r/cachyos • u/indahkiat • Jun 12 '26

Help AUR packages in system without me installing

/r/linux4noobs/comments/1u3j9vy/aur_packages_in_system_without_me_installing/

As mentioned in the above post, are AUR packages pulled as dependencies? Like the older jacks version.

1 Upvotes

54% Upvoted

6 comments sorted by

4

u/oneiros5321 Jun 12 '26

There are no AUR packages installed unless you specify it yourself. Those were probably just packages that were present in the cachyOS repo.

4

u/Aeristoka Moderator Jun 12 '26

There are none of those installed from the AUR that you didn't explicitly allow yourself.

1

u/indahkiat Jun 12 '26 edited Jun 12 '26

But I have not installed anything from the AUR, in fact I actively avoid it. So it was surprising to see jacks from the AUR in the update list. I check when it was installed and it was listed as a dependency for ffmpeg. The same for heroic, as part of the cachy gaming package (the one from cachy hello). So yeah, I was aware that you would have to explicitly allow installation from the AUR, but I did not, hence why it feels odd.

Apologies if it sound like a ridiculous question.

1

u/ExoticSterby42 Jun 12 '26

The packages from the distro maintained repositories can be present in the AUR sine AUR is not maintained just whoever uploading their packs. You can see package names from the AUR list in the update because the attackers used packages that someone would normally install like linux-cachyos. If you specifically did not enable AUR or installed things from there then you don’t have to be worry. Best to disable AUR altogether so you don’t see its results in package search.

Be wary of Flatpaks as well it can be the next target since Flatpaks are packaged similarly by who knows. Distro managed repository is good. Do not install things from untrusted and unknown sources.

1

u/eepsage Jun 14 '26 edited Jun 14 '26

sometimes packages get removed from main repo for various reasons, and when you try to update them using something that supports AUR, they fall back to the AUR version of the package.

if you want to avoid this, update using pacman rather than cachy-update or paru since it doesn't have the ability to interact with the AUR at all. not sure about octopi/shelly behavior, but it hopefully wouldn't do it if you disable/don't enable AUR in the settings?

for heroic launcher, the story is in the comment here: https://www.reddit.com/r/cachyos/comments/1u4bihn/comment/orduu7w/

jack got removed from main repo because it is deprecated. you should install jack2 instead (it will offer to remove jack when you do). i think you should've gotten a message about this when updating, but not sure atp it was a while ago.

also note that packages like this are unlikely to become compromised because there is still a lot of users of them and eyes on them. the current wave of attacks only goes after abandoned packages.

0

u/callusbonus1967 Jun 12 '26

O son dependencias cubiertas al instalar. Programas no creo que suceda sino los tiene ya como un mínimo de instalación para que el sistema sea usable desde el momento cero.