I am a noob+ in the sense that I barely understand anything about Linux but I’m still able to troubleshoot a number of issues on my own with wikis, search, and LLM support.
I switched to Nobara two years ago as Windows 11 was the final nail in the coffin and proton worked with 99% of my games. I picked it because Fedora-derivatives appeared to be very well supported whilst also having rapid updates. It’s a really nice OS and I’m grateful for their work, but I am thinking of switching to a distro that is more flexible and customizable over the long term.
Arch looked like the best choice in terms of the latter but it is intimidating and the community doesn’t particularly enjoy dealing with noobs, which I totally get. My understanding is that CachyOS is a noob-friendly version of Arch that “just werks” at the beginning when you need to do things and move on with your life, but also lets you learn more about Linux and personalize your experience at your own pace more so than any other distro family. (I’ve heard of Gentoo but I am not touching that any time soon haha) Is this correct?
Some noob questions:
How exactly does trust work with the AUR? Let’s say we take a random app that requires a high degree of trust such as a VPN, does using a random user’s package (e.g. AUR (en) - mullvad-vpn-bin ) make sense in this regard if I don’t know what I’m doing and have no way of verifying the code?
What are your thoughts on other Arch distros such as Garuda or EndeavourOS?
What is generally the best way to managing apps from various sources e.g. a roiling mess of AppImages, github clones, packages that would use dnf install on Nobara/Fedora and keeping track of it all?
AUR, you actually can see what the PKGBUILD script, when you installing from AUR, (atleast on yay) you always be prompted 2 things, 1 is cleanbuild and 1 is check the PKGBUILD, in there you can check the script, and see if there is any suspicious code inserted in there, or you can check on the AUR page itself, to see other people comment
Unfortunately i didn’t tested it, as for arch, i only tested pure arch (yes i created super minimalized for server purpose back then) and cachy right away, so idk about garuda and endavour
pacman and yay (atleast for me) managed all of it sofar, as for github as long it’s from AUR yes, it can maintain like other packaging (apt / dnf), as for manual clones and appimages, i do think you can’t track them (atleast i havnt explored that part yet for app management, because pacman and yay is suffice for me)
Verify the source of the code. Always review PKGBUILDs before installing. In this example you can see that it downloads the debian packages from the mullvad github.
Garuda does some…unwise?…things and is mostly aesthetic focused. Endeavour is also good (closer to Arch) but cachy is nicer.
Limit those sources in the first place imo, especially random unmanaged stuff. This isn’t really different from Nobara/Fedora. The GUI tools that manage multiple sources…have reasons to not use for Arch packages. I prefer cli tools for package management. There are all-in-one things like topgrade which i think are ok but don’t use and can’t vouch for.
Bonjour! I am also still a noob (I installed Cachy 6 months ago and this is my first “real” Linux experience after playing around with several Live-ISOs in the past years).
Regarding AUR:
There is a popularity level. Quote from the site: “Popularity is calculated as the sum of all votes with each vote being weighted with a factor of 0.98 per day since its creation.” The package you mentioned has a popularity level of 3.15, which is pretty good. Also, always take a look at the number of votes and when the account was created. In your case, the account exists since 2019 so it is safe to say the account is solid
Always look at the “Last Updated” timestamp. Be very suspicious when a package is older than a month or two because it will much likely depend on outdated packages which is a risk in itself
As others said already, you should check the PKGBUILD script, but that is a little overwhelming, even for a software developer like me
My personal rule of thumb: I try to avoid AUR packages whenever possible
Regarding other distros: On my laptop, I tried Mint, MX Linux and Kubuntu and I didn’t like any of them, especially the snap-package-philosophy of Ubuntu is a waste of precious hard-drive space in my eyes. I failed installing Cachy on that machine, so I settled for TuxedoOS (because the machine I own was once rebranded as a Tuxedo laptop, so I was hoping for good hardware support and that hope was met).
Regarding “apps from various sources”: I would advise the same as @mattsteg : try to avoid too many sources, especially in the beginning. I had to learn that not everything is updated when you do a system update, even with cachy-update and adding more sources generally means more manual work on your side.
I also just recently had to learn about *.pacnew files and how to handle them, which is something nobody tells you in the beginning.
If you don’t mind me asking about your dev POV: when you see some random but interesting GitHub project/app, what is the best practice for this sort of thing in Arch?
In my case that’s where it gets messy. As a no-code normie, I grab projects that fit my interests and just clone it in an applications folder or type in the install instructions which often seem to involve adding random repos, or employing a hydra-like constellation of methods, supplementary packages, and tweaks (e.g. docker, anaconda, python or nvidia drivers) where I’m not even sure how the rest of my system is affected. Probably a dumb thing to do, but then again I don’t know what the unknown unknowns are by definition. So far I haven’t experienced any issues in Nobara/Fedora, but I want to start with a clean methodological slate in Cachy.
Docker stuff is containerized and kept self-contained. Only docker itself is really installed, and just use the cachy packages (try to keep stuff organized for your own sanity though)
Python and anaconda - if you’re installing python stuff that isn’t in the cachy repos then you should use some kind of venv. Anaconda is one fine choice that can suit. Don’t mess with the system.python.
My very personal opinion is that I try not to mess around too much with my system. Especially not when I am so new to the OS as I am now. I come from the Windows world since Win95, so that is 30 years of experience versus 6 months of learning CachyOS (and some Debian-derivate on my laptop) so I still feel very unsure about most of the things I do.
Therefore, I treat my main machine very carefully in order not to mess it up because I really need that machine for gaming, recording, mails, graphics stuff, OBS, ShotCut, you name it. I tend to stick to well-known projects that are available in repos and so far, there was no need to search for something different.
The one time I tried some fancy stuff resulted in me restoring the previous btrfs-snapshot (and I congratulated myself that I was prepared enough to do that), so I won’t just tryout some Github projects on my machine unless I absolutely understand what they do and only if I really need them. Which, as mentioned, has not yet been the case.
Which kind of projects do you have in mind?
Edit: come to think of it, the fanciest thing I did on my current machine is to run Wordpress in a Podman pod so that I can tryout new CSS styles for my website instead of having to do it on the live system. But that really took me nearly a whole day until I understood what I had to do and how it fits to my backup strategy and so on.
The last thing I do is jump into those rabbit holes of install this, then that, then pip, then run a python script. then do some random CLI stuff, because that is the highway to hell
Edit 2: the safest thing you can do to tryout random Github projects would for sure be either a Docker / Podman approach or a complete VM approach, the latter maybe being a bit of an overkill.
