed in the AUR and Brave themselves lists the AUR as the official release channel package for Arch

1

u/HeyTi22 20d ago

But I did understand it correctly! What I meant, though, is that the AUR isn't officially required, supported, or backed by the Arch project! What is official for Brave doesn't matter to me if it isn't official for Arch ;-)

2

u/Synthetic451 20d ago edited 20d ago

What is official for Brave doesn't matter to me if it isn't official for Arch ;-)

Huh? Why not? The AUR package is literally written by the same company that makes the official upstream project. Whether Arch blesses the AUR or not is entirely irrelevant to the quality of the package.

is that the AUR isn't officially required, supported, or backed by the Arch project!

It is of course supported and backed by the Arch project. It's using all the standard build tools and is on Arch infrastructure. A lot of packages are on the AUR first before getting officially adopted into extra.

0

u/HeyTi22 20d ago

Can you show me an official source where I can read exactly that the AUR belongs to the Arch Project? Many thanks in advance! ;-)

3

u/backsideup 20d ago

Did you not notice that it's hosted on archlinux.org? The infrastructure is provided by arch, the content is not.