52 releases (11 breaking)
424 downloads per month
37KB
957 lines
RUA
RUA is a build tool for ArchLinux, AUR. Its features:
- Uses a namespace jail to build packages:
- Show the user what they are about to install:
- warn if SUID files are present, and show them
- show INSTALL script (if present), executable and file list preview
- Minimize user interaction:
- verify all PKGBUILD-s once, build without interruptions
- group built dependencies for batch review/install
-.tar package built, run RUA checks on it (SUID, executable list, INSTALL script review etc).
rua jailbuild --offline /path/to/pkgbuild/directory # build a directory. Don't fetch any dependencies. Assumes a clean directory.
rua --help && rua install --help # shows CLI help
Jail arguments can be overridden in ~/.config/rua/wrap_args.d/ .
Install dependencies
sudo pacman -S --needed git base-devel bubblewrap cargo
Install (the AUR way)
git clone cd rua makepkg -si
In the web interface, package is rua.
Install (the Rust way)
cargo install rua
There won't be bash/zsh/fish completions this way, but everything else should work.
How it works
We'll consider the "install" command. RUA will:
- Fetch the AUR package and all recursive dependencies.
- Prepare a summary of all pacman and AUR packages that will need installing. Show the summary to the user, confirm proceeding.
- Iterate over all AUR dependencies and ask to review the repo-s (PKGBUILDs, etc).
- Propose installing all pacman dependencies in one batch. (No need to do it for each AUR package individually, save user-s time).
- Build all AUR packages of maximum dependency "depth".
- Let the user review built artifacts (in batch).
- Install them. If any more packages are left, go two steps up.
Limitations
- Smart caching is not implemented yet. To avoid outdated builds, RUA wipes caches in case of possible conflict. This may change in the future.
- Optional dependencies (optdepends) are not installed. They are skipped. Check them out manually when you review PKGBUILD. This may change in the future.
- The tool does not show you outdated packages yet (those that have updates in AUR). Pull requests are welcomed.
- Unless you explicitly enable it, builds do not share user home (~). This may result in rust/maven/npm/whatever packages being re-downloaded each build. If you want to override some of that, take a look at ~/.config/rua/wrap_args.d/ and the parent directory for examples.
Safety
RUA only adds build-time safety and install-time control. Once/if packages pass your review, they are as run-time safe as they were in the first place. Do not install AUR packages you don't trust.+.
Dependencies
~9MB
~162K SLoC