On 8/8/26 4:12 AM, CraftingDragon007 wrote:
That's amazing so the 300+ people actively using it should just go about
their day without security updates to their browser (except the people
who really want to update it themselves), until the aur is finally
reopened in soonTM
These are the times that try men's souls... (and women's)
Necessity is the mother of invention (or at least darn good motivation
for learning)
When faced with unavailability of current packages through AUR, it's
a great opportunity to simply learn to build the package you want. The
PKGBUILD for that package (or a similar clone) is likely available. All
that needs to be done is to modify the existing PKGBUILD so it will
build the current package you are after. A PKGBUILD isn't magic, it's
just a bash script that you can modify as needed.
As mentioned earlier in the thread, most times you simply need to
grab the current snapshot for the package (.tar.gz) which contains the
PKGBUILD and often just change the 'pkgver' variable to match the
current version you want to build. Then just generate the new checksum
to match the new source with 'makepkg -g', update the PKGBUILD with it
(copy/paste) and now you are ready to build the current package -- but
don't stop there. Before you build, do it right, set up and build in
clean chroot. [1]
The page has everything you need to protect your system from the
build by forcing the build be contained in that chroot and not touch
your running system. You can do it with a few simple command-line
commands. The only challenge is for the odd (old) package that has a
number of AUR-only dependencies, which means you just have to build them
first (same process) and install them in your chroot to support the
build of the package you want. (see: 2.2.1 Pre-install required
packages, the -I option)
Now of course all this means confirming that any package you pull
from AUR doesn't contain malware, but the moderators have done a whale
of a job identifying those packages, deleting the malicious commits and
restoring the package to the pre-compromise state. You can check the
history for the package to help with your assessment of whether it has
been altered, and if you have suspicions you can't resolve, you can ask
here.
Yes, there are some extra steps compared to simply grabbing an AUR
package or having it installed by a helper, but this is where
open-source requires each of us to do our part and give back with a bit
of effort to ensure the system continues to thrive while still being
able to exercise "user-choice" over the specific package we want on our
system.
It's learning, and each day you learn something new, has been a good
day. Good luck if you go this route and you can always ask for help if
you get stuck. The libera.chat #archlinux channel is also a very
responsive source for help, also a great source.
[1] DeveloperWiki:Building in a clean chroot - ArchWiki
https://wiki.archlinux.org/title/DeveloperWiki:Building_in_a_clean_chroot
--
David C. Rankin, J.D.,P.E.
