Hacker News Reader

Comment by mrln | Hacker News Reader

Yeah, yay works until it doesn't anymore, because the pacman library dependency it uses was updated but yay was not... and then you need to recompile yay manually. I mean, I'll still use it (or rather paru, which works basically the same way), but it's very annoying, when it happens every few months.

View on HN

You can download a precompiled yay/paru from their Github pages btw.

I don't understand, yay updates itself. I've never once had this problem.

That's assuming you do system upgrades through paru/yay. However, you may not want to upgrade the packages you've obtained from the AUR and so you upgrade using pacman. That may cause the updated libalpm to become incompatible with the installed yay/paru.

yay used to be in the official Arch Linux repository for some time, wonder why it was removed.

Iirc it was to force the extra step necessary for the user to acknowledge that the AUR can bootstrap malware if used blindly.

This seems to be a relatively consistent discussion surrounding AUR helper development; for example, adding UX to incentivise users to read PKGBUILDs, lest the AUR becomes an attractive vector for skids.

No one wants the AUR to become NPM, and the thing that will incentivise that is uneducated users. Having the small barrier of not having helpers in the main repos is an effective way of accomplishing that.

https://wiki.archlinux.org/title/AUR_helpers

AUR helpers like yay are not supported officially. The other commenter sheds some light as to why.

Assume they mean having to recompile the AUR package they were trying to install using yay.

If users mental model is mostly "yay is like pacman but can also install packages from AUR the same way" wihout thinking deeper about the difference then I think it using it is very risky and that you should just stick to pacman + git/makepkg. Only consider helpers once that's become second nature and routine. Telling people to "just yay install" is doing them a disservice. An upgrade breaking the system isn't even that bad compared to getting infected with malware due to an old package you were using being orphaned and hijacked to spread malware or getting a bad copycat version due to a typo.

I think EndeavourOS is doing users a disservice if they provide sth like yay preinstalled and ready to use out of the box. It isn't installing packages from a shared repo: It's downloading code from arbitrary locations and running it on your machine in order to produce a package. Being able to read and understand shell script (PKGBUILD) is kind of a prerequisite to using it safely.

Reply on news.ycombinator.com