LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Arch (https://www.linuxquestions.org/questions/arch-29/)
-   -   Yaourt and super user (https://www.linuxquestions.org/questions/arch-29/yaourt-and-super-user-842747/)

Mr. Alex 11-06-2010 12:39 PM

Yaourt and super user
 
Some say that you shouldn't use yaourt with root privileges because it's dangerous. But if I try to use it as a regular user, it asks for some password. So how can I use it without root privileges? Besides, it installs software on GNU system, how can I install something as a regular user on GNU??

TheStarLion 11-06-2010 02:43 PM

By default, it will do everything it can as the regular unprivileged user until it requires the root password, then will fall back to using sudo to get priveliged.

Yaourt itself does not actually handle any package management - it calls on Pacman for that, which requires the root password.
What Yaourt does do is make the AUR accessible as if it were any other repository, and automates running makepkg.

Try downloading a pkgbuild from the AUR and running makepkg on it as root - it'll complain too.

Compiling something as root - or doing anything as root - is potentially risky because it has complete access to do everything and anything.

Mr. Alex 11-06-2010 02:58 PM

So installing something from AUR is dangerous?

TheStarLion 11-06-2010 09:37 PM

Try asking Yaourt to make you a package from the AUR - even it will warn that it is potentially dangerous.
All this actually means is that it's totally unsupported - it comes with no warrenty, just the files it needs to make the package, and even then that package is not trusted. Who knows what it could do?
However, I've often discovered that if you want to make use of the AUR, then you're taking a risk every time you choose to trust an AUR package will do what it says it will - and even then, that's if it will compile.

Mr. Alex 11-07-2010 03:45 AM

I thought that someone checks packages which go to AUR...

TheStarLion 11-07-2010 11:52 AM

Yes. The Maintainer.
As far as I'm aware, the only other time is when a TU takes one under their wing and moves it to [community]

It's not like .deb or .rpm based package management where all repositories give a GPG key, and all packages are signed with it. Pacman repositories have their checks to ensure they're correct; AUR ones are always unsupported and used at the user's own risk.

Mr. Alex 11-07-2010 12:36 PM

Do you know cases when users suffered when installed software from AUR?

TheStarLion 11-07-2010 01:44 PM

Not of other users, but I've had the odd problem when a package was orphaned, or taken up by a different maintainer. Most of the problems come from incorrect dependencies and make-dependencies, 404 not found errors, failed file checks or just it failing to compile for one reason or another (Ex. gnome-shell and unity packages).


All times are GMT -5. The time now is 07:46 AM.