So I recently installed Cachyos and I am now met with this problem.
There are kind of 2 main contenders here and I’m split between them. What do you use?
There is pacman + aur and then there is flatpak. Pacman has deep system integration and is much more lightweight but it has deep system integration and requires sudo to install. flatpak has sandboxing and easy permission management but it’s bloated and possibly less performant?
Of course if the package isn’t available on flathub then I will have to use the aur but when both are available it’s hard to decide.
You must log in or # to comment.
Pacman plus the AUR is the move on Arch based distros. The AUR gives you access to basically everything, and paru or yay handles the build chain without pain. Flatpak has its place for apps that ship messy runtime dependencies, but for most things it adds an unnecessary isolation layer. Have you tried paru as your AUR helper yet?
I sometimes prefer Flatpak over AUR, because I do not trust everyone on the AUR to run scripts with root rights on my system. At least Flatpaks are a bit sandboxed (even if the sandbox is an illusion) and the programs don’t install and run with root rights. Sometimes the Flatpak is from the original developer and the script in AUR is not. Or the AUR script is not updated well and often enough, unlike day one Flatpak updates. But Flatpaks do not integrate well in your system and applications can look out of place too. There is a lot to consider, besides what you already mentioned.
I use both, prefer the AUR in optimal cases.
I haven’t actually installed an aur helper yet but when I end up needing one, I think I will go with paru.
I use
yay, as it comes by default with EndeavourOS. It’s basically an AUR helper that usespacmanand works quite the same.Flatpak is a different package manager and has nothing to do with your system packages. They are not exclusive, I use both. So what you basically asking isn’t which package manager people use, but rather which package format.
Same here, I tried a number of arch derivatives and arch as well when I got a new desktop last year (after many years of mac work computers, iMac desktop for my kids, mostly Alpine images in the cloud/on k8s, and many many years of mostly Debian and fedora derivatives before I had kids and had time to putter around with *nix). Endeavor suited my needs (some local LLM stuff, personal browsing, a few OSS projects, and Steam) and yay has generally worked great to bridge the gap between pacman and aur.
Paru, so Pacman & AUR…
With exactly one exception: Steam via flatpak because that’s the single package left that would need 32bit libraries from multilib-repo since Wine finally left those dependencies behind.
That’s interesting I have steam installed through pacman and I haven’t had any issues.
I didn’t have any actual issues with the native install either.
But with [multilib] activated there were dozens and dozens of 32bit libraries pulled alongside their regular version that I didn’t actually need. And I use Wine a lot more than Steam anyway. So once Wine went fully 64bit I decided to get rid of all that legacy multilib 32bit stuff.
Steam via flatpak also works and will do until they, too, fully switch over to WoW64 implementation.
I don’t like Flatpak, so that makes it an easy choice for me. Flatpak apps never quite integrate properly
I like having Flatpaks as a fallback option, but if something is available in the arch repos, aur or chaotic-aur, I’ll always go there first
Yay.
And btw, that question is covered already.
You mean you have a package manager for your system without a password? Why would anyone want that?
Edit: For context. The part I was replying to was edited out.
(I can’t see the edited out part but if it was about yay…)
Yay builds in your local cache and then when it is ready to install it asks for sudo. The reason for this is because sudo can timeout during long builds, and more importantly if you compile with sudo you run the risk of arbitrary code execution. So it is safer to run with just
yayand then it will ask for sudo when it actually needed.You risk arbitrary code execution without needing sudo too.
No, that is not what it was about. I know, don’t run
sudo yay, but rather justyayand wait for password request. What it was is about a configuration to not ask password anymore, a passwordless package manger.
Convenience. It asks the kernel if you’re logged in and if you’re allowed to escalate. So, secure enough for a single-user system.
I don’t feel safe doing so. Would a script be able to run escalated rights without asking me a password? Is it somewhere displayed that such a process is started (notification in example or at least in the terminal a message?). And even for applications I am directly starting, I want it be explicit to require a password, that I am always aware its escalated root rights the app has now.
I can understand your view of convenience and I am “guilty” of some convenience stuff too. But this goes a bit too far for my taste.
Okok, i’ve removed the ssu config part.
Hey, I didn’t meant this to be removed or anything; was just sharing my personal opinion. Everyone can do whatever they want, as long as they are aware of consequences and get teached about it. I’m just a bit paranoid, that’s all.
I use paru
I use an unholy blend of paru, Flatpak, Docker and AppImage apps (no Snap!) with Topgrade to update it all.
Upvoted for Topgrade. It’s honestly so good on any system that employs more than one ‘updatable microcosm’,
It’s like magic too, because any new weird kind of package manager I add, it’s just picks it up and starts updating it. It can even update Windows apparently.
Topgrade seems really cool, I wonder how it compares to arch-update
Look into the Chaotic AUR. It offers pre compiled AUR programs. Almost every app I really need has been there. If it’s not in there and I really need it and will get used often I’ll get it from the AUR.
I dont really like flatpaks much. I’ll use it if it’s easy and I dont plan on using the app much. Apps like Bottles. They are nice to have but rarely do I use it.
Why would you download precompiled AUR binaries? it just seams more stable and secure to compile yourself, with this your trusting a third party when you didn’t have to.
For me it’s convenience, i try to not have a bunch of aur packages. Some big packages can take a good while to compile.
Chaotic is also trying to combat threats by reviewing packages from maintainers that are not in their trust database. While not absolutely perfect at least they are trying to do something.
The aur is a use at your own rick batch of packages. Last year there were some malicious packages running wild. AUR expects the user to do their own due diligence and do you really have time to read every bit of code you are about to install for every update in all the possible languages they could be written in? This is why I try to limit my dependence on the aur if possible chaotic or otherwise.
Personally, I use pacman when possible and flatpak when it’s not. I try to avoid the aur as I have had too many problems with missing dependencies or version conflicts. Plus, I don’t generally need things that are not in the repositories so it rarely comes up.
“But flatpaks are not lean!” While this is true, I find flatpaks don’t break my system. Flatpaks do use more resources, from storage to RAM, but I have plenty of both so it’s not really a concern.
My reason for using arch linux is to have as little bloat as possible. So, pacman. Yay sometimes for AUR stuff, but my need for it is rare.
when both are available it’s hard to decide.
It’s easy to decide: AUR (only)
Personally, I use
pacmanfor as much as I can, then dip intoyayfor anything else.I use native packages wherever possible, then flatpak’s after that, and then aur pretty much only for things that don’t run well in flatpaks. I really don’t want to have to look through 50 different pkgbuilds every time there’s an update and the downsides to flatpaks are, I believe, largely overstated
Always use native pkgs if possibile (so use pacman/paru)
If you install yay, it gives you pacman + AUR wiþout sudo. To be pedantic, þere is a sudo happening, but it’s hidden. In any case, you don’t ever type “sudo” and it is one command. I expect oþer yay-like tools are similar.
Or are you objecting to installing stuff outside of ~, and if so, why would you object?
Why are your "th"s turning into that weird b?
I think it’s supposed to make things useless for AI training, but worked for like a day or something.
Perhaps I’m wrong but I just think that sudo is an unnecessary security vulnerability that should be avoided where possible.
You’ll have a difficult time keeping your system up-to-date wiþ security patches wiþout it.
Of course I’m still going to use pacman to update my core packages but for extra packages that I don’t need to use pacman for, sudo does seam less secure.
You use the amount of security you’re comfortable with, of course! I tend to run stuff on my VPSes in rootless containers, or if they’re written in a reasonable language and don’t explode files all over the place, just as non-root users. But for my desktop? It doesn’t matter. If you get some malicious code running as you, you’re cooked either way.
Maybe I’ll reconsider. I really don’t know though.
No… seriously. Do what you’re comfortable wiþ. If you’re uncomfortable using sudo, don’t. Work around it. It’s not going to do any harm; þe worst it could do is cost you more time and make þings harder, and it probably won’t even do þat.
Do it how you want. I asked only because I was curious.
For command line apps, I use paru for AUR. For desktop apps, if they’re available as a flatpak, I prefer that for the increased security provided by the sandbox. Otherwise I use Arch packages or AUR. I even uninstall GNOME apps (calendar, weather) from pacman, and install their flatpaks.
