Why would someone "Frankenstein" EOS with other distro's repos?

[UncleSpellbinder]

@limotux

Isn’t there any repo has it compiled already?

Yes… as has already been stated, the Chaotic AUR. The kernels in the Chaotic AUR are ready to install, compiled, and they install quickly.

If you want to enable the Chaotic AUR, follow the instructions here:

Chaotic-AUR - automated binary repo 👨🏻‍💻

[cactux]

@limotux

AUR (the default that comes with EndeavourOS)

AUR is not a default for EOS. It is an unofficial repository: Archlinux User Repository. It’s a place for users like you and me to submit PKGBUILDs or pre-compiled binaries to be used by other users.

[MyNameIsRichard]

But it’s enabled by default, or at least I don’t remember enabling it.

[cactux]

It is not enabled.

You get an AUR helper, yay and other scripts specific to EOS which can manage building and installing packages from AUR.

It is not a repository that you can enable, in the same sense that you can enable a repository in your pacman.conf.

You could say that EOS enables the users to build packages from AUR and install them.

[limotux]

@UncleSpellbinder

enable the Chaotic AUR

@UncleSpellbinder
Sorry if I am asking “stupid” or silly questions. I am just worried enabling a “foreign” repo might affect the stability of my installation or cause any conflicts. You know the title of this thread and perhaps many other thread saying it is dangerous to mix repos of different distros!
By the way, I am a bit worried of name “Cahotic”, is it reall so?

[MyNameIsRichard]

I perhaps chose my words unwisely. I should’ve said something like, you don’t have to install anything to use the AUR.

[cactux]

Yes. You don’t have to install yay. I think it is part of EOS standard package list.

I think paru is also available in EOS repo.

On a vanilla Arch, you would need to build “manually” yourself an AUR helper, like yay, from AUR.

[Cphusion]

Does anyone know how they determine which PKGBUILDS are built for the Chaotic AUR, I was just looking but it seems several PKGBUILDS I use from the AUR aren’t in the Chaotic AUR and I can’t find any information about it as in on what basis they decide which PKGBUILDS they build for the Chaotic AUR?

[UncleSpellbinder]

@limotux

…many other thread saying it is dangerous to mix repos of different distros!

Chaotic AUR is not a “repo from another distro.” Though the lead maintainer of the Chaotic AUR is Nico Jensch, who is also part of the Garuda team. Chaotic-AUR is an unofficial, automated building service for the Arch User Repository (AUR). It pre-builds packages from the AUR, making it easier for users to install software without having to manually compile it themselves. Essentially, it’s a repository of pre-built binaries derived from the AUR.

@limotux

By the way, I am a bit worried of name “Cahotic”, is it reall so?

That’s just the name they gave it. Nothing more.

[UncleSpellbinder]

@Cphusion, there may be info in the About Us section of the Chaotic AUR website.

[limotux]

@UncleSpellbinder

Chaotic-AUR is an unofficial, automated building service for the Arch User Repository (AUR). It pre-builds packages from the AUR, making it easier for users to install software without having to manually compile it themselves. Essentially, it’s a repository of pre-built binaries derived from the AUR.

Oh, thanks a lot @UncleSpellbinder
To be honest, first time for me to hear about this “Chaotic” AUR, and glad that it is just a name.

[cactux]

@limotux

first time for me to hear about this “Chaotic” AUR

There is a post from @BluishHumility here about chaotic-aur:

Pamac/Octopi/Pacseek Alternatives- To AUR or Not to AUR?

I feel compelled to defend the Chaotic-AUR team because I know those guys break their backs to keep that repo in good shape. It is driven by automation as you say, but there is quite a bit of time and manual effort that goes into maintaining it as well. Users can request packages be added to the repo on the GitHub issue page (https://github.com/chaotic-aur/packages/issues), but they are not just blindly added. One of the team members looks over the PKGBUILD and determines if the package should…

TL;DR

@BluishHumility

At the end of the day, as with the regular AUR, it is ultimately up to the user to review the package and inspect the PKGBUILD to decide if they would like to install a package or not.

---

So, the conclusion seems to be that, even if you can add chaotic-aur to your pacman.conf, add their key to your pacman keys, add their mirrorlist toy your pacman mirrorlist and install with sudo pacman -S whatever you need to exercise the same caution reviewing the PKGBUILDs as when you use a PKGBUILD from AUR to build and install a package.

[Cphusion]

I may have overlooked the name of the package. But I did find some useful information, which I overlooked last time looking there. Thanks!

One thing I do find odd is with https://aur.archlinux.org/packages/jellyfin-media-player
It was last updated today “2025-04-13” and has version 1.12.0-3.

When you check the it in the Chaotic AUR it was last updated “30/03/2025” and also has version “1.12.0-3”. I would have expected the Chaotic AUR version to be a lower version since it hasn’t been recently updated? Anyone know how that is?

[limotux]

@cactux

There is a post from @BluishHumility here about chaotic-aur:

@cactux I never meant anything bad about the repo or the guys. I just was worried of the name.
They are doing a great job I see, to have the apps pre-compiled is something great, it will save us all a lot of time. You see what I said that I tried and it took ages.

@cactux

even if you can add chaotic-aur to your pacman.conf, add their key to your pacman keys, add their mirrorlist toy your pacman mirrorlist and install with

I will see what I can doo about it in a while.
Thank you very much

[Cphusion]

@Cphusion

When you check the it in the Chaotic AUR it was last updated “30/03/2025” and also has version “1.12.0-3”. I would have expected the Chaotic AUR version to be a lower version since it hasn’t been recently updated? Anyone know how that is?

I think I may have found an answer, seems like it may have to do with how the Chaotic AUR pipelines work.

• The CI’s behavior concerning each package can be configured via a config file in the .CI folder: this file stores information like PKGBUILD source (it can be AUR or something different), PKGBUILD timestamp on AUR, most recent Git commit as well as settings like whether to push a PKGBUILD change back to AUR.
• PKGBUILD changes can now be reviewed in case of major (all changes other than pkgver, hashes, pkgrel) updates - CI automatically creates a PR containing the changes for human review.
• Adding and removing packages is entirely controlled via Git - after adding a new PKGBUILD folder via commit, the corresponding package will automatically be deployed. Removing it has the opposite effect.

I’ll give the Chaotic AUR a try since it seems to be run by trustworthy people looking at the “About us” page.

[cactux]

@limotux

I never meant anything bad about the repo or the guys.

I know. But since you mentioned that you had never heard about the repo before, I wanted to fill in with a bit more information.

I know they are a bunch of hardworking people, doing a great job and the repo is trusted by many users and if I am not wrong is enabled by default in Garuda Linux.

However, the fact remains that whenever you add a third party repository to your pacman, you have to trust the source of that repo. The responsibility is only yours.

For a more detailed discussion in general see

[FAQ] The dangers of using 3rd party repos

This is something I wrote last year and posted somewhere else. I thought it was worth sharing here as I see a lot of people using 3rd party repos. There are often discussions about the dangers of using AUR but it seems like there a lot less focus is on the dangers of using 3rd party repos. In general, using a 3rd party repo is much more dangerous than using AUR. With an AUR package, everything is fully transparent and the package is built on your machines. A quick look at the PKGBUILD file wi…

[limotux]

@cactux

However, the fact remains that whenever you add a third party repository to your pacman, you have to trust the source of that repo. The responsibility is only yours.

@cactux
As far as I know it is risky to add repos from other distros other than Arch repos (unfortunatley) as some other distros have some nice features and apps.

@[FAQ] The dangers of using 3rd party repos

I see a lot of people using 3rd party repos. There are often discussions about the dangers of using AUR but it seems like there a lot less focus is on the dangers of using 3rd party repos. In general, using a 3rd party repo is much more dangerous than using AUR.

And this agrees with what @dalto said.

[Cphusion]

@cactux

For a more detailed discussion in general see

This is something I wrote last year and posted somewhere else. I thought it was worth sharing here as I see a lot of people using 3rd party repos. There are often discussions about the dangers of using AUR but it seems like there a lot less focus is on the dangers of using 3rd party repos. In general, using a 3rd party repo is much more dangerous than using AUR. With an AUR package, everything is fully transparent and the package is built on your machines. A quick look at the PKGBUILD file wi…

I’d be curious to hear @dalto’s current stance specifically on the Chaotic AUR knowning that it’s trusted by a lot of users and run by the Garuda team even though it’s automated with pipelines?

[dalto]

@Cphusion

I’d be curious to hear @dalto’s current stance specifically on the Chaotic AUR knowning that it’s trusted by a lot of users and run by the Garuda team even though it’s automated with pipelines?

Even though I do know and trust some of the people involved in the chaotic-aur, I would go back to the original questions I asked in that post:

There are a few questions I would urge you to ask yourself before adding a 3rd party repo

• Do I trust all of the packagers who can build packages for the repo
• Do I understand the process for new packagers to get access to the repo
• Are the packages built in the repo signed by the key of the person who built them or is that process automated with a shared key

Since the answer to not all of those is “yes” for me, I would still not use it.

[Cphusion]

@dalto

There are a few questions I would urge you to ask yourself before adding a 3rd party repo

• Do I trust all of the packagers who can build packages for the repo
• Do I understand the process for new packagers to get access to the repo
• Are the packages built in the repo signed by the key of the person who built them or is that process automated with a shared key

Since the answer to not all of those is “yes” for me, I would still not use it.

Thanks for sharing your view on it, you do have a point. Based on that I will just continue to build my own packages from the AUR PKGBUILDS.