The beloved lightweight distro
This is the main reason that one should learn to read PKGBUILDs. Any AUR helper like Yay or Paru should give the option. Just make sure that the package downloads from an official source and contains only the necessary build and install instructions.
But I agree. Some people treat the AUR as just another repository, when it most definitely is not.
This is something that I still need to learn about. What is a good starting point to learn how to read them?
It's a shell script. Somebody wrote down the shell commands to download, extract, compile from source code. If you can do shell stuff then you're about 1/2 way there. If you've ever manually compiled from source code then you're all the way there pretty much.
It's quite simple since there isn't any other abstraction to learn than what many Linux users already know. Shell commands and compiling stuff.
Probably the one thing that might be foreign is variable and functions of shell scripting.
It's pretty clearly stated on the front page of aur.archlinux.org: "DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk."
Warnings about AUR packages being potentially dangerous have been around since the days of IRC. Scary, reason to take pause, but also not new.
In fact, exactly that has already happened in past.
https://thehackernews.com/2018/07/arch-linux-aur-malware.html
On June 7, a malicious user nicknamed "xeactor" adopted an orphaned package (software without an active maintainer) called "acroread" which functions as a PDF viewer, and modified it to add malicious code.
So definitely check what you're installing.
I think that's kind of the point of the AUR. It's much easier to get into the AUR so we have all of these packages available, but you have to be a bit more careful than you would be with official repos.
This is why you always read AUR comments and package file before installing anything from the AUR.
It's important to actually read what's in the packages. The AUR saves me time installing that I can use up front confirming.
It's only scary if you think the AUR is inherently trustworthy. It's not, and every piece of official documentation and various wikis make it abundantly clear it's not. (If you see somewhere that doesn't point it out or edit it so it does.)
The AUR is barely better than pasting J Random Hacker's 'curl http://foo | sudo bash' code you see somewhere to install something. And that's only because at least the AUR makes it easier to inspect what's about to run and what changed.
Yup. If I want to install something "app-like" and it isn't in the main repos I tend to go with the flatpak over the AUR for that reason.
This is one of the reasons I don't recommend Arch to people. To easy to get owned if you don't know what you're doing.