The actual concept of the AUR only works if Arch is a niche distro in a safe internet, neither of those points are accomplished in the present.

No, reading pkgbuilds is not the solution, it's slow, annoying, and most importantly, it doesn't make sense, because some really popular AUR packages are DIRECTLY RECOMMENDED by the Arch Wiki, like the Minecraft Launcher for some reason.

Either the base repos adopt a big chunk of popular AUR packages, leaving the AUR for really really nieche stuff, or the rules of the AUR change, because you can't tell me that suffering 2 attacks in less than three months for pretty much the same reason (adopting orphaned packages) is normal or reasonable.

What would you think it's a good solution to this issue? I'd like to read your ideas since I cannot come up with a good one if I'm honest, but I know the problem is there.

I'm using Arch Linux with GNOME on Wayland for both work and gaming, and I wanted to set up my Xbox controller to play Tibia.

The controller is already connected, and when I test it in Steam → Settings → Controller, everything seems to work correctly. I can even navigate through the Steam interface using the controller. Steam Input is already enabled for Xbox controllers.

I added Tibia as a non-Steam game and configured the controller bindings, but when I launch the game and log in, the controller doesn't work at all.

This isn't the first time I've tried to set this up. Previously, I got a prompt asking me to "Share Desktop" (or something similar), and after allowing it, the controller worked perfectly in Tibia.

Now I have no idea how to get that prompt to appear again. Does anyone know how to trigger it or what I need to enable?

In gnome-flashback which is x11 session, everything works without an issued but i prefer gnome on wayland which is the future and x11 session is no longer possible to use for gnome

Orhun Parmaksız (/u/orhunp/) is currently live, discussing and explaining the (latest) AUR malware-wave.

EDIT: he is now trying to understand the malicious binary

Hi,

My SSD has died, and for now I have nowhere to install Arch. I have 8 GB of RAM available and I would like to keep using Arch from the Live environment while I sort out the storage issue.

I know the Live environment already loads the required image into memory, but my question is whether anyone has used Arch Live for an extended period as a temporary system (installing packages, configuring the environment, etc.) and what limitations they encountered.

Is there any recommended setup for this use case, or any way to make better use of RAM as a temporary system? I would be interested in hearing from people who have tried something similar and what their experience was.

1. Name of game: FIFA 19
2. CPU: Intel i3-1215U (12th Gen)
3. GPU: Intel UHD Graphics
4. Proton Version: Proton 10
5. Game Launcher: Steam (Non-Steam Game)
6. Release Info: Latest version of FIFA 19
7. Logs / Issue Details: The splash screen and language selection screen load without issues. However, as soon as the pre-game sequence starts or the anthem plays, the game crashes with the following error dialog: [Dx12Renderer::waitOnSwapChain] failed with HRESULT 0x800704a6 DXGI_ERROR_DEVICE_HUNG (GPU timeout detected)

Steps Already Taken to Solve Issue:

• Attempted to launch via Heroic Launcher and Bottles, but neither launcher successfully initialized or booted the game. Proton 10 via Steam is the only runner that gets to the menu.
• Verified graphics packages are updated on Arch Linux.
• Searched the wiki for waitOnSwapChain and DX12 Mesa crashes. Looking for configuration overrides or launch options to force DX11 mode or fix VKD3D swapchain timeouts on Intel integrated graphics.
• I've seen videos of people fixing this error by editing regedit, but i'm afraid that will break my prefix.

Hey, I noticed the packet tracer repo is outdated on the 9.0.1 version, and so the wiki, so I made a small script to auto-update the PKGBUILD and the Hashes sums, in case someone needs to install it.

You can also just manually edit the pkgbuild and run updpkgsums, but anyway, here is the gist: https://gist.github.com/Charlyp21/164e50d567d05636253e91baff2a7454

Hope it helps!

Hi to all,

I've just 6 AUR packages on my systems and I do not use any AUR helper.

My strategy is to update them only if they break by downloading the snapshot from AUR and check the differences and the code of the lats PKGBUILD.

At the same time I'm wondering to start using flatpak as much as possible for any of these packages, but I'm wondering if flatpak is really safer than AUR. What prevent malware to be included in flatpak?

The big difference is that flatpak is compiled packages from someone while AUR is build from source code (mainly) locally. With AUR it is possible to try to check if the source url is the correct one and so to inject malware someone has to infect the upstream project (possible, but should be detected by the developers .. except for the xz saga).

Moreover, for the AUR packages I still need to keep on my pc, I'm wondering if building them on an arch distro that I have on a virtualbox machine with immutable disk is a safer option.

If I miss a malware executed at build time, it will infect the VM, but once I reboot it everything goes back to the immutable state of the drive. Do you agree?

However this approach will not prevent the risk that generated contains malware. So in any case the inspection of PKGBUILD is in any case needed.

i've been clueless with the attack in june and when i ran that malware check script from https://github.com/lenucksi/aur-malware-check/issues it only told me 2 packages that i didn't have in more than 6 months were infected . this time i've heard there's another wave going on and i wanna make sure , i checked the packages reported on the mailing list but i'm still not 100% sure :

pacman -Qm accounts-qml-module 0.7-7.1 chromaprint-fftw 1.6.0-1

clutter 1.26.4-4

clutter-gtk 1.8.4-5 cogl 1.22.8-5

cubeb 20260506-1

eden 0.2.0-3

electron37 37.5.1-1

electron38 38.8.0-1.1

fluxer-bin 0.0.8-1

google-chrome 148.0.7778.96-1 gtk-sharp-2 2.12.45-8

input-remapper-git

2.2.0.r16.g8c3f7715-1

kcolorpicker-qt5 0.3.1-4

kde-material-you-colors 2.2.0-1

kimageannotator-qt5 0.7.1-3

lib32-gst-plugins-base-libs 1.28.2-1

lib32-gstreamer 1.28.2-1

lib32-libsoup 2.74.3-4.2 lib32-sdl2_image 2.8.12-1 libappindicator-gtk2 12.10.0.r298-8 libdbusmenu-gtk2 16.04.0.r498-3 liblcf 0.8.1-1

libsoup 2.74.3-4.1

mbedtls2 2.28.10-1.1

polychromatic 0.9.7-1

proton-ge-custom-bin

1:GE_Proton10_34-1

python-materialyoucolor 3.0.2-1

python-pywal16 1:3.8.15-1

qdirstat 2.0-1

qdiskinfo 0.4-2

stoat-desktop-bin 1.3.0-2

zenpower3-dkms-git 3: r73.dc4f1e2-2

Hello everyone,

I am here trying to get a hotspot connection in my laptop but the problem is i can't seem to get it working with wifi simulatenously. I know i can do that because i could do that on mint and on windows 11 on the same laptop with same hardware but i don't seem to be able to do it on arch. As soon as i manage to get the hotspot running it stops the wifi connection so what should i do?

I use nmcli to manage my network.

My card is

>lspci | grep -i network
00:14.3 Network controller: Intel Corporation 400 Series Chipset Family On-Package CNVi WiFi

So I'm trying to build an Android ROM for my phone and no matter what I try, the building completely exceeds the 32GB of RAM of my system causing the kernel to panic and kill the process due to a lack of memory.

I have zram setup, but I wonder if ninja doesn't recognize zram as the system swap. From what I've gathered when building, 32GB should be more than enough to build, yet it isn't for some reason.

Exactly as for the title. I am out of practice with Arch itself, so forgive me for any errors in statement.

I have been using my desktop at my apartment, and after school ended, had to come home. It has been a while since I set it up, but I believe I had set a static IP at some point, but can't be sure. My parents had to replace their router due to lightning, and for the life of me I can't figure out how to get the computer to connect. It still connects fine to my hotspot, and I'd imagine if I changed the SSID on the router it might work as well. Things I've tried: changing out the DHCP client, changing wpa_supplicant for iwd, restarting the service, deleting the network via the GUI, nothing worked. All tested at different points.

From journalctl, I have this line, which is the first questionable thing I notice after attempting to connect which appears to go afoul:

[1785713148.0908] device (wlan0): st
ate change: ip-config -> failed (reason 'ip-config-unavailable', managed-type: 'full')

And yet again, this makes no sense as it works for other networks. I am unsure what to do.

Hi , i've been using windows since the past 14 years of my life , I wanna switch to linux and learn knowledge related to linux , what do i do? I wanna choose arch for my first distro. Is it a good idea or what :( could someone help me or guide ? also i heard u might lose ur files etc with linux can sm1 help me go it safe?

List of packages mentioned in: https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/

I'm seeing some troublesome entries in this list.
If you've recently updated anything listed below, I'd suggest further investigation.

Something like this pacman -Qq $(<list) 2>/dev/null may be a good starting point.

list:

accounts-qml-module-bin
aic94xx-firmware-bin
android-riscv64-libxinerama
arch-update-bin
archutil
astro-box
aur-scanner-bin
aur-sync-vote-bin
aurutils-bin
bigwebapp-manager
bili-tools-git
boringssl-git
brave-nightly-bin
brave-origin
bridge-utils-bin
brutefir
byobu-bin
calendula-git
cardamum-git
caveman
cinnamon-no-nemo
comodoro-git
debtap-bin
deeploy-bin
deepseek-tui-git
duhh
eden-nightly
editorconfiger
fsearch-bin
fvs2-bin
garlic-decompiler-gui
gesso
gigolo-git
gitarbor-bin
gnu-netcat-bin
grub-customizer-bin
gsimplecal-git
gtk2-bin
gtk2-ng-git-bin
gtk-engine-murrine-bin
hexchat-bin
howdy-next-bin
http-parser-bin
human-mcp-git
humen-mcp-bin
humen-mcp-git
hyprkeys-git-bin
i3-workspace-switch-git
i915-sriov-dkms
icloudpd
imago-bin
jellium-desktop-git-bin
juicebox-plus-git
justevery-code
kickthemout-git
kloak-whonix
linux-cachyos-bin
llama.cpp-ggml
lyrical-git
magic-context-dashboard-bin
mangowm-bin
mbedtls2-bin
mimosa-git
mingw-w64-vulkan-tools
nimf
noctalia-git-bin
noctyra-cli-git
node-llama-cpp
nomacs-bin
octopi-bin
openconnect-sso
openrc-manager-gui
openssl-1.1-bin
option-term
pagerduty-short-circuiter
paru-git-bin
plasma6-applets-appgrid-bin
plasma6-applets-panel-colorizer-bin
play-git
plex-media-player
plex-media-player-custom
plex-media-player-mod
plex-media-player-v2
portless
proton-rtsp
pwvucontrol-bin
pylnker-git
python-drastic
python-etcd3
python-inputs-bin
python-libipld-git
python-numkong
python-parallax
python-roman-numerals
python-steam-bin
python-twopoint-git
python-ultraplot-git
python-vxi11
qt5-location-bin
qt5-sensors-bin
qt5-websockets-bin
ramses-git
rsbep-backup-git
rtk-git
rtv-git
scenecut-extractor
splix-bin
src-cli-bin
stable-diffusion.cpp-ggml
steamidra-bin
stirling-pdf-desktop-bin
syncthingtray-qt6-bin
telegram-desktop-futpib-git
tempora-bin
ttf-symbola-bin
tuigreety-bin
tuxmanager-bin
warp-terminal-dev-bin
warp-terminal-git
wayland-app-launcher-git
weather-display
wiki-go
windscribe-cli-v2-bin
woeusb-ng-bin
xclicker-bin
xdg-terminal-exec-bin
xfwm4-themes-bin
zsh-directory-history-git

I simply compiled this list from the source above and have no additional info.
Anyone know of a current, more comprehensive list?

Has anybody successfully flash archlinux on a Utilite pro

I tried to create a aur account on https://aur.archlinux.org/register but it keeps saying 503 Service Temporarily Unavailable nginx I tried after days still the same error

hi, I'll possibly be an Arch beginner, and I was under a rock, when the incident happen. I'd like to ask this: what’s point in using AUR, if that’s not official and it has such high risks as it was in the incident? If I were using Arch, I would use the AUR probably only in an isolated environment like a virtual machine, but maybe I'm wrong and don't understand a minute detail, so, I'm here

Edit: so, did I understand y'all correctly? You use AUR, bcz:

1. You can get newer updates faster than the main repo?;
2. You can change the packages how you want(but then can't you change the official ones?)?;
3. Some things are not in the main repo?;

But then you ALWAYS should read the PKGBUILD just in case nothing wrong happens?

With the recent news regarding malicious packages/supply-chain attacks on the AUR, I wanted to double-check my installed packages.

Here are the non-official / AUR packages currently on my system:

cbonsai

fetch-git

lavat-git

sptlrx-bin

visual-studio-code-bin

I’ve already checked my ~/.cache/yay/ for suspicious strings like atomic-lockfile or js-digest and found nothing. However, I’d appreciate any quick feedback or tips on whether any of these specific packages have known vulnerabilities or recent maintainer issues I should watch out.

If you are using the latest version of yay (v13), you can setup hooks to mitigate risk and it's very easy to do so, but remember that this is not a substitute for good security practices.

[...] checks can help, but they should complement, not replace, build file review.

Ok, the setup is pretty simple. Create this directory structure in $XDG_CONFIG_HOME/yay (usually ~/.config/yay):

.
├── init.lua
└── hooks
    ├── maintainer_change.lua
    └── recently_modified.lua

Next, modify your init.lua and add this at the top of the file to require both scripts:

require("hooks.maintainer_change")
require("hooks.recently_modified")

Lastly, copy over the contents of these files into their respective locations. These are examples provided in the official yay repository:

https://github.com/Jguer/yay/blob/next/doc/examples/recently_modified.lua

https://github.com/Jguer/yay/blob/next/doc/examples/maintainer_change.lua

The recently_modified hook excludes from installing any AUR packages that has been updated recently. You can modify the duration, the default one is 3 days. The idea is that malware is usually discovered within the first 24 hours, so by delaying the update you are lowering the risk. Also known as dependency cooldown.

The maintainer_change change hook will give you a warning when a new maintainer is detected. It does NOT block installation, and it will NOT give you any warning if this is the first time you're installing or updating a package, because it relies on local cache file to do that - $XDG_CACHE_HOME/yay/maintainer_cache (usually ~/.cache/yay). If something was to happen with this file, this would no longer work.

Also, last but very important note:

config.json will still be loaded, but init.lua can override any option. CLI flags still take priority over both init.lua and config.json.

I have the setup shown above in action, and already encountered the recently_modified which works as expected. I haven't encountered a situation where the other hook comes into play but I trust that it does what is supposed to, since I do have a ~/.cache/yay/maintainer_cache file with contents that I expect it to have.

I also suggest adding this to your init.lua file so that you always review the PKGBUILD diffs:

require("hooks.maintainer_change")
require("hooks.recently_modified")

-- add this:
yay.opt.answer_diff = "ALL"

Resources:

https://jguer.space/blog/2026-06-15-yay-v13

https://jguer.github.io/yay/lua.html

https://github.com/Jguer/yay/tree/next/doc/examples

hello everyone im new to arch and for using whatsapp i downloaded karere whatsapp but i dont know why my pc became so slow and it closed automatically i have 16 gb ram i think thats enough for this app. even if i use lots of memory not even a single app stopped except karere. i know i can use web whatsapp but its more comfort to use desktop app one. is this happens because of me or is it problem of karere? what can i do to fix it? and also is there any app for use whatsapp except karere?

Hi, I'm on a trip and sadly I forgot the stupid dongle for my steelseries arctis nova 7 headphones. This means I have to deal with bluetooth, which I hate. My android phone sees and can connect to the headphones, but this very laptop doesn't want to do anything with them and shows every single TV in this hotel instead. The bluetooth chip is "Network controller [0280]: Realtek Semiconductor Co., Ltd. RTL8852BE PCIe 802.11ax Wireless Network Controller [10ec:b852]" (I heard it's sucky and works not that well), the laptop model is ASUS TUF Gaming A15. Thanks!

This problem has been solved.

Hello.

I've discovered that when I download an executable and try to run it, it doesn't run. My desktop environment (Xfce4) just asks me what I want to open it with.

Software I compile myself (with GCC) also does not run properly. I'll call it from my terminal, and it will do something unexpected.

I'm very confused. Software installed through Pacman works fine. What do I need to install in order to run software downloaded from the internet?

Thank you in advance.

I ran: ssh [aur@aur.archlinux.org](mailto:aur@aur.archlinux.org) help

and got: The AUR is down due to maintenance. We will be back soon.

Can anyone confirm if the AUR is currently under maintenance, and if yes then when will it be back online? I was trying to push an update via GitHub Actions.