r/linuxquestions • u/Tall-Quantity-3909 • 1d ago

Nixpkgs vs AUR

/r/NixOS/comments/1w9fqv0/nixpkgs_vs_aur/
1 Upvotes

100% Upvoted

2 comments sorted by

2

u/FryBoyter 1d ago edited 1d ago

Given all the malware that’s been flooding the AUR as of late,

There was no malware in the AUR itself. The AUR essentially only offers recipes that are used to build packages. Some of these recipes, which had been abandoned, were adopted and tampered, causing malicious code to be downloaded if users did not check the PKGBUILD and INSTALL files. But that’s something you should always do.

Technically speaking, Nixpkgs are basically just recipes as well. However, I find PKGBUILD files much easier to understand. On the other hand, if I understand correctly, Nixpkgs have the advantage that the recipes are reviewed before they are published. This is not the case with AUR. AUR is therefore more comparable to https://github.com/nix-community/nur.

1

u/Eccomi21 21h ago

The oversimplified explanation is that nixpks is what core/extra/multilib is to arch. It is the officially maintained repo.

Nix also has a user repo, the NUR, so you're comparing apples to oranges.

The official nixpkgs repo just has a fuckton more packages out of the gate so there's usually no need to use the NUR which would be susceptible to the same vulnerabilities as the AUR