Last night while updating my system, I noticed that a random aur package my system depends on was orphaned in the aur. It’s some random deep-down dependency of another AUR package, and it’s not received any upstream commits in a while. Nice and stable, just needed an owner. I decided to adopt the package before someone else did.

It was kinda scary how simple it is to adopt an orphaned package. Create AUR account… click an email link… Done. If someone wanted to squat the package for malicious purposes, it would be stupidly simple.

I get that this is a problem for all community repos, not just AUR (npm, anyone?), but it’s still an unsettling prospect. I feel like it goes unacknowledged some times.

  • 4ffyEnglish
    3·
    1 year ago

    First, you should be familiar with the basic process of compiling and installing software from source. For C or C++ projects, this can be as simple as ./configure, make, make install for projects that use GNU Autotools, or something like cmake -B build, cd build, make, make install for CMake projects.

    I generally split PKGBUILDs into three important parts. There’s the metadata at the top then there’s the build and package functions. build is where everything up to the make (or equivalent build-the-thing) command goes and package is where the make install bits go.

    There’s also the prepare and check functions, but those aren’t used as often.

    As for the actual documentation, the Arch Wiki page for PKGBUILD covers most of the metadata stuff and the page for Creating Packages covers most of the build and package stuff.