I only use the AUR for a few apps. I think in the aftermath of the security incidents, lots of packages are being identified as being orphaned.
What should I do in this instance? I don’t recall installing any of these, and maybe they were installed as dependencies, I’m just confused by the output of yay --aur
→ Packages not in AUR: python-backports-zstd python-pkg_resources → Orphan (unmaintained) AUR Packages: lib32-aalib lib32-audit lib32-duktape lib32-gettext lib32-giflib
lib32-glib-networking lib32-gpm lib32-imlib2 lib32-libavc1394 lib32-libcaca lib32-libcap lib32-libdv
lib32-libiec61883 lib32-libnl lib32-libnsl lib32-libpcap lib32-libproxy lib32-libraw1394 lib32-libshout
lib32-libsoup3 lib32-libtirpc lib32-libvpx lib32-mpg123 lib32-popt lib32-speex lib32-taglib lib32-tw
olame lib32-v4l-utils lib32-wavpack → Flagged Out Of Date AUR Packages: xwaylandvideobridge
pacman can tell you why something is installed with pacman -Qi
read the output of the command there is a line for Reason installed an there is a line to show if its a dependency.
To learn more of what pacman can do please man pacman
If you have a Google account, there’s a useful tool called Google NotebookLM. You can feed it a package list and have it analyze the list. You can also ask it whether orphaned packages can safely be removed.
Create a list of your installed packages with:
bash
pacman -Qi > /tmp/packlist.txt
Then go to https://notebook.google.com, create a new notebook, and upload the packlist.txt file you just created. It will immediately start analyzing it. You can then ask it, for example, about orphaned packages.
The analysis may take some time, depending on the number of packages. Please be patient.
But be careful: it’s AI, so it may also produce nonsense.
So that tells you it was installed as a dependency of another package.
What does the Required By field tell you? Is it still required by another package or is it required by none?
If it’s still required by a package, you need it if you want to continue to use that package.
If it’s not required by anything, that means the package that originally required it either no longer exists (you uninstalled it), or no longer requires it. You can remove it.
BTW - There continues to be confusion about orphaned AUR packages and packages that are orphans on your system. These are not the same thing. Orphan does not equal orphaned. Orphaned does not equal orphan.
pacman -Qdtq (search for orphans): “here is a list of packages that are orphans” = these packages were installed as dependencies, but they are no longer needed as dependencies.
yay (when updating AUR packages): “this AUR package is orphaned” = this package no longer has a maintainer; maybe someone will adopt it. It might still work fine, and maybe someone will update the PKGBUILD but not officially adopt the package, but be aware that as of right now, there’s no dedicated maintainer. It does not in any way mean that this package is no longer required on your system.
An orphaned AUR package simply doesn’t have a maintainer at this time; it may or may not be an orphan package on your system.
What ever you do don’t do what this @amarkuni said. I would never upload and application list to GOOGLE. Last thing I need is for them to steal more of my data that they don’t PAY ME for.
I switched from AUR to flatpaks for now. Comes with its own downsides, but seems the less messy option for the moment. Dependencies are trickier, of course.
.