Handling AUR packages safely

The AUR is one of the strengths of Arch Linux and its derivatives. Anyone can upload packages there, and Arch developers do not review them first. Only use AUR packages that you really need, and check each one before you build it.

Caution

Supply chain attacks on AUR packages happen. The checks below reduce the risk but do not remove it.

Check the official repositories first

Before you install a package from the AUR, check whether it is already in the official repositories. On Garuda, this includes the Chaotic-AUR. The Chaotic-AUR checks package updates against a list of trusted AUR maintainers. Updates that come from untrusted maintainers and change more than the version or checksums are opened as a pull request for human review. See the Chaotic-AUR forum section for details.

Check the package page

Find the package on aur.archlinux.org and open its details page.

1. Check whether the package is marked orphaned. An orphaned package has no maintainer, so it will not receive updates. It is an easy target for attackers.
2. Check the popularity and votes. A high vote count or a popularity of 1.0 means many users watch the package.
3. Check the dependencies. Make sure you know which of them come from the official repositories and which come from the AUR.
4. Check the last update date. If the package has not been updated for many months or years, do not install it. It probably does not work anymore.
5. Read the user comments. Problems are often reported there.

Install with paru

Do not use a graphical tool for AUR packages. Use the terminal and paru. Paru shows more about what it does.

paru -S yourpackage

When paru asks whether to review the packages to build, always answer yes with Y.

Note

The prompt is quoted as Review packages to build? [Y/n] in some versions and as Proceed to Review? [Y/n] in others. The exact wording depends on the paru version. Answer yes in both cases.

Paru then opens the PKGBUILD. This file is the build recipe. Read through it with the arrow keys. Press q to leave the view. You do not need to be a programmer to spot a problem.

Look for these points in the PKGBUILD:

• The maintainer and the source URL should match the details on the AUR page.
• curl, wget or fetch commands that download code from other URLs can be a sign of trouble.
• npm install or pip install have no place in a package that is not related to JavaScript or Python.
• An install=pkgname.install line means that code runs on install or removal. Read that file too. The AUR web interface does not list this file in the file list, so check it through the View PKGBUILD page. Choose path: root at the top, then open pkgname.install.

If something looks strange, press Ctrl+C to cancel the build. You can ask about it in the forum before you continue.

Note

Paru can also print a PKGBUILD without building anything. Run paru -Gp yourpackage to read it first. This command comes from the paru documentation and was not tested on this page.

Update AUR packages

An update can introduce a compromised version. Review the changes in the PKGBUILD each time you update, not only when you install.

When an update runs, paru shows the build files again. Compare them with the previous version. The AUR web page for the package also lists recent comments and changes.

Chaotic-AUR is not the AUR

The Chaotic-AUR is a separate repository with packages taken from the AUR and added to it. Updates are checked against a list of trusted AUR maintainers. If all maintainers of a package are trusted, or only the version and checksums change, the update goes through automatically. Any other change is opened as a pull request and reviewed by a person. Garuda has a few maintainers who review them. This is not a guarantee, but it is a different level of review than the raw AUR.

Garuda updates Chaotic-AUR packages with pacman as part of the normal system update. This is why pacman -Su seems to update AUR packages.

Use garuda-update to update Garuda, not pacman -Su. Garuda runs its own update steps in garuda-update.

Update AUR packages on Garuda

To update packages from the AUR, run:

garuda-update -a

The -a option, or --aur, sets UPDATE_AUR=1 for that run. It then runs paru -Sua, which updates AUR packages only.

AUR updates are off by default. To turn them on for every run, uncomment UPDATE_AUR=1 in /etc/garuda/garuda-update/config, or tick Update AUR packages in Garuda Toolbox under System settings. The default file has the line commented out:

# UPDATE_AUR=1

UPDATE_AUR=1 turns AUR updates on

Uncommenting UPDATE_AUR=1 enables AUR updates on every garuda-update run. To return to the default behaviour, comment the line out again with #.

Note

When garuda-update runs from Garuda Toolbox, it skips AUR updates. The script prints that Toolbox does not support them and that you should use the terminal and review the updates manually.

---

Source: How to handle AUR packages