How to Install from AUR - FlyingMachineArena

Table of Contents

Understanding the Arch User Repository (AUR)

The Arch User Repository (AUR) is a community-driven repository for Arch Linux users. It contains package descriptions, build scripts (PKGBUILDs), and other related files that allow you to compile packages from source using the Arch Build System (ABS). The AUR is a vital resource for Arch Linux users, as it significantly expands the range of available software beyond the official repositories. While the official repositories are curated and maintained by Arch developers, the AUR leverages the power of the community to provide and update a vast array of packages, often including software that hasn’t yet made it into the official repositories or that is more niche in its appeal.

The AUR is not a mirror of the official repositories. Instead, it hosts PKGBUILD files, which are shell scripts that detail how to download the source code for a given package, compile it, and then package it in a format that pacman, Arch Linux’s package manager, can install. This decentralized approach offers several advantages:

Flexibility: Users can install software not available in the official repositories, including bleeding-edge versions, specialized tools, or even software that might violate Arch’s packaging policies for official inclusion.
Transparency: Because PKGBUILDs are just scripts, users can inspect them before building and installing, ensuring that no malicious code is being executed. This is a crucial security aspect of using the AUR.
Community Driven: The AUR thrives on community contributions. Users can submit new packages, report bugs, and contribute updates to existing packages, fostering a dynamic and responsive ecosystem.

However, it’s crucial to understand that packages in the AUR are not officially supported by Arch Linux. Users are responsible for vetting the PKGBUILDs and for the potential consequences of installing software from the AUR. This means careful consideration and due diligence are required.

The Role of PKGBUILDs

At the heart of the AUR lies the PKGBUILD file. This is a shell script written in Bash that contains all the necessary information and instructions for makepkg, Arch’s build utility, to create an installable package. A PKGBUILD typically defines:

pkgname: The name of the package.
pkgver: The version of the package.
pkgrel: The release number of the Arch Linux package (incremented for changes to the PKGBUILD itself, not the upstream software).
pkgdesc: A brief description of the package.
arch: The architecture(s) the package is built for (e.g., ('x86_64')).
url: The upstream URL of the software.
license: The license under which the software is distributed.
depends: A list of dependencies required at runtime.
makedepends: A list of dependencies required only during the build process.
source: An array of URLs or local files from which to download the source code.
sha256sums: Checksums for verifying the integrity of the downloaded source files.
build(): A function that describes how to configure and compile the source code.
package(): A function that describes how to install the compiled files into the package structure.

By understanding the structure and content of a PKGBUILD, users can gain a deeper insight into the build process and ensure the integrity of the software they are installing.

Installing AUR Helpers: The Efficient Approach

While it is possible to manually build packages from the AUR using makepkg, this process can become cumbersome, especially when dealing with multiple dependencies or frequent updates. This is where AUR helpers come into play. AUR helpers are command-line utilities that automate the process of downloading, building, and installing packages from the AUR. They simplify dependency management, handle package upgrades, and streamline the overall AUR experience.

There are several popular AUR helpers available, each with its own set of features and preferences. Some of the most commonly used ones include:

yay: A highly popular and feature-rich AUR helper that combines the functionality of pacman with AUR access. It’s known for its speed and user-friendly interface. yay can search, install, and upgrade AUR packages, as well as official repository packages, all from a single command.
paru: Another excellent AUR helper that aims to be a more modern and feature-complete alternative. paru also offers seamless integration with pacman and a robust set of options for managing AUR packages.
aura: A versatile AUR helper that focuses on safety and flexibility. aura provides advanced options for managing AUR packages, including pre-compilation and custom build environments.

The installation of an AUR helper itself typically requires using makepkg because the helper is usually distributed through the AUR. This might seem like a “chicken and the egg” situation, but it’s a one-time bootstrapping process.

Installing `yay` as an Example

To illustrate the process, let’s walk through installing yay, one of the most widely recommended AUR helpers.

Install git: If you don’t already have git installed, you’ll need it to clone the AUR repository.
```
sudo pacman -S git
```
Clone the yay AUR repository: Navigate to a directory where you typically store source code for building (e.g., ~/builds or a dedicated directory). Then, clone the yay repository from the AUR.
```
cd ~  # Or your preferred build directory
git clone https://aur.archlinux.org/yay.git
```
Navigate into the cloned directory:
```
cd yay
```
Build and install the package: Use makepkg to build the yay package. The -si flags are important: -s installs missing dependencies, and -i installs the package after a successful build.
bash makepkg -si
You will be prompted to enter your password to install dependencies and the package itself. makepkg will download the source, compile it, and then install it using pacman.

Once yay is installed, you can use it to manage other AUR packages. For instance, to search for a package:

yay <package-name>

And to install a package:

yay -S <package-name>

This process is significantly more convenient than manually managing each AUR package.

Manually Installing AUR Packages: The Fundamental Process

For those who prefer a hands-on approach or need to understand the underlying mechanics, manually installing AUR packages is an essential skill. This method involves downloading the PKGBUILD and associated files, inspecting them for security, and then using makepkg to build and install the package.

Step-by-Step Manual Installation

Locate the Package on the AUR Website:
Go to the Arch User Repository website (aur.archlinux.org). Use the search bar to find the package you wish to install. For example, let’s say you want to install example-package.
Clone the AUR Repository:
On the package’s page, you’ll find a “Git Clone URL”. Copy this URL. Open your terminal and navigate to a directory where you want to download and build the package (e.g., ~/builds). Then, use git clone to download the package’s build files.
bash cd ~/builds # Or your preferred directory git clone https://aur.archlinux.org/example-package.git

Navigate into the Package Directory:
Change your current directory to the newly cloned repository.
```
cd example-package
```
Inspect the PKGBUILD (Crucial Security Step):
Before building, always examine the PKGBUILD file. This script contains instructions that will be executed on your system. Open the PKGBUILD in your favorite text editor.
```
less PKGBUILD
# or
nano PKGBUILD
```
Look for anything suspicious, such as executing arbitrary commands, downloading from untrusted sources, or overly broad permissions. Pay close attention to the source array and any commands executed in the build() and package() functions. If you are unsure about any part, it’s best to avoid building the package or seek clarification from the AUR community.
Build the Package with makepkg:
Once you are confident about the PKGBUILD, you can build the package. The makepkg command will download the source code, verify its integrity using the provided checksums, compile it, and create a binary package file.
```
makepkg
```
This command will download sources and build the package. If it requires dependencies that are not installed, makepkg will usually report this. You can install missing dependencies using pacman. Alternatively, you can use the -s flag with makepkg to automatically resolve and install dependencies:
```
makepkg -s
```
Install the Built Package:
After makepkg successfully builds the package, it will create a .pkg.tar.zst file (or similar extension depending on compression). You can then install this package using pacman.
bash sudo pacman -U example-package-<version>-<release>-<arch>.pkg.tar.zst
Replace <version>, <release>, and <arch> with the actual values from the generated filename. If you used makepkg -si, this step would have been performed automatically after a successful build.

Understanding `makepkg` Options

makepkg offers several useful options that can be combined:

-s (--syncdeps): Automatically installs missing dependencies using pacman.
-i (--install): Installs the package after a successful build using pacman.
-c (--clean): Cleans up leftover build files after the build is complete.
-r (--rmdeps): Removes dependencies that were installed specifically for the build once the package is installed.
-p <PKGBUILD> (--printsrcinfo): Generates a .SRCINFO file, which is useful for package submissions.
--nocheck: Skips the check() function, which often runs test suites. Use with caution, as tests are important for verifying package correctness.

Combining these options, a common manual build command is:

makepkg -sic

This command will synchronize dependencies, build the package, install it, and then clean up the build directory.

Maintaining and Updating AUR Packages

Just like packages from official repositories, AUR packages require periodic updates to benefit from bug fixes, security patches, and new features. The process for updating depends on how you installed the packages.

Updating with AUR Helpers

If you used an AUR helper like yay or paru, updating is straightforward. These helpers are designed to check for updates to both official repository packages and AUR packages.

To update all installed packages (official and AUR):

yay
# or
paru

These commands will list all available updates. You can then choose to proceed with the updates, often by pressing ‘y’ and Enter. The helper will handle fetching new versions, rebuilding packages if necessary, and installing them.

If you want to specifically check for AUR updates without including official repository updates, you can often use flags like:

yay -Sua # Updates AUR packages only
# or
paru -Sua # Updates AUR packages only

It’s good practice to run yay (or your chosen helper) regularly to keep your system up-to-date.

Manual Updates

If you installed packages manually, you’ll need to update them manually as well. The process mirrors the manual installation:

Navigate to the Package Directory: Go back to the directory where you originally cloned the package’s AUR repository (e.g., ~/builds/example-package).
Fetch Latest Changes: Use git pull to fetch the latest changes from the AUR repository. This will update the PKGBUILD and any other related files.
```
cd ~/builds/example-package
git pull
```
Inspect PKGBUILD Changes: Crucially, after git pull, inspect the PKGBUILD again. Changes in the PKGBUILD might introduce new dependencies, alter build steps, or require different configurations.
Rebuild and Reinstall: Run makepkg again, followed by pacman -U to install the updated package.
bash makepkg -s # Build with updated PKGBUILD and sync dependencies sudo pacman -U example-package-<new_version>-<new_release>-<arch>.pkg.tar.zst
Alternatively, you can use makepkg -si to build and install in one go, assuming dependencies are met.

Manual updates require more diligence, as you are responsible for ensuring you are building and installing the correct, updated version.

Best Practices and Security Considerations

Using the AUR extends the capabilities of your Arch Linux system significantly, but it also introduces responsibilities. Adhering to best practices and understanding the security implications is paramount.

Security Through Scrutiny

Always Inspect PKGBUILDs: This cannot be stressed enough. Before building any AUR package, open the PKGBUILD file and read through it. Look for suspicious commands, downloads from unknown sources, or anything that seems out of place.
Check Checksums: The sha256sums array in the PKGBUILD is used to verify the integrity of downloaded source files. makepkg automatically checks these. If a checksum fails, it indicates that the source file has been tampered with or is not the intended version.
Understand Dependencies: Be aware of the dependencies a package requires. If a package has many, or obscure, dependencies, investigate them further.
AUR is Not Trusted: Remember that packages in the AUR are submitted by users. While many are legitimate and well-maintained, there’s no guarantee of security or quality comparable to the official repositories.

Community Engagement and Reporting

Check Comments and Votes: Before installing a package, check the comments section on the AUR website for the package. Users often report build issues, security concerns, or provide helpful tips. High vote counts generally indicate a well-regarded and trustworthy package.
Report Issues: If you encounter a problem with an AUR package, or find a security vulnerability, report it on the package’s AUR page. This helps the package maintainer and the wider community.

Managing AUR Packages

Use an AUR Helper: For most users, an AUR helper significantly simplifies management. However, even with a helper, you should still understand the underlying process and be prepared to inspect PKGBUILDs, especially for critical or less popular packages.
Keep Packages Updated: Regularly update your AUR packages to benefit from fixes and security patches.
Clean Build Directories: After successful installation, you can often clean up the build directories to save disk space. AUR helpers often have options for this, and manual makepkg -c also helps.

By approaching the AUR with a cautious and informed mindset, you can harness its vast software selection safely and effectively, further customizing your Arch Linux experience to meet your specific needs.