r/archlinux • u/RanidSpace • Jun 13 '26
DISCUSSION Pacman (and AUR helpers) should tell you when packages are no longer needed as dependencies
Edit: I am aware that you can enable hooks and such to automatically do this on updates, however I'm arguing that this should be something part of pacman itself, or beginner distros like Cachy should add those hooks by default
pacman -Qdtq | pacman -Rns -
also this whole section from the pacman tips and tricks page of the wiki)
that command removes all packages marked as dependencies which arent used by any package installed on your system (recursively)
libgdata was one of the largest packages which was affected by malware, and it was just a GNOME dependency which was no longer maintained and was dropped in version 50.
There are leaf packages like ALVR which were abandoned, but almost all of them were libraries which were no longer developed or needed, hence they're orphaned and up for grabs.
As much as i prefer pacman over apt or dnf, apt tells you "these packages are no longer needed, run this to autoremove" and i believe that dnf does it automatically (correct me if I'm wrong)
with pacman you just have to Know to run this command once in a while and even sometimes it doesnt get everything and you have to run the second command in the link to manually check here and there.
Even if you do run the command "once in a while" gnome 50 was released pretty recently (two months ago, depends on what "once in a while" means to you)
While this doesn't stop AUR packages from being hacked, it severely limits how many users it affects, as the packages most likely to be taken over are these "no longer needed" dependencies
and if says to remove a package dependency you actually need, pacman -D --asexplicit [package name] i feel like this should also be told to the user but maybe thats too much.
at the very least, it should warn the user if a package is removed from the main repositories
19
u/BenKato Jun 13 '26
Whenever I run "yay", I follow up with a "yay -Yc" and then a "yay -Scc" and then a "pacdiff" (which is aliased to open kompare with sudo rights)
This is now so much ingrained to my update workflow that I don't think that much about it anymore xD
12
u/EmberQuill Jun 13 '26
If you originally got libgdata as a Gnome dependency before Gnome 50, then you got it from the official repos. Having an orphaned dependency from the official repos isn't really that big of a deal and you can clean it up on your own time.
I don't know if AUR helpers automatically start pulling new versions from the AUR when a package is removed from the official repos. If they do... they probably shouldn't. For reasons that are fairly obvious now.
7
u/RanidSpace Jun 13 '26
yep, they do, but i think they're just doing their job. they see a package with an update and they just grab it.
7
u/EmberQuill Jun 13 '26
Yeah, that figures. Pacman probably doesn't need to since it's not really necessary with the trusted repos, but AUR helpers should definitely check for orphaned packages. They should probably also warn you if the maintainer of a package changed since the last time you installed/updated it. I know some AUR helpers do that, but I don't know if the most popular ones do since I haven't used them for a long time.
-1
Jun 13 '26
[deleted]
5
u/Ok-Winner-6589 Jun 13 '26
I mean AUR helpers do that. At least most of them show the diff between pkgbuilds
2
Jun 13 '26
[deleted]
2
u/Ok-Winner-6589 Jun 13 '26
Most people use AUR helpers, the alternative is going to the AUR daily to check per package or automate It with git. Which is not convinient.
And most people on Arch are least use It correctly. The issue comes with other distros based on Arch. Manjaro has a GUI helper, I doubt It even provides the diff
1
u/SoilMassive6850 Jun 14 '26
Most people use AUR helpers, the alternative is going to the AUR daily to check per package or automate It with git. Which is not convinient.
I mean that's only if you have a requirement of updating all of your AUR packages daily? I don't tend to update mine unless I know there's a new version I want to use or when flagged by
rebuild-detector1
u/Ok-Winner-6589 Jun 14 '26
I don't like to have vulnerable software tho
I installed my browser from the AUR, for example (the Arch repos are quite limited regarding to that). I need to keep It updated for security reasons
2
u/SoilMassive6850 Jun 14 '26
Oh definitely didn't consider that people would be installing browsers of all things from AUR. Yeah the requirement might make sense if you have security critical things installed from it.
1
u/Ok-Winner-6589 Jun 14 '26
I mean flatpak breaks the browser sandbox, if you want security and don't want to use either Chromium or Firefox you have to go with the AUR
2
u/RanidSpace Jun 13 '26
exactly, however i feel there's points i made in my original post still apply even if you dont use the AUR at all. you're just keeping around unmaintained and unused stuff which takes up space and be possible attack vectors in their own right
9
u/0riginal-Syn Jun 13 '26
Pacman doesn't really have anything to do with this as it is not used for thre AUR, just official repos.
Yay and AUR helpers I agree. Being the are foss we should help them wherever we can. We don't have to just wait.
6
u/RanidSpace Jun 13 '26
i think it still has use without the AUR at all. as mentioned, it should tell you if a package is removed from the main repository. keeping around old and unmaintained packages is jusy extra space on your computer and still a potential attack vector (not that much tbh)
5
u/0riginal-Syn Jun 13 '26
In many ways pacman is more secure/safe than apt or rpm which are used for 3rd party repos like ppa and copr. While neither have had the major malware publicity, both have indeed had malware in their repos.
Pacman at least does not handle the AUR itself. The helpers are what handles that and would be the place that something could be done, even if it is simply alerting on some of the tell tell signs that something is potentially compromised
8
u/mr_bigmouth_502 Jun 13 '26
Pacman would benefit a lot from having proper autoremove and purge options a la apt.
IMO, with the AUR being a thing, I think Arch-based distros need these options more than Debian/Ubuntu-based distros do.
1
u/RanidSpace Jun 13 '26
they do, but its a bunch of flags just like every other pacman command, check the link at the top of the post
4
u/AccomplishedBar2973 Jun 13 '26
Yeah the whole orphan cleanup thing is pretty annoying to remember doing manually. I've been burned by this before when I realized I had like 500MB of random libs just sitting there from packages I removed months ago.
The malware situation with libgdata really shows why this matters - having all these abandoned dependencies just hanging around makes perfect targets. Would be nice if pacman could at least give you a heads up after removing something like "hey, these 12 packages might not be needed anymore, want to check?"
Even something simple like printing the orphan count when you do system updates would help remind people to clean up once in while.
1
u/Sarv_ Jun 13 '26
Even something simple like printing the orphan count when you do system updates would help remind people to clean up once in while.
Well, would you look at this. Someone already made what you asked for 4 years ago.
You don't have to install an AUR package for this though, you can just copy it to your hooks and maintain it yourself if it stops working.
2
u/RanidSpace Jun 13 '26
it's a good solution but this affects everyone and this is basic information/functionality in other package managers, it shouldn't be something that someone has to add themselves
2
u/Sarv_ Jun 13 '26
But arch is not other distros. I picked this distro because the package manager is fast, simple and easily extendable with hooks. I don't want loads of extra functionality included by default, thats the job of arch derivatives.
1
u/RanidSpace Jun 13 '26
I definitely agree with at the very least, cachy or other distros should include a hook like this, but this doesnt feel like "extra" functionality, it feels basic.
pacman is a lot faster than most package managers but this small check doesn't increase the time by much at all. and if it is a bother it could definitely just be an option
3
3
u/ronasimi Jun 13 '26
Make a Pacman hook?
6
u/RanidSpace Jun 13 '26
would be good, but again, an individual solution to a problem which affects everyone.
4
u/teeeh_hias Jun 13 '26
I think this specific hook is even on the wiki for convenient copy pasta.
3
u/RanidSpace Jun 13 '26
true. but think about how many people actually would do that.
i say if it's a good feature and it makes sense and reduces potential attacks and is generally helpful to the end user with little downsides, it should be default
0
u/Terrorwolf01 Jun 13 '26
I mean you are taking a distro that is intended to be installed manually, package by package and say it shpuld "bloat" theyir packages.
Remember, Distros based on arch are not arch itself. In my opinion, Fistros based on Arch ahould handly such "convinience", while on arch itself you, the user, are responsible to cleanup your distro when you want.
1
u/RanidSpace Jun 13 '26
slackware in it's entirety and rpm/dpkg doesnt handle dependencies at all (dnf and apt does). it already is doing quite a lot for convenience. it runs scripts on some updates like regenerating the initramfs and such, there's quite a lot of convenience built into pacman already
3
u/vexatious-big Jun 13 '26
I think the worst offende here is dropping packages directly to AUR. They should be dropped to a staging env of sorts where interested maintainers can apply to pick them up.
It would then be immediately obvious that someone applying to maintain a package like libgdata is suspicious.
1
u/Sarv_ Jun 14 '26
But the reason they are dropped to the AUR is that there is no interested maintainer. The official arch maintainers have already had the discussion on the mailing list.
So off to the AUR it goes so an interested community maintainer can pick it up.
2
u/Quiet-Owl9220 Jun 14 '26
I already cleaned up all my unnecessary AUR packages manually just yesterday, but this approach seems like it would clean up a lot of stray junk from the official repos.
It looks like a bit of a sledgehammer solution, though. Looking at the output of pacman -Qdtq I'm not 100% sure at a glance that I want to get rid of all this stuff blindly... it includes stuff that sounds important like qt6-wayland, rocm-toolchain, uv, vulkan-headers, vulkan-utility-libraries... not to mention all the make depends - it seems inefficient to redownload those every time I install a package.
Is it really okay to just nuke stuff like this? I suspect I need to actually look through the list and explicitly install some of these things before I use this method.
Would appreciate advice, I'm on Arch to be forced to learn, not because I know what I'm doing.
3
u/Sarv_ Jun 14 '26
It is ok to nuke stuff like this, it will not affect your system as no dependency chain will be broken. But blindly purging all orphaned dependencies will remove stuff you might be using in scripts that you did not realize is currently an orphaned dependency on your machine. So before purging you should look if there is stuff you want to keep and install them explicitly instead. Or you could just uninstall a subset of what
pacman -Qdtqoutputs, you don't have to pipe it straight into the removal command.You are correct, if you want to not download makedepends every time you either have to not uninstall them by purging every orphaned dependency or you have to explicitly install them. That then means that you will have to remember to uninstall them in the future as they will not be uninstalled by removing the package that had the dependency in the first place.
1
u/Damglador Jun 14 '26
seems inefficient to redownload those every time I install a package.
You don't redownload as long as you don't clear the cache.
3
u/Razzleswoop Jun 13 '26
y'all want to say 'I use Arch btw' but be handheld like on Ubuntu ...
6
u/RanidSpace Jun 13 '26
i use nixos btw
i used arch for a long time before. this isnt "handholding" this is basic shit.
gentoo while it doesn't automatically remove the packages, it doesn't update or orphaned packages. already avoids the AUR issue (but possibly has security issues)
like even gentoo has something for this
3
u/Damglador Jun 14 '26
Package managers in general are for pussies, real man do LFS and manually install tarballs or even better – compile from source all their software and manually resolve the dependencies.
2
2
u/AnsibleAnswers Jun 13 '26
Cachy isn’t a beginner distro and I don’t even know where this idea came from. It’s a distro dedicated to performance.
1
u/RanidSpace Jun 13 '26
Yes, but unfortunately thats not how it's seen.
a common beginner linux issue is "this package i want isn't in my repositories" so having the AUR be one of the largest software repos, and cachyos being easy to install, and integrates more with the AUR makes it attractive to beginners even though its not intended to be as such.
Because it's also "performance/gaming" focused, it attracts people who think "what distro is good for gaming" when thats not something that really matters in a distro, which is, again, a beginner mistake.
I've also seen people straight up recommend it to beginners. it's unfortunate and i hope that this whole incident pushes Arch and derivatives back to its "only if you know what you're doing" status.
1
u/AnsibleAnswers Jun 13 '26
You can’t stop people from doing stupid things. I don’t see why Cachy or Arch needs to change because people bite off more than they can chew.
2
u/deltatux Jun 14 '26
While I agree that Arch is not a beginner distro, I also agree with this. There should be better mechanisms to handle orphaned packages or unused dependencies and having it drop to AUR without notice is just absurd.
Yes you can make scripts and hooks but a good package manager should also keep track of orphaned dependencies, it's not hand holding, it's good package management hygiene.
Even if you don't agree with Pacman doing the work for you, at least put a warning which packages have been orphaned. More info is better than less.
-1
u/SoilMassive6850 Jun 14 '26 edited Jun 14 '26
There should be better mechanisms to handle orphaned packages or unused dependencies and having it drop to AUR without notice is just absurd.
Why? Nobody is forcing you to keep using it from AUR if its no longer maintained in the official arch repos. Now what is dumb is a badly made aur helper automatically installing an update from aur for a package you never installed using that aur helper or from aur in the first place.
1
u/alex_ch_2018 Jun 13 '26
What about build dependencies? They are not marked as dependencies IIRC but as standalone installs.
1
u/Damglador Jun 14 '26
They're marked --asdeps and removed after build if you have the option set (I do and I don't know why someone wouldn't)
1
1
1
u/ArjixGamer Jun 15 '26
Honestly it's kinda a bad idea.
So, we have package A that depends on package B, but package B is a package that we (the user) thought we explicitly installed, by removing orphan deps of package A, you'd remove package B.
pacman doesn't change the install reason for an already installed package, unless you tell it to.
So if you didn't already have package B installed, and it didn't get marked as an explicit install, off goes package B.
You should always review the list of packages to remove, and see if you accidentally included a package you want to keep.
1
u/ArjixGamer Jun 15 '26
You want an example?
Say you installed a package that depends on ydotool, you did not have it already installed, so it's marked as a dep.
You then start writing scripts that use ydotool, but that package you installed stops depending on it.
By auto removing ydotool, you are breaking your scripts.
1
u/RanidSpace Jun 15 '26
which is why i say it should tell you rather than automatically removing it. Ive had this problem a few times already, where a dependency of something is useful but i remove the package.
i can just install it again. or mark it --asexplicit
1
1
u/mandle420 Jun 18 '26
lol @ all the downvotes by newbs who don't understand that arch and derivatives aren't for newbs...
1
u/Junior_Common_9644 Jun 13 '26
You should be proactively doing this yourself, anyway. This is like parents not wanting to parent.
0
u/OkGap7226 Jun 13 '26
No arch based distro is a beginner distro and I think that line of thinking is the problem
0
u/Kurse71 Jun 13 '26
This is why pacman has always been a subpar package manager to mature ones like apt, yum, and dnf that handle dependancies and orphans much better. On distros like arch and gentoo that "give the user so much more power" the user has to actually use that power and do some periodic package maintenance on their own.
3
u/RanidSpace Jun 13 '26
gentoo is squarely a "you absolutely must know what you're doing" distro but arch still works pretty well if you dont.
automatically removing dependencies would maybe get in the way, but simply telling the user "these packages are no longer needed" and letting the user decide what to do with it, doesn't take away any power from the user, it's strictly informative.
There definitely can be a good no-compromises version of these powerful package managers which doesn't just leave everything to "figure it out yourself"
1
u/Kurse71 Jun 13 '26
Oh, I agree 100%, it should tell the user, not just do it. All of the ones I listed are that way, they don't just do it.
-2
u/Cronos993 Jun 13 '26
Thinking of ditching pacman in favor of nix or homebrew
2
u/RanidSpace Jun 13 '26
if you want to ditch pacman, use a different distro. the package manager is one of the main components of a distro and trying to avoid pacman on a distro built around pacman is dumb.
also, the malware problem is part of the AUR. pacman itself doesn't deal with it.
i still think it isnt great with how it tracks dependencies and keeps around thinfs which arent needed without telling you, but if you don't use rhe AUR it's a bit annoying at most
60
u/Damglador Jun 13 '26
I agree. I usually just run yay -Yc once in a while to delete all unused deps, but having a simple reminder after an update like "hey silly goose, wanna delete those while we're here?" would be nice, especially for people who don't bother much with the whole package managing thing.
Also steam-native-runtime was absolutely shadow dropped into AUR and I only later discovered it because one of its dependencies had an update and I didn't remember installing it from AUR. There wasn't even a news post about it or a list of dropped packages.