3 ms·

If the PPA is run by the project then you don't need to trust someone else. Sometimes AUR packages are created by a developer for the project but since you are

If the PPA is run by the project then you don't need to trust someone else. Sometimes AUR packages are created by a developer for the project but since you aren't trusting a particular URL that is run by the project it is possible that that will change later without you noticing if you are auto updating from AUR.

dartharva 4y ago
Whoever makes the PKGBUILD, it almost always points to and builds from the original project's git server in a client machine. You can verify that from the package's AUR web page. And about project maintainers running PPAs - Say you're a dev, and you want to package binaries for your software. What's easier, whipping up a quick PKGBUILD once and putting it in your git server, thus allowing anyone to get the latest updated build at anytime, or setting up accounts and painstakingly compiling and updating each build to a PPA? Are you aware of the hundreds of abandoned PPAs that lie orphaned after maintainers gave up in frustration about how cumbersome they are?
- joveian 4y ago
  I haven't looked that often since it is easiest to try to avoid software that isn't in the main package system, but I rarely see PKGBUILD checked into the upstream project. It is more common in my experience that an upstream developer manages the AUR package on the Arch website, not as part of the project. You can verify AUR packages before using them (this is what I do) but it is an extra step vs. a maintained PPA. AUR packages can be unmaintained as well. No matter the system the best situation for users is when the software you use is in the main package system.
  - dartharva 4y ago
    Well if you're avoiding software that isn't in the main package system then it doesn't make a difference either way - the official Arch repository has almost everything the official Debian/Ubuntu repositories do that isn't distro-specific.

dartharva 4y ago

Whoever makes the PKGBUILD, it almost always points to and builds from the original project's git server in a client machine. You can verify that from the package's AUR web page. And about project maintainers running PPAs - Say you're a dev, and you want to package binaries for your software. What's easier, whipping up a quick PKGBUILD once and putting it in your git server, thus allowing anyone to get the latest updated build at anytime, or setting up accounts and painstakingly compiling and updating each build to a PPA? Are you aware of the hundreds of abandoned PPAs that lie orphaned after maintainers gave up in frustration about how cumbersome they are?

joveian 4y ago
I haven't looked that often since it is easiest to try to avoid software that isn't in the main package system, but I rarely see PKGBUILD checked into the upstream project. It is more common in my experience that an upstream developer manages the AUR package on the Arch website, not as part of the project. You can verify AUR packages before using them (this is what I do) but it is an extra step vs. a maintained PPA. AUR packages can be unmaintained as well. No matter the system the best situation for users is when the software you use is in the main package system.
- dartharva 4y ago
  Well if you're avoiding software that isn't in the main package system then it doesn't make a difference either way - the official Arch repository has almost everything the official Debian/Ubuntu repositories do that isn't distro-specific.