Flatpak vs AUR?

[Kundalini]

I see conflicting info and opinions on this everywhere I’ve searched and since I have a fresh new install, I’d like to educate myself before installing the apps I need.

When should I choose an AUR version of an application, and when should I choose the Flatpak? For example, steam and discord. Are these better to install via the ‘pacman -S’ command or using the Flatpak? And why?

[Kresimir]

I look for software in this order:

1. official Arch Linux software repositories
2. the AUR
3. building it myself from source code (either making a PKGBUILD for it or keeping it in the home directory)
4. Appimage from a trustworthy source
5. Flatpak from a trustworthy source

Snaps never.

This may or may not be good for you, but it works for me, and this is what I recommend.

[Kundalini]

What’s the difference between #1 and #2 ? I thought they were the same?

[Kresimir]

They are not the same. Official repositories contain software built and packaged by Arch Linux Trusted Users. The AUR contains PKGBUILDs (which are recipes for how to package something into a package for Arch Linux). You use these PKGBUILDs to package software yourself locally – you are the TU. When you install these, they are marked as foreign packages, not as repo packages. Anyone can submit PKGBUILDs to the AUR, it’s a community driven project.

[Kundalini]

So when I install steam with command “sudo pacman -S steam”. Is this the official Arch repository?

I’m a little new to EOS, so I am trying to understand how I can spot the difference between official and unofficial Arch repository apps.

[Kresimir]

Typically yes. Unless you’ve manually added third party repositories to your pacman.conf, pacman with the -S option can only access packages in the official repositories.

[Kundalini]

Okay that makes sense. So the AUR pkgbuilds are ‘yay’ command installations?

[Kresimir]

No. All packages on Arch Linux are build using the makepkg utility, from a PKGBUILD file. For the packages in the repositories, someone else already did that.

For the packages in the AUR you do it yourself. They are actually not real packages, only recipes how to package stuff yourself. yay is just a tool that automates the process of building and installing a package from the AUR.

[Kundalini]

Can you share why you choose AUR over flatpaks? I see some people state the security advantage of Flatpak over AUR. So I wonder your opinion and reasoning for your priority choice?

[Kresimir]

There is no security advantage of Flatpaks over the AUR.

In fact, if you understand the process of packaging packages for Arch, and are careful and you inspect the PKGBUILD and all the accompanying files, you know exactly what goes on into a package you’ve packaged from the AUR. You know where the software is downloaded from, you know how it is installed, what the package contains, everything… It’s a fully transparent system. It does require you to understand what you’re doing, of course.

With Flatpaks, you have no idea what is inside them, because you didn’t package them yourself.

[Kundalini]

This makes sense. I need to learn how to do exactly what you just stated when installing an AUR. I’ve never used the AUR repository, and I should. Do you have any links where I can learn it?

Also, how do I know if an official arch application exists? Is there a list somewhere I can check? I know steam exists, but I am not sure if discord does.

[Kresimir]

I wrote a bunch of posts about that, let me find them.

How to Install Apps from AUR

makepkg is a script that creates a foreign (i.e. non-repo) package, which can be installed using pacman -U. Before we can make a package, we need to have both base-devel and git packages installed: sudo pacman -S base-devel git --needed On EndeavourOS, these should already be preinstalled. Depending on the specific package, we may also need other programs, like compilers and build systems. These are called “make dependencies”. Typically, making a package from the AUR involves the following …

AUR PKGBUILDs

The AUR is one of the safest ways to install software, just because it is so transparent. But it does not tolerate just looking up the package in Pamac and clicking on the Build button, or doing yay package_name blindly. It requires that the user knows what’s going on. That’s why I recommend trying to build at least one package manually, to understand what’s going on, before using an AUR helper like pamac or yay. yay has a nice feature that allows you to inspect a PKGBUILD file before installin…

Current Best Practice Flatpack or Aur?

It does not, if the packager is either malicious or incompetent (the two main concerns when it comes to installing software). It merely gives the user false sense of security. The biggest advantage of the AUR is that you build the packages yourself (according to a recipe posted by someone online), so you can know exactly what goes in the package, assuming you care to know. If you don’t care to know, then this advantage of the AUR is completely lost to you. With Flatpaks and AppImages, you hav…

KDE's August 2020 Apps Update

Oh boy, where to even start? Well, with Flatpak, because it’s a much lesser evil of the two. In fact, it’s not really that bad. The only issue I have with the concept of flatpaks is that they statically link all or most of their dependencies and do not integrate well with the system. The obvious downside of statically linking dependencies is that flatpaks use a lot of disk space. A less obvious, but perhaps more serious disadvantage is that older versions of dependencies may lack securit…

[pycrk]

if you search eg with yay for aur packages

yay steam

you can recognize the aur packages in the output by the fact that the name(aur) of the repo is at the beginning.

core, extra and the multilib repos are official.

[Kundalini]

I’ll read this over. Thanks for sharing!

[Kundalini]

This was helpful. I checked and discord exists under ‘extra’… proceeding to install. Thanks!!

[Kresimir]

These are all of the official repositories:

https://wiki.archlinux.org/title/Official_repositories

You can search them with this page:

https://archlinux.org/packages/

Or with pacman -Ss.

[chromian]

Flatkpaks are not for a distro like Arch Linux or it’s derivatives.

Everything under the sun is either available in either the official repos or AUR; that too latest versions. And moreover they are packaged especially for the distro compared to a more general approach of flatpaks.

Flatpaks are more geared towards distros like Ubuntu that have a limited or outdated software repos.

[Kundalini]

That makes sense. I have flatpak enabled just in case I cannot find a specific app.

[chromian]

That’s good approach.

[mbod]

@Kundalini

When should I choose an AUR version of an application, and when should I choose the Flatpak?

If the software is in the AUR then use the AUR.
If not, then use flatpak.

This is my theory. But I deviate from it occasionally. Example: Steam. I had stability issues in the past with steam. Some updates in arch broke my steam installation. Now I am using flatpak steam and everything is ok.