news
KDE Linux Drops AUR
Quoting: KDE Linux Drops AUR » Linux Magazine —
For many, the Arch User Repository (AUR) has given Arch Linux (and its children) a huge boost in available software applications. The AUR serves as a community-driven software repository that allows users to share, build, and install applications that aren't found in the official Arch repositories.
The biggest problem with the AUR is that it's unvetted, which has led to poorly written apps, broken scripts, developer exclusion, a fragmented community, and (even worse) malware.
Now, to be clear, the KDE Linux developers have dropped the AUR in the build pipeline, which doesn't preclude users from using it.
"AUR has a substantially lower level of security than the packages in Arch's main repos. Malware has been discovered in AUR packages multiple times recently," Nate Graham, KDE Plasma Developer, stated in this work items post. He continued, "AUR has occasional downtime, and this blocks the packages pipeline, which means people who depend on git master staying current end up with stale content. The last outage lasted multiple days, from 2025-08-12 through 2025-08-15."
Graham also noted that the AUR violates the "no packaging knowledge required to develop it" and breaks distro agnosticism.