Hacker News Reader

Comment by dandersch | Hacker News Reader

I think Arch has to rethink what the AUR really is for in the age of AI.

If users aren't supposed to trust anything from the AUR, then they will start to use LLMs to scan PKGBUILDs for them. But at that point, why not let the LLM loose directly on the upstream repo and build+install the package from source?

View on HN

You really don't see the difference between a deterministic script installing a tarball pinned by its hash, and "sudo chatgpt install master branch of this repo"?

Yes, the second option gives me an easily inspectable list of results (as I can see all the tool calls the model made). The deterministic script is probably overly complex and hard to read, maybe supports ten billion platform combinations.

Arch is famously x64 only?

I run it on my milk-v duo s risk sbc. The risk-v version is maintained by a few dedicated people, and the milk-v specifics I had to fix myself. But it works :)

I knew there's an unofficial version for ARM. I meant more that the vast majority of AUR packages target x64 only because that's what 'official' Arch supports.

That being said, didn't know there's a RISC V effort as well now, so TIL.

Most PKGBUILDS are stupidly simple, they're probably easier to read than a set of tool calls. See this for a randomly picked recently updated example:

https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=batte...

(honestly I think the way that arch packages work is really nice compared to most other distros: you can almost copy and paste the README of a project into one and have a package)

Here's the most complicated one I found, building a browser:

https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=flowf...

The main risk, if you're reading them, is typosquatting and hiding the malicious code in what the project downloads.

> The deterministic script is probably overly complex and hard to read, maybe supports ten billion platform combinations.

Uh sorry what? Can you point to a PKGBUILD that is indeed this complex?

The AUR is still a better option than using curl to freebase shell scripts straight from github, which is pretty much the go-to route for any LLM-generated guides.

See also, the -o- emoticon: https://youtu.be/M1si1y5lvkk&t=1902s

Or you could use Nix as a package manager on practically any distro or OS of your choice. Arch, Debian, Windows, macOS - it doesn't matter. Most users should never ever need to bother with AUR again with this approach.

https://repology.org/repositories/graphs

Nobody needs to rethink anything in "the age of AI". Stop trying to make everything about your favorite topic. If the tool can provide value then they'll use it, if not they won't.

Reply on news.ycombinator.com