Almost. But with one key difference. PPAs are precompiled binaries where you cannot inspect the source - you have to trust the maintainer of the PPA. AUR is a repository of source packages which you can download and inspect yourself (or hope others have done this). This makes AUR more community focused than PPAs I feel. AUR is also a central repo managed by people that dont own the vast majority of the packages hosted on it and where packages can be taken down if found malicious. PPAs are lots of separate repositories all managed by different people that generally maintain all the packages for their PPA.
Though in both cases anyone can upload anything to them, so they are not 100% trustworthy. But I do think the way AUR works puts them ahead of PPAs.
there is one more thing - unless you are using something like chaotic aur, or a very popular package, please pay attention to PKGBUILDS. These are essentially bash scripts which can (depending on your package manager) will run with highest permissions. They can do anything
Also you can’t just install these packages, you have to import the keyrings of any packages that access the kernel. That requires you to go to the website, check out the owner of the key, see their contributions and decide for yourself if you trust it
Isn’t installing from the AUR equivalent to installing from a PPA, in terms of security and trust?
There no security and trust when it comes to 3rd-party repos. There can be anything in there. Neither the AUR nor PPAs come with any guarantees.
Almost. But with one key difference. PPAs are precompiled binaries where you cannot inspect the source - you have to trust the maintainer of the PPA. AUR is a repository of source packages which you can download and inspect yourself (or hope others have done this). This makes AUR more community focused than PPAs I feel. AUR is also a central repo managed by people that dont own the vast majority of the packages hosted on it and where packages can be taken down if found malicious. PPAs are lots of separate repositories all managed by different people that generally maintain all the packages for their PPA.
Though in both cases anyone can upload anything to them, so they are not 100% trustworthy. But I do think the way AUR works puts them ahead of PPAs.
there is one more thing - unless you are using something like chaotic aur, or a very popular package, please pay attention to PKGBUILDS. These are essentially bash scripts which can (depending on your package manager) will run with highest permissions. They can do anything
They also may not compile stuff from source, they can download and install binaries and some AUR packages do exactly that.
There’s zero guarantee when using AUR. It’s not supported by Arch for a reason.
Also you can’t just install these packages, you have to import the keyrings of any packages that access the kernel. That requires you to go to the website, check out the owner of the key, see their contributions and decide for yourself if you trust it