[landdate]

> It was bad enough when finding out more than 400 AUR packages for Arch Linux users had been infected with malware but now that number has risen to around 900 a few hours ago and now in the end at more than 1,500 user-contributed packages.been infected with malware

I never had a need for the AUR.

If I want a package not in the official repository I build it myself or if it has a binary release I will download it. this way i don't have to use root when building and can have program installed locally just for a single user which is how it should be anyway for most desktop use cases.

At least in this way there is one less level of possible malicious code insertion in developer -> user, vs develeper -> maintainer -> user.

[NekkoDroid]

> this way i don't have to use root when building

`makepkg` will actively refuse to run if you are invoking it as root (unless you specifically invoke it with something like `env EUID=123 makepkg ...`).

> and can have program installed locally just for a single user which is how it should be anyway for most desktop use cases.

I do wish pacman would support a user level installations. It will refuse to install packages as non-root (which you can go around by using user namespaces and mapping yourself to root).

[landdate]

Maybe I used imprecise wording. Not root, but must be part of sudoers. Or am I misunderstanding how the process works? Don'tWhenever I have installed a package from aur with yay it requires user being part of sudoers.

[NekkoDroid]

Yea, but that is to install the package after it was built (or installing dependencies). The build itself is done unprivileged.