[BUG] Forces AUR installation, and installs packages without review

[vasi]

Describe the bug

AUR has been having a number of security issues lately. Users are wary of it, and should at least be reading PKGBUILD files carefully.

But when installing ML4W:

• The preflight-arch.sh script prompts me to choose an AUR helper. There's no option to skip using AUR.
• The installer then installs a bunch of packages, some of which come from AUR. In my case, these were hyprsysteminfo and python-pywalfox. These are installed with --noconfirm, so there's no prompt for approval no notification these are coming from AUR, and no chance to read the PKGBUILD.
• Both the above packages have gone through multiple changes of maintainer recently. The PKGBUILDs look fine as of now, but I don't trust brand new maintainers.

Steps to reproduce

1.Start with Arch, with no AUR helper installed
2. In a terminal, install the stable ML4W release: bash <(curl -s https://ml4w.com/os/stable)
3. You'll be asked for an AUR helper
4. Packages from AUR will be installed without confirmation

Expected behavior

There's a few things that could be done here. From easiest to hardest:

1. Allow the user to select "none" for the AUR helper. Just skip the packages that are only available in AUR, those two packages are not critical for ML4W.
2. Offer to show the user AUR packages before installing them, and let them read the PKGBUILD. yay offers flags for this already.
3. Hardcode a version of these packages to install, which is known to be good. Update it only a few weeks after a new release, so we can be pretty sure someone has checked it by then.
4. Establish more stable maintainership of these packages, and get them into Arch extras, or at least Chaotic-AUR.

Screenshots

No response

Distribution

Arch Linux

If Other, specify

No response

Additional context

Thanks for looking into this! I appreciate all y'all are doing, I know maintaining software is hard.

Code of Conduct

• I agree to follow this project's Code of Conduct

[mylinuxforwork]

@vasi Thank you so much for bringing this up. The best way would be to remove all remaining AUR packages from the installer. I have cleaned up already a lot. And you're right, the remaining two packages are not required to run the system.

The user can decide later on an AUR helper and install packages.

I will implement this request for 2.15.1

[vasi]

To test, I just did a clean install of Arch in a VM, and ran the stable ml4w installer. Result:

❯ pacman -Qm
grimblast-git r167.3dcbce7-1
hyprsysteminfo 0.2.0-1
hyprsysteminfo-debug 0.2.0-1
python-pywalfox 2.9.0-1
python-screeninfo 0.8.1-2
yay-bin 13.0.1-1
yay-bin-debug 13.0.1-1

In approximate order of decreasing importance, how much do we care about each of these?

• grimblast-git: Allows several screenshot modes. Could manage without it, but would lose some functionality. This is just a couple of shell scripts though, we already have a script to install it on non-Arch.
• python-pywalfox: No impact at all unless the user installed pywalfox in Firefox/Thunderbird. If they do, I guess we could install with pipx like we do on Fedora/OpenSUSE? I trust PyPI's security model much farther than AUR's, especially if we install as non-root.
• hyprsysteminfo: Totally optional. Without it, we just display system info in kitty instead of a slightly-customized window.
• yay-bin: Obviously don't need this if we don't want AUR.
• python-screeninfo: Looks entirely unused, I'm not sure why we install it.

[hurlbutt]

In #1680 there's already support to build grimblast from source for non-Arch distros. The Arch post-install script could be modified to detect whether grimblast exists and build from source rather than relying on the AUR.

[hurlbutt]

@mylinuxforwork - Created #1790 to change Arch-based systems' post-install to install grimblast-git from source if it's not found in pacman

@vasi - If you want to test this in a clean Arch install and confirm that a) grimblast-git isn't reported from pacman and b) screenshots work as intended, I'd appreciate it.

[mylinuxforwork]

@hurlbutt @vasi Just pushed an update to the rolling release using the upcoming ml4w-dotfiles-installer 0.2.8 without using any AUR helper.
grimshot will be installed similar to Fedora and openSuse and pywalfox with pipx
https://github.com/mylinuxforwork/dotfiles/blob/main/setup/post-arch.sh

Hyprsysteminfo has been replaced again to the command line version. System updater works without AUR helper as well.

[hurlbutt]

@mylinuxforwork - Understood. I did modify my PR #1790 to just check for grimblast-git already being installed via pacman -Qi as to not usurp that package's management.

[vasi]

This is great, thank you! I'm on vacation right now and so I can't test, but I'll make sure to try it out when I'm back.