You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Add an AUR package manager driven by paru or yay - #5749
Adds an AUR package manager on Arch-based distributions, driven by paru or yay (whichever is found first, paru preferred). It is offered next to Pacman wherever /etc/os-release names the arch family.
What it does
Search (-Ss --aur), details (-Si --aur: maintainer, AUR page link to the PKGBUILD, dependencies), install/update (-S --aur … aur/<name>), uninstall (-Rs), update check (-Qua).
Installed list comes from pacman -Qm directly, not the helper, so AUR packages stay visible even when a libalpm soname bump breaks paru/yay until they are rebuilt. While the AUR manager is ready, Pacman lists only native packages (-Qn), so nothing shows twice.
Never elevated: makepkg refuses to run as root. A new MustNotRunElevated capability makes RequestsElevation ignore "Run as administrator" (including per-package overrides), and the manager reports itself unavailable while UniGetUI runs as root. The helper receives UniGetUI's own elevator through --sudo/--sudoflags, so pacman's install step uses the same askpass (or pkexec) prompt.
Non-interactive: PKGBUILD review is skipped (--skipreview for paru, --answer*=None for yay); the helper is identified from --version, and an unidentified one only gets the options both understand.
Version comparison: Pacman and AUR now use AlpmVersion, a port of libalpm's alpm_pkg_vercmp. The default numeric comparison read the pkgrel as a version segment (it ranked 1.0-2 above 1.0.1-1 and hid that update) and misordered epochs. AGENTS.md is updated accordingly.
Pacman's dependency parsing and install-location lookup move to a shared AlpmOutput class, used by both managers.
The description warns that AUR packages are user-produced and not reviewed by Arch Linux, as discussed in the issue.
Verification
Ran end to end on real Arch Linux in a throwaway archlinux:latest CI job (not part of this PR, branch since deleted), once with only paru and once with only yay, as an unprivileged user: detection and paru/yay identification, search, details, install of pfetch from the AUR through InstallPackageOperation (with "Run as administrator" set, and correctly ignored), the package listed exactly once under AUR and not under Pacman, a clean update check, and uninstall. 127/127 tests passed in both jobs.
The first run caught a real bug: yay -S --aur pfetch installed extra/pfetch-rs because it providespfetch. Targets are now named aur/<name>, fixed in the second commit.
Real paru and yay output captured in that run is now used as test fixtures (search lines, yay's wrapped -Si layout).
Unit tests: AurManagerTests, AlpmVersionTests (libalpm's vercmp cases, both directions), plus the setup-guide, reinstall-on-update, broker-request and package-operation suites. Both dotnet format gates pass.
Not covered
The graphical askpass prompt itself (CI used passwordless sudo; it proves the elevator and flags are passed through).
An actual upgrade of an outdated AUR package (the update check ran and correctly found nothing; upgrades use the same -S … aur/<name> command as installs).
A confirmation dialog when the manager is turned on; the warning is in the description for now.
Arch users get most of their software from the AUR, which pacman cannot
reach. A new AUR manager (id `aur`, offered on the arch family next to
Pacman) searches, installs, updates and removes AUR packages through
paru or yay, whichever is found first, preferring paru.
Building:
- makepkg refuses to run as root, so the helper always runs as the
user. The new MustNotRunElevated capability makes RequestsElevation
ignore "run as administrator", including per-package overrides, and
the manager reports itself unavailable while UniGetUI runs as root.
CanRunAsAdmin could not carry this: WinInstaller, MacPkg and Homebrew
also leave it false.
- The helper gets UniGetUI's own elevator through --sudo/--sudoflags, so
pacman's install step uses the same sudo askpass (or pkexec) prompt.
The sudo loop is turned off for an elevator that is not sudo.
- No terminal is attached, so PKGBUILD review is skipped: --skipreview
for paru, --answerclean/diff/edit=None for yay. The helper is
identified from --version, then its file name; an unidentified one
only gets the options both understand. paru reads `--sudoloop=false`
as sudo flags and yay has no --nosudoloop, hence the per-helper
spelling.
- Every flag and output format was checked against the paru and yay
sources; neither has been run end to end on Arch yet.
Listing:
- Installed AUR packages come from `pacman -Qm`, not the helper, so they
stay visible when a libalpm soname bump breaks paru or yay until they
are rebuilt. While the AUR manager is ready, Pacman lists only native
packages (-Qn), so nothing shows twice.
- Updates come from `-Qua`; ignored packages and paru's `latest-commit`
devel entries are skipped. Exit code 1 with no results means "nothing
found" only when stderr reports no error, so offline checks fail
visibly instead of looking empty.
- Listings register their process for the timeout kill and read stderr
concurrently, so a chatty helper cannot deadlock on a full pipe.
- Details show the maintainer and link the AUR page (which leads to the
PKGBUILD), as suggested in the issue; makedepends are not presented
as runtime dependencies.
Pacman and AUR now compare versions with AlpmVersion, a port of
libalpm's alpm_pkg_vercmp. The default numeric comparison reads the
pkgrel as a version segment, so it ranked 1.0-2 above 1.0.1-1 and hid
that update; epochs misordered the same way. Pacman's dependency parsing
and install-location lookup move to a shared AlpmOutput class.
The manager description warns that AUR packages are user-produced and
not reviewed by Arch Linux. A confirmation when the manager is turned on
is left for a follow-up.
Fixes#5734
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Running the manager end to end on Arch Linux showed `yay -S --aur pfetch`
installing extra/pfetch-rs instead: --aur restricts yay's search mode,
but a target name is still satisfied by any sync package that provides
it, and pfetch-rs provides pfetch. The repository package then never
shows up under the AUR manager, and the user did not get the package
they picked. Naming the target `aur/<name>` makes both paru and yay take
it from the AUR. Uninstalls keep the bare name, which pacman resolves.
The same run captured real paru and yay output; search lines and yay's
wrapped -Si layout from it are now test fixtures, and they parse as the
hand-written ones did.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
AUR operations can bypass prohibited elevation, and uninstall-before-update can remove the selected helper before reinstalling it, leaving AUR operations broken.
- Refuse operations of managers that elevate on their own while
elevation is prohibited. With the setting on, ElevatorLoader leaves
the elevator empty, so the helper received no --sudo and fell back to
plain sudo for pacman. A new ElevatesItself capability drives the
refusal in PackageOperation.RefusalBeforeStart, before anything runs.
- Stop offering uninstall-before-update for AUR packages. Updating the
helper's own package that way removed the executable the reinstall
then launches. makepkg -S replaces a package in place, so the option
never had a purpose here.
- Always pass --sudoloop=false to yay. Its sudo loop runs `sudo -v`
without --sudoflags and retries that until it succeeds, so with a
sudoloop config and expired credentials the operation waited forever
instead of opening the askpass prompt. paru passes its flags to the
loop, so it is still only turned off for an elevator other than sudo.
- Treat exit code 1 with no results as "nothing found" only when stderr
is empty or warnings only. yay reports a failed RPC call as
` -> Get "...": dial tcp: ...` without the word "error", which the
previous check let through as an empty, successful update check.
- Remove LANGUAGE from listing processes. yay's gotext reads it before
LC_ALL, so a translated -Si would lose every field ParseDetails reads.
- Set CanListDependencies for AUR, and for Pacman, whose details have
parsed dependencies all along without the page showing them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
If the helper emits a valid update row and then exits with a fatal diagnostic, this condition returns the partial results instead of reporting failure. Closing the task logger only records the exit code; PackageManager still leaves LastUpdatesListingFailed false and records a successful health check, so users are not warned that the update listing is incomplete. Throw for every nonzero normalized exit code, regardless of the number of parsed rows.
Clear dependencies before reloading package details
PackageDetails.Load reuses the same details object after saved installation options invalidate it, but this parser appends dependencies without clearing the previous list. Each subsequent load duplicates the mandatory and optional dependencies, and dependencies removed upstream remain displayed. Clear the dependency collection before parsing the new details snapshot.
This method also supplies GetStandaloneParameters, so copied/manual commands include --sudoflags=-A when the GUI uses sudo with askpass. ElevatorLoader sets SUDO_ASKPASS only in UniGetUI's environment; pasting the command into an independently opened terminal without that variable and with expired credentials makes sudo fail instead of prompting. Keep the GUI elevator flags for executed operations, but omit them for standalone commands so the helper can use terminal-based sudo.
Use consistent AUR readiness for each inventory reload
After the manager-initialization timeout, AUR can become ready after the loader skips its listing but before Pacman's background query evaluates this delegate. Pacman then runs -Qn without an AUR listing for that reload, omitting every foreign package. Share one readiness decision across both listings for each reload, or trigger a full inventory reload when AUR finishes late initialization.
- Always pass --sudoflags with --sudo, empty when the elevator takes no
arguments. yay applies the command-line value over the sudoflags
saved in its configuration, so a saved `-A` no longer reaches pkexec.
paru's config and command line can only add to SudoFlags, so a value
in paru.conf still does; that is documented rather than worked around
by replacing the user's whole paru.conf through PARU_CONF.
- Leave --sudo, --sudoflags and the sudo-loop options out of commands
copied for a terminal. SUDO_ASKPASS exists only in UniGetUI's own
environment, so `sudo -A` failed there instead of prompting.
- Fail a listing on any nonzero exit, not only an empty one. paru and
yay exit 0 whenever they print a row, so a nonzero exit with rows
means part of the list is missing, and it now reaches the manager's
failure state instead of being shown as complete.
- Clear the dependencies before parsing details. PackageDetails.Load
reuses the same object when saved options change during a load, and
each pass appended another copy.
- When manager initialization times out and AUR finishes after the
first installed-packages reload took its snapshot, reload once more.
Pacman may have listed with -Qn in that reload while AUR was left out
of it, hiding every foreign package until the next refresh.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
The AUR follow-up reload can be discarded while the initial package load is active, leaving foreign packages misassigned or missing until a manual refresh; it must wait for the current load to finish.
No open issues 🎉
1 previously missed issue
In code that hasn't changed since last review
AUR initialization during load discards the follow-up package reload
If AUR finishes initializing after the initial installed-package load has selected its managers but before that load finishes, this reload is discarded: AbstractPackageLoader.ReloadPackages() returns immediately while IsLoading is true (lines 201–204). The initial load skipped AUR, so foreign packages remain assigned to Pacman—or disappear if Pacman observes AUR becoming ready and uses -Qn—until a manual refresh. Await WaitForCurrentLoadAsync() before requesting the follow-up reload so the late initialization actually refreshes the inventory.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
new-featureA new feature that could be useful in WingetUI
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-actions
Bot
added
the
new-feature
![randy-but-a-ro[bot]](https://avatars.githubusercontent.com/in/113084?s=60&v=4){kind=small}
Fixes #5734
Adds an AUR package manager on Arch-based distributions, driven by
paruoryay(whichever is found first, paru preferred). It is offered next to Pacman wherever/etc/os-releasenames thearchfamily.What it does
-Ss --aur), details (-Si --aur: maintainer, AUR page link to the PKGBUILD, dependencies), install/update (-S --aur … aur/<name>), uninstall (-Rs), update check (-Qua).pacman -Qmdirectly, not the helper, so AUR packages stay visible even when a libalpm soname bump breaks paru/yay until they are rebuilt. While the AUR manager is ready, Pacman lists only native packages (-Qn), so nothing shows twice.MustNotRunElevatedcapability makesRequestsElevationignore "Run as administrator" (including per-package overrides), and the manager reports itself unavailable while UniGetUI runs as root. The helper receives UniGetUI's own elevator through--sudo/--sudoflags, so pacman's install step uses the same askpass (or pkexec) prompt.--skipreviewfor paru,--answer*=Nonefor yay); the helper is identified from--version, and an unidentified one only gets the options both understand.AlpmVersion, a port of libalpm'salpm_pkg_vercmp. The default numeric comparison read the pkgrel as a version segment (it ranked1.0-2above1.0.1-1and hid that update) and misordered epochs.AGENTS.mdis updated accordingly.AlpmOutputclass, used by both managers.Verification
archlinux:latestCI job (not part of this PR, branch since deleted), once with only paru and once with only yay, as an unprivileged user: detection and paru/yay identification, search, details, install ofpfetchfrom the AUR throughInstallPackageOperation(with "Run as administrator" set, and correctly ignored), the package listed exactly once under AUR and not under Pacman, a clean update check, and uninstall. 127/127 tests passed in both jobs.yay -S --aur pfetchinstalledextra/pfetch-rsbecause it providespfetch. Targets are now namedaur/<name>, fixed in the second commit.-Silayout).AurManagerTests,AlpmVersionTests(libalpm's vercmp cases, both directions), plus the setup-guide, reinstall-on-update, broker-request and package-operation suites. Bothdotnet formatgates pass.Not covered
-S … aur/<name>command as installs).🤖 Generated with Claude Code