Replacement of crystal-extra repository with chaotic-aur

[jastrzymb]

What do we think of replacing crystal-extra with chaotic-aur?
Personally, I have some pros and cons listed here:

Pros:

• Less maintenance work for us
• Wider range of prebuilt AUR packages available

Cons:

• Would require extra work to package their keyring and mirrorlist
• Would require an update to the /etc/pacman.conf we ship by default

But what do you all think?

[axtloss]

Isn't it risky to just offer prebuilt AUR packages? Because no one would be verifying the pkgbuilds and it would be easy to distribute anything malicious that way

[jastrzymb]

Theoretically, no one can verify that the packages we ship are the actual PKGBUILDs either, plus chaotic-aur is generally seen as a common, trusted source anyways

[axtloss]

my point wasn't that the chaotic AUR or we distribute modified pkgbuilds, but that the AUR can have malicious pkgbuilds that don't get verified because the chaotic AUR is just an automated build system.

[jastrzymb]

If I recall correctly, chaotic-aur only builds specific approved packages, but I'll check this just in case

[hericiumvevo]

I would add chaotic-aur but keep crystal-extra with higher priority, lets us still have some authority over the packages. Also lets us easily verify pkgbuilds

[SomethingGeneric]

I think it's better that the only prebuilt AUR stuff we allow be stuff where someone from our team has at least glanced at the PKGBUILD. Besides, ame is such a lovely tool that I don't think it's a super big deal to ship anything much from the AUR unless one of our own programs needs it

[jastrzymb]

My main concern is for packages à la Chrome/Chromium, which people do not want to compile from source. It'll also let us be miles more reliable in offering stuff like verified and maintained AUR kernels (chaotic-aur handles a lot of this very well, it seems)