Post #2746145
2026-03-14 15:37 UTC
The AUR just hosts pkgbuild files, no source or built packages. The pkgbuild can point to arbitrary external sources that could update separately. Manjaro could have their own AUR that hosts old pkgbuilds, but that wouldn't be foolproof since the external sources could change. Also, if a pkgbuild was updated for security reasons, now Manjaro is putting users at risk by continuing to serve the old version, and now that's another problem for them to solve.
Replies (1)
-
@Veraxis@lemmy.world 2026-03-14 15:52
>Also, if a pkgbuild was updated for security reasons, now Manjaro is putting users at risk by continuing to serve the old version Hold up, isn't that last point just a criticism of delayed updates in general? By that logic, would Manjaro be putting users at security risk by holding back the main packages?