4 ms·

There's tons of alternatives to yaourt, thankfully.

• cyphar 11y ago
  But AFAIK they all use package-query (pacaur does IIRC).
  • heinrich5991 11y ago
    `packer` does not: https://aur.archlinux.org/packages/packer/ https://aur.archlinux.org/packages/packer/
  • creshal 11y ago
    https://aur.archlinux.org/packages/package-query/ https://aur.archlinux.org/packages/package-query/ Only pacupg does, according to this. pacaur, cower, apacman, packer, and all the others (https://wiki.archlinux.org/index.php/AUR_helpers https://wiki.archlinux.org/index.php/AUR_helpers) don't.
• baldfat 11y ago
  I still manually build off the AUR and don't use AUR package management.
  • coldpie 11y ago
    yaourt & co. are very useful when you have to build packages with tons of dependencies. I had to build the 32-bit gstreamer stuff from AUR for some Wine work recently, and it saved me tons of time. Just remember to set --noconfirm or it'll ask you to confirm a dozen things for every package :)
    • creshal 11y ago
      > or it'll ask you to confirm a dozen things for every package I bloody well hope it asks before running unverified code off the internet with root permission!
      • coldpie 11y ago
        Yes, obviously you should know what the AUR is before you use it.
        • baldfat 11y ago
          Big reason why I use OpenSUSE at work.
        • tveita 11y ago
          A bunch of AUR packages, like Yaourt itself, download their sources over HTTP and verify them with MD5, so even if you trust the AUR maintainer you have no idea if you're getting the same file they did. It's sad that makepkg still uses MD5 by default in this day and age because "it's faster".
          • creshal 11y ago
            File hashes are only supposed to protect against download errors, not against malicious intent. MD5 is good enough for that, and makepkg supports GPG for actual verification.
            • tveita 11y ago
              I assure you Yaourt doesn't have an .asc signature either. They should be using SHA-256, or Blake 2 if they think the extra seconds spent verifying matter, but insisting on using MD5 is pretty much going out of your way to increase your attack surface. There is no reason to use it in a modern system.
              • creshal 11y ago
                > I assure you Yaourt doesn't have an .asc signature either. That's yaourt's problem, not makepkg's or the AUR's. > They should be using SHA-256, or Blake 2 if they think the extra seconds spent verifying matter, but insisting on using MD5 is pretty much going out of your way to increase your attack surface. It doesn't matter what algorithm you use, file hashes are not a security feature. Use GPG!