4 ms·

I think the issue with AUR is that you get your foot in the door with packages like spotify[1]. It does its magic to allow you to install a .deb package on your

I think the issue with AUR is that you get your foot in the door with packages like spotify[1]. It does its magic to allow you to install a .deb package on your distro. I don't know how else to install the Spotify desktop app without AUR. But once you're willing to do that, why not go a little further and trust other packages? Now, someone could argue that the Spotify app isn't important, but there's a reason it has 268 votes. A better solution would be having packages like spotify in their own repo, and a separate, you-better-verify repo for the rest. [1] https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=spotify https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=spoti...

rossvor 4mo ago
I don't have it installed, so I can't comment if it requires constant babysitting, but looks pretty okay to me -- it has no AUR-only dependencies (++), one extra shell script (--), popular (++ given enough eyeballs...). Should be fairly easy to review, anything fishy should be fairly visible in git diff. If I needed it I would be using this PKGBUILD. It's a net gain that it exists there, someone else done most of the work for me. > Now, someone could argue that the Spotify app isn't important, but there's a reason it has 268 votes. A better solution would be having packages like spotify in their own repo, and a separate, you-better-verify repo for the rest. I mean yeah, but everything is trade off of volunteer + user attention. There is no trusted user™ who uses spotify, so it's not in official packages. So you as user need to maintain it yourself or rely on AUR and verify.
- Hackbraten 4mo ago
  > There is no trusted user™ who uses spotify, so it's not in official packages That's not the reason why Spotify is not on extra. Spotify is not on extra because it's not FOSS.
  - rossvor 4mo ago
    That is not true, there are plenty of non-FOSS packages in extra/multilib (e.g steam, discord, nvidia). The only criteria is if there is an interested packager to maintain it. >The large number of packages and build scripts in the various Arch Linux repositories offer free and open source software for those who prefer it, as well as proprietary software packages for those who embrace functionality over ideology. [1] https://wiki.archlinux.org/title/Arch_Linux https://wiki.archlinux.org/title/Arch_Linux [2] https://wiki.archlinux.org/title/Nonfree_applications_package_guidelines https://wiki.archlinux.org/title/Nonfree_applications_packag... [3] https://bbs.archlinux.org/viewtopic.php?id=272134 https://bbs.archlinux.org/viewtopic.php?id=272134 [4] https://bbs.archlinux.org/viewtopic.php?id=273609 https://bbs.archlinux.org/viewtopic.php?id=273609

rossvor 4mo ago

I don't have it installed, so I can't comment if it requires constant babysitting, but looks pretty okay to me -- it has no AUR-only dependencies (++), one extra shell script (--), popular (++ given enough eyeballs...). Should be fairly easy to review, anything fishy should be fairly visible in git diff. If I needed it I would be using this PKGBUILD. It's a net gain that it exists there, someone else done most of the work for me. > Now, someone could argue that the Spotify app isn't important, but there's a reason it has 268 votes. A better solution would be having packages like spotify in their own repo, and a separate, you-better-verify repo for the rest. I mean yeah, but everything is trade off of volunteer + user attention. There is no trusted user™ who uses spotify, so it's not in official packages. So you as user need to maintain it yourself or rely on AUR and verify.

Hackbraten 4mo ago
> There is no trusted user™ who uses spotify, so it's not in official packages That's not the reason why Spotify is not on extra. Spotify is not on extra because it's not FOSS.
- rossvor 4mo ago
  That is not true, there are plenty of non-FOSS packages in extra/multilib (e.g steam, discord, nvidia). The only criteria is if there is an interested packager to maintain it. >The large number of packages and build scripts in the various Arch Linux repositories offer free and open source software for those who prefer it, as well as proprietary software packages for those who embrace functionality over ideology. [1] https://wiki.archlinux.org/title/Arch_Linux https://wiki.archlinux.org/title/Arch_Linux [2] https://wiki.archlinux.org/title/Nonfree_applications_package_guidelines https://wiki.archlinux.org/title/Nonfree_applications_packag... [3] https://bbs.archlinux.org/viewtopic.php?id=272134 https://bbs.archlinux.org/viewtopic.php?id=272134 [4] https://bbs.archlinux.org/viewtopic.php?id=273609 https://bbs.archlinux.org/viewtopic.php?id=273609