The incidents didn’t just break “optional community packages”; they broke core workflows that other distros ship officially. AUR problems became system‑wide problems!

Arch maintains only a few thousand official packages. -Compare that to Debian/Ubuntu’s tens of thousands.

Not in the ‘official repos’:

  • everyday tools
  • popular apps
  • developer tooling
  • GUI apps
  • proprietary apps

Arch users love to pretend the AUR is optional, but all these are from the AUR:

  • VS Code
  • Chrome
  • Discord
  • JetBrains IDEs
  • Steam (with extras)
  • Most drivers
  • Most niche libraries
  • Most modern apps

AUR packages run arbitrary shell scripts on your machine AUR PKGBUILDs:

  • run arbitrary bash
  • download arbitrary sources
  • execute arbitrary build steps
  • can inject arbitrary commands
  • have no sandbox
  • have no review
  • have no signing
  • have no automated scanning

(even more absurd than letting amateur 3rd party volunteer drivers in ring 0 on Linux)

When you update a few times a week, you can expect the majority of users to not even look at PGKBUILDS!