Pacman hooks, the AUR, and build security

Pacman efficiency and hooks#

Parallel downloads

In /etc/pacman.conf, set the following under [options]:

[options]
ParallelDownloads = 5

Adjust this to suit your bandwidth and the load on the mirror. More parallel downloads do not guarantee better speed; server connection or rate limits may apply.

A hook to report orphaned packages

You can configure the following in /etc/pacman.d/hooks/orphan-check.hook:

[Trigger]
Operation = Upgrade
Operation = Install
Operation = Remove
Type = Package
Target = *

[Action]
Description = Checking for orphaned packages...
When = PostTransaction
Exec = /usr/bin/bash -c "/usr/bin/pacman -Qtd || echo 'No orphans found.'"

This example only reports packages; it does not remove them. pacman -Qtd returns a nonzero status when there are no matches. The fallback message in the script may also conceal a genuine query failure, so automated maintenance should log stderr and distinguish the causes.

AUR helpers: Paru and Yay#

The AUR provides user-submitted build scripts, which are not the same as prebuilt packages from the official repositories. AUR helpers are not officially supported and do not replace a review of PKGBUILD, installation scripts, and changes.

Preview features, resource usage, and chroot support vary by version and configuration; do not infer performance advantages without measurements. A clean build can prevent interference from old artifacts, but CleanBuild does not automatically provide security isolation.

Review and clean builds#

Why review a PKGBUILD?

A PKGBUILD is itself executable shell code: reading files, accessing the network, and running other programs can all happen during the build. Do not run makepkg as root or build unreviewed scripts in a working directory that contains sensitive credentials.

Clean chroots with devtools

sudo pacman -S devtools
# 在已审阅的 PKGBUILD 所在目录中执行
extra-x86_64-build

The main purpose of a clean chroot is to provide consistent build dependencies and environments, preventing packages installed on the host from hiding missing dependencies. It is not equivalent to a sandbox with no network, no host mounts, or absolute protection from malicious code. Untrusted builds can be further confined to a dedicated virtual machine or a restricted account/environment.

Performance settings in makepkg.conf

MAKEFLAGS="-j$(nproc)"
COMPRESSZST=(zstd -c -T0 --ultra -20 -)

Adjust parallel compilation to suit available memory. High compression levels increase packaging time and resource use, so use them only when smaller artifacts are genuinely needed. Experiment in the user-level makepkg configuration rather than treating machine-specific settings as optimal for every system.

Reproducible builds and distribution integrity#

Reproducible builds concern whether the same inputs and environment produce identical artifacts. archlinux-repro is one of the relevant tools:

repro --help
# 具体包输入和子命令以已安装工具版本的帮助为准

The repro verify <package_name> command from the original notes cannot be assumed to work across versions. Identical artifacts are evidence of reproducibility; they do not by themselves prove that source code is free of malicious behavior. Package signature verification, trusted keys, source code review, and independent rebuilds each serve different purposes.

The package management workflow#

graph LR
    A[AUR 构建脚本] --> B[审阅来源和变更]
    B --> C[干净环境构建]
    C --> D[检查包产物]
    D --> E[安装并验证行为]
    E --> F[管理缓存与更新]

When synchronizing repository databases, perform a full system upgrade: sudo pacman -Syu. Do not use pacman -Sy package and create an unsupported partial upgrade.